I was checking a credential again this morning.
Same one I had verified a few days ago.
Didn’t expect anything different.
It had passed cleanly before.
Pulled it again.
Same attester.
Same data.
Same reference.
But it didn’t resolve the same way.
Not broken.
Just... different.
That part didn’t sit right.
So I pulled the earlier result side by side.
Compared them line by line.
That’s when it showed up.
The credential hadn’t changed.
But something behind it had.
I went back to the schema.
Pulled it directly from the registry.
Same schemaId.
Different definition.
At first I thought I had the wrong one.
Checked again.
Matched.
Still felt off.
Then I checked older pulls.
Previous records.
They weren’t the same.
The structure had shifted.
Subtly.
Field ordering.
Validation rules.
One field resolving differently than before.
Nothing that would fail verification.
But enough to change what the credential actually meant.
That’s when it narrowed down.
I wasn’t reading the credential the same way anymore.
The credential only carries schemaId.
No version.
No snapshot.
No anchor to what it meant when it was issued.
That’s where it gets uncomfortable.
A credential is supposed to be stable.
Something you can verify later and get the same result.
But here...
the meaning isn’t fixed.
It moves.
It depends on what the schema looks like at the time of verification.
Not at the time of issuance.
I tried to find where the version was locked.
Some reference.
Some snapshot.
Couldn’t find one.
So when the schema changes...
the interpretation changes with it.
Schema version gap.
Not a mismatch.
Not an error.
A gap between what the credential meant when it was issued...
and what it means now.
I kept testing it.
An access system reading the credential today...
would evaluate it differently than it did a few days ago.
Same credential.
Different outcome.
Nothing fails.
Nothing signals the change.
It just shifts quietly.
That’s the part I’m watching now.
Because once schemas start moving like this...
verification isn’t confirming anything anymore.
It’s rewriting what the credential means.
$SIGN only matters if a credential stays anchored to the schema version it was issued against...
not just the schemaId.
Because once meaning can change without the credential changing...
verification stops being confirmation.
And becomes reinterpretation.
So the real question becomes this.
If a credential depends on a schema that can evolve...
what exactly are you verifying when you verify it later?