README
¶
provin OSS
Decentralized data pipeline engine — the provin wire profile (reference
implementation) of the dPLaaX protocol. Every data transformation is
cryptographically signed as a W3C Verifiable Credential, forming a linear provenance
chain that any participant can verify independently. DB-free, YAML-driven,
self-hostable.
Self-hosting a node means standing up its authorization layer too: the node is
fail-closed and needs a policy decision point (PDP). For an authenticated stack —
real auth.provider + policy-verifier + node + NATS in one command, driving a
record to a VERIFIED verdict — see deploy/quickstart/.
The PDP backend is pluggable (o3co | opa | cedar | static); static is an
authorization allow-list, not authentication (see
network/README.md).
Status: PoC skeleton. Directory structure and per-layer conventions are in place; interfaces and implementations land incrementally.
Naming
| Surface | Name | Where it appears |
|---|---|---|
| Protocol | dplaax |
proto namespace (dplaax.*.v1), DID method (did:dplaax), JSON-LD context IRIs |
| Product | provin |
this repository, CLI binary (provin), Docker images |
PoC-ness is expressed in the registry segment of DIDs (e.g.
did:dplaax:poc.dplaax.dev:org:acme), never in the method name — so provenance chains
survive the PoC → production transition.
Layout
api/protobuf/ protocol definitions (buf; namespace dplaax.*.v1)
gen/ generated code (committed — buf not required to build)
network/ registry & coordination services (control-plane library + handlers)
pipeline/ Pipeline Process peer catalog + shared mechanics
cmd/standalone/ network node binary (registry control plane + pipeline data plane)
cmd/provin/ operator CLI
conformance/ provin profile conformance vectors + harness (test-only)
docs/ architecture / concepts / protocol / did
scripts/ lint hygiene checks (run by `make lint`)
The remaining top-level directories are the library packages — pure domain
libraries consumed by network/, pipeline/, and cmd/ (see
Library packages).
Dependency direction (strict, one-way)
cmd/ network/ pipeline/ (consumers)
│
▼
library packages (pure domain; no proto, no internal deps)
▲
│
gen/ ◄── api/protobuf (wire types; consumed by network/pipeline/cmd only)
Library packages never import gen/. network/ and pipeline/ never import each
other — they interact exclusively over the wire (ConnectRPC / NATS).
Library packages
- No internal dependencies: no library package imports
gen/,network/,pipeline/, orcmd/. Proto-generated types never appear here. - One-way consumption: consumers depend on library packages; never the reverse.
- Interfaces here are the stable contracts of the system. Renaming or reshaping an exported identifier in this layer is a breaking change for every consumer.
| Package | Responsibility |
|---|---|
did/ |
DID domain: W3C document model, method dispatch (MethodOf); the did:dplaax method (T1) in did/dplaax |
canon/ |
Canonicalization of signing scopes: JCS (RFC 8785), URDNA2015, strict JSON decoding |
vc/ |
W3C VC Data Integrity: credential model, builder, verifier, cryptosuites, confidence axes |
crypto/ |
Key generation / signing / verification interfaces + Ed25519 implementation |
delegation/ |
Owner-signed delegation credentials for Pipeline/Process DIDs |
resolver/ |
DID Document resolution interface + local / grpc / multi implementations |
keystore/ |
Private-key storage contract (KMS-model boundary) |
tlog/ |
Per-organization transparency log: append-only, tamper-evident record sequences (audit substrate) |
hoconconfig/ |
Three-layer HOCON configuration loader |
orgverify/ |
DNS-based organization identity verification |
Internal dependency DAG (within the library layer):
vc ──► did, canon, crypto
delegation ──► vc, did, crypto
resolver ──► did
orgverify ──► did, resolver
keystore ──► crypto
tlog ──► crypto
Pipeline Process model
A pipeline is a graph composition of four peer process types — none is privileged:
| Type | Definitional property |
|---|---|
| Chained Process | Stateless 1:1 transformation; preserves the VC chain |
| Source Process | Emits a new FirstDrop VC (cuts the chain) |
| Sink Process | Terminates the chain; writes to the outside world |
| Custom Process | Conforms to the Pipeline Contract on at least one I/O side |
See pipeline/README.md. Extension adapters live in separate repositories and implement pipeline/contract.
License
Apache License 2.0 — see LICENSE.
