[xgreenx]

Stacked on #2 (feat/ceremony-constructions). Two commits.

1. libid-attestations goes

It builds digests for Solidity that is no longer there. libid-contracts#21 removed the legacy login and transfer stack: _verifyNotarySignature, JwksOracle, XZkVerifier and the registry identity hash are all gone from libid-contracts main. The crate's own tests are named token_attest_digest_matches_solidity and me_attest_digest_matches_solidity, and there is no Solidity left for them to match — they now pin one Rust implementation against another Rust expectation.

Nothing in this workspace uses it. The only in-repo mention was a doc line in libid-crypto, which now points at libid-ceremony.

Ordering. Its last consumer is the notary's JWKS path (src/jwks/mock.rs, src/jwks/notary.rs on main, #3 and #6). libid-org/notary#7 removes that usage by making the JWKS reading an ordinary notarized session verified through NotaryService. Those branches pin a fixed revision of this repository, so they keep resolving against a tree that still has the crate; only a pin moved past this commit needs #7 in first.

Consumers outside the stack are unaffected. identity-backend and handles-backend call compute_notary_digest but pin the v0.2.0 and v0.1.0 release tags. Those published versions stay on crates.io — this just means there is no 0.3.0 of the crate.

2. The release surface follows the code

Removing a crate is half of it. The manifests, the README and the publish lists still described a workspace two crates and three types out of date, and nothing checks any of it:

• libid-transcript kept a ts feature and an optional ts-rs dependency. Every ts_rs::TS derive went with EvmProof, so --features ts compiled ts-rs and derived nothing. No consumer enables it, so this was weight rather than breakage.
• Its description — the string crates.io shows — still advertised "the EvmProof/NotaryResponse proof types". Both were deleted in feat: the ceremony wire constructions — digest, PKCE, attested data, reveal layouts #2. TlsHandshakeData survives and AttestationWire is new; the description names those.
• The README had no libid-ceremony row, documented the derive that no longer exists, and its usage sketch built an EvmProof.
• libid-ceremony carries no publish = false and was in neither publish-crates.sh nor the publish dry-run. A publishable crate nothing publishes is a v0.3.0 that ships an incomplete workspace. It goes after libid-crypto, which it depends on.

libid-ceremony's description also called the record "the section 9.1 types"; §9.1 is attestation verification and its fee, as #7 spells out.

Verification

• cargo +nightly fmt --all -- --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace — 93 passed
• cargo publish --dry-run -p libid-crypto -p libid-transcript -p libid-ceremony -p libid-signer — all four pack and rebuild from the packaged tarball

Siblings

#7 (requirement citations) and #8 (reveal layouts) sit on the same base and touch different files.