Directories
¶
| Path | Synopsis |
|---|---|
|
Package allowlist matches a candidate DID against a trust pattern — the admission decision behind a pipeline's allow-list.
|
Package allowlist matches a candidate DID against a trust pattern — the admission decision behind a pipeline's allow-list. |
|
Package bundle defines the portable audit-evidence bundle: the on-disk convention a relying party archives during live operation so that a provenance chain re-verifies offline — years later, with every piece of the emitting infrastructure gone — plus the assembly (Export) and the offline verification (Verify) that operate it.
|
Package bundle defines the portable audit-evidence bundle: the on-disk convention a relying party archives during live operation so that a provenance chain re-verifies offline — years later, with every piece of the emitting infrastructure gone — plus the assembly (Export) and the offline verification (Verify) that operate it. |
|
Package canon owns the deterministic byte representation of JSON signing scopes ("canonicalization") and the strict decoder that protects them.
|
Package canon owns the deterministic byte representation of JSON signing scopes ("canonicalization") and the strict decoder that protects them. |
|
jcs
Package jcs implements RFC 8785 (JSON Canonicalization Scheme) — the Phase 1 (MUST) canonicalization for dplaax signing scopes.
|
Package jcs implements RFC 8785 (JSON Canonicalization Scheme) — the Phase 1 (MUST) canonicalization for dplaax signing scopes. |
|
urdna2015
Package urdna2015 implements RDF Dataset Normalization (URDNA2015) for the eddsa-rdfc-2022 cryptosuite (Phase 2, MAY).
|
Package urdna2015 implements RDF Dataset Normalization (URDNA2015) for the eddsa-rdfc-2022 cryptosuite (Phase 2, MAY). |
|
cmd
|
|
|
provin
command
Command provin is the operator CLI for DID, schema, and chain management against a dplaax registry (see README.md).
|
Command provin is the operator CLI for DID, schema, and chain management against a dplaax registry (see README.md). |
|
provin/internal/client
Package client builds the ConnectRPC clients the provin CLI drives a registry with: base-URL validation, the L1 bearer-token interceptor, and nothing else — commands own request shaping, this package owns the wire.
|
Package client builds the ConnectRPC clients the provin CLI drives a registry with: base-URL validation, the L1 bearer-token interceptor, and nothing else — commands own request shaping, this package owns the wire. |
|
provin/internal/commands
Package commands implements the provin CLI's command groups (one file per group).
|
Package commands implements the provin CLI's command groups (one file per group). |
|
provin/internal/keyfile
Package keyfile persists a CLI-local owner key as a single JWK file — the only private key that ever exists outside the registry (KMS model; see cmd/provin/README.md).
|
Package keyfile persists a CLI-local owner key as a single JWK file — the only private key that ever exists outside the registry (KMS model; see cmd/provin/README.md). |
|
standalone
command
Command standalone is the dplaax network registry server: a single binary that loads its HOCON config, constructs the DID / Schema / Signer services over file-backed stores, and serves them via ConnectRPC (h2c) behind the L1 authorization interceptors, plus the public W3C DID resolution route, /healthz (liveness), and /readyz (dependency-aware readiness).
|
Command standalone is the dplaax network registry server: a single binary that loads its HOCON config, constructs the DID / Schema / Signer services over file-backed stores, and serves them via ConnectRPC (h2c) behind the L1 authorization interceptors, plus the public W3C DID resolution route, /healthz (liveness), and /readyz (dependency-aware readiness). |
|
Package crypto defines the key-generation, signing, and verification interfaces.
|
Package crypto defines the key-generation, signing, and verification interfaces. |
|
ed25519
Package ed25519 is the Ed25519 implementation of the crypto interfaces — the PoC's only signature suite.
|
Package ed25519 is the Ed25519 implementation of the crypto interfaces — the PoC's only signature suite. |
|
Package delegation implements the owner-signed DelegationCredential: an Owner DID's assertion that a Pipeline or Process DID acts under its authority.
|
Package delegation implements the owner-signed DelegationCredential: an Owner DID's assertion that a Pipeline or Process DID acts under its authority. |
|
deploy
|
|
|
quickstart/provision
command
Command provision lays down the operator-mode NATS trust material the quickstart's broker and standalone node consume — an operator trust root, one account, the account's claims JWT in a resolver directory, and a broker config that preloads it.
|
Command provision lays down the operator-mode NATS trust material the quickstart's broker and standalone node consume — an operator trust root, one account, the account's claims JWT in a resolver directory, and a broker config that preloads it. |
|
Package did is the method-agnostic DID domain: the W3C DID Document model shared by every consumer (resolution, verification, key extraction) and the method-dispatch primitive.
|
Package did is the method-agnostic DID domain: the W3C DID Document model shared by every consumer (resolution, verification, key extraction) and the method-dispatch primitive. |
|
dplaax
Package dplaax implements the did:dplaax DID method — the T1 native method of the provin profile and the only method admitted on the credential-issuance plane (Process / Pipeline / Owner DIDs behind a PipelinePassCredential's issuer).
|
Package dplaax implements the did:dplaax DID method — the T1 native method of the provin profile and the only method admitted on the credential-issuance plane (Process / Pipeline / Owner DIDs behind a PipelinePassCredential's issuer). |
|
gen
|
|
|
Package hoconconfig implements a three-layer HOCON configuration loader.
|
Package hoconconfig implements a three-layer HOCON configuration loader. |
|
Package keystore defines the raw private-key custody contract: persisting and retrieving key material for at-issuance key generation and for CLI-local / test owner keys.
|
Package keystore defines the raw private-key custody contract: persisting and retrieving key material for at-issuance key generation and for CLI-local / test owner keys. |
|
filestore
Package filestore is the file-backed keystore.KeyStore: the production key-at-rest store for the registry process (KMS model).
|
Package filestore is the file-backed keystore.KeyStore: the production key-at-rest store for the registry process (KMS model). |
|
network
|
|
|
pkg/auth
Package auth is the network layer's authorization-enforcement wiring (the PEP).
|
Package auth is the network layer's authorization-enforcement wiring (the PEP). |
|
pkg/chainconfig
Package chainconfig is the chain transport configuration layer: it selects the pub-sub backend (nats in production, noop in debug builds) and carries the nats parameters (endpoint, account/trust-root seeds, resolver directory, node identity).
|
Package chainconfig is the chain transport configuration layer: it selects the pub-sub backend (nats in production, noop in debug builds) and carries the nats parameters (endpoint, account/trust-root seeds, resolver directory, node identity). |
|
pkg/core
Package core is the network server foundation: SSRF-resistant outbound URL validation, secret URI resolution, and the typed/validated config tree built on hoconconfig.
|
Package core is the network server foundation: SSRF-resistant outbound URL validation, secret URI resolution, and the typed/validated config tree built on hoconconfig. |
|
pkg/didresolver
Package didresolver is the outbound, cross-registry DID resolver: given a did:dplaax DID it derives the owning registry's W3C resolution URL, fetches the document over an SSRF-guarded HTTP client, and returns the parsed *did.DIDDocument.
|
Package didresolver is the outbound, cross-registry DID resolver: given a did:dplaax DID it derives the owning registry's W3C resolution URL, fetches the document over an SSRF-guarded HTTP client, and returns the parsed *did.DIDDocument. |
|
pkg/pagination
Package pagination codifies the repo's paged-RPC conventions, set by the discovery slice's first paged RPCs and shared by every later one:
|
Package pagination codifies the repo's paged-RPC conventions, set by the discovery slice's first paged RPCs and shared by every later one: |
|
pkg/pipelineconfig
Package pipelineconfig is the data-plane configuration layer: it declares the pipeline transport loops a standalone node runs.
|
Package pipelineconfig is the data-plane configuration layer: it declares the pipeline transport loops a standalone node runs. |
|
pkg/registry
Package registry is the registry-identity configuration layer: the did:dplaax {registry} segment this server is authoritative for, and the service endpoints embedded in every issued DID Document.
|
Package registry is the registry-identity configuration layer: the did:dplaax {registry} segment this server is authoritative for, and the service endpoints embedded in every issued DID Document. |
|
pkg/services/auditor
Package auditor is the verdict half of the async chain-audit path (slice-17h): a background Runner drains a registry of consumed chain heads, assembles each chain from the LOCAL store (the substrate slice-17g fills) by reusing chainwalk over a local-store resolver, runs vc.VerifyChain (L1 proofs + chain structure + origin), and records a per-head audit status (three-state + per-axis + coverage).
|
Package auditor is the verdict half of the async chain-audit path (slice-17h): a background Runner drains a registry of consumed chain heads, assembles each chain from the LOCAL store (the substrate slice-17g fills) by reusing chainwalk over a local-store resolver, runs vc.VerifyChain (L1 proofs + chain structure + origin), and records a per-head audit status (three-state + per-axis + coverage). |
|
pkg/services/auditor/filestore
Package filestore is the file-backed implementation of the auditor's StatusStore, ReceiptStore, and AuditQueue — the durable audit half of the evidence substrate (spec: evidence-persistence, e2e finding #23).
|
Package filestore is the file-backed implementation of the auditor's StatusStore, ReceiptStore, and AuditQueue — the durable audit half of the evidence substrate (spec: evidence-persistence, e2e finding #23). |
|
pkg/services/auditor/handler
Package handler is the proto↔domain boundary for AuditService: it converts the recorded auditor.AuditRecord to the wire response and maps the read service's sentinel errors to Connect codes (errors.Is, never string matching).
|
Package handler is the proto↔domain boundary for AuditService: it converts the recorded auditor.AuditRecord to the wire response and maps the read service's sentinel errors to Connect codes (errors.Is, never string matching). |
|
pkg/services/auditor/internal/storecontract
Package storecontract is the shared behavioral suite for auditor StatusStore, ReceiptStore, and AuditQueue implementations: the mem and file stores both run it, so their semantics (sentinel errors, dedup, attempt preservation, ordering) cannot drift apart silently.
|
Package storecontract is the shared behavioral suite for auditor StatusStore, ReceiptStore, and AuditQueue implementations: the mem and file stores both run it, so their semantics (sentinel errors, dedup, attempt preservation, ordering) cannot drift apart silently. |
|
pkg/services/chainmanager
Package chainmanager is the cross-pipeline connection control plane: two surfaces over one frozen wire (dplaax.chain.v1).
|
Package chainmanager is the cross-pipeline connection control plane: two surfaces over one frozen wire (dplaax.chain.v1). |
|
pkg/services/chainmanager/evidence
Package evidence is the chain manager's relationship-evidence log: the durable, append-only record of a counterparty-signed control-plane request plus the key material used to verify it (transfer.relationship.record).
|
Package evidence is the chain manager's relationship-evidence log: the durable, append-only record of a counterparty-signed control-plane request plus the key material used to verify it (transfer.relationship.record). |
|
pkg/services/chainmanager/handler
Package handler is the proto↔domain boundary for the chainmanager services.
|
Package handler is the proto↔domain boundary for the chainmanager services. |
|
pkg/services/chainmanager/infra
Package infra defines the transport-level operator abstraction for chain connections — the Hub swap point for the network-side pub-sub backend.
|
Package infra defines the transport-level operator abstraction for chain connections — the Hub swap point for the network-side pub-sub backend. |
|
pkg/services/chainmanager/infra/nats
Package nats is the production-shaped infra.Operator: a NATS decentralized-auth control-plane that maintains one local NATS account's exports/imports as a signed account-claims JWT, so the broker — independently of the peer-layer admission (slice-11/12) — enforces cross-account isolation.
|
Package nats is the production-shaped infra.Operator: a NATS decentralized-auth control-plane that maintains one local NATS account's exports/imports as a signed account-claims JWT, so the broker — independently of the peer-layer admission (slice-11/12) — enforces cross-account isolation. |
|
pkg/services/chainmanager/infra/noop
Package noop is a debug/test-only infra.Operator: it records nothing and wires no real transport.
|
Package noop is a debug/test-only infra.Operator: it records nothing and wires no real transport. |
|
pkg/services/chainmanager/peerclient
Package peerclient is the outbound side of the chainmanager connection flow: the ConnectRPC client this CM uses to call a remote publisher's ChainPeerService.
|
Package peerclient is the outbound side of the chainmanager connection flow: the ConnectRPC client this CM uses to call a remote publisher's ChainPeerService. |
|
pkg/services/chainmanager/store
Package store defines the persistence contracts of the chain manager: subscriptions and allow-lists.
|
Package store defines the persistence contracts of the chain manager: subscriptions and allow-lists. |
|
pkg/services/chainmanager/store/memstore
Package memstore is the in-memory chainmanager store: SubscriptionStore and AllowListStore backed by mutex-guarded maps.
|
Package memstore is the in-memory chainmanager store: SubscriptionStore and AllowListStore backed by mutex-guarded maps. |
|
pkg/services/chainmanager/store/yamlstore
Package yamlstore is the filesystem chainmanager store: SubscriptionStore and AllowListStore persisted as one YAML file per record under a root directory.
|
Package yamlstore is the filesystem chainmanager store: SubscriptionStore and AllowListStore persisted as one YAML file per record under a root directory. |
|
pkg/services/chainmanager/wireauth
Package wireauth is the L2 peer-authentication layer of the chain manager: every internet-facing ChainPeerService RPC carries an Ed25519 Proof over a JCS-canonicalized per-RPC view, and this package signs and verifies them.
|
Package wireauth is the L2 peer-authentication layer of the chain manager: every internet-facing ChainPeerService RPC carries an Ed25519 Proof over a JCS-canonicalized per-RPC view, and this package signs and verifies them. |
|
pkg/services/didregistry
Package didregistry is the domain service of the DID-lifecycle registry: it registers self-sovereign Owner DIDs, issues Pipeline/Process DIDs under owner-signed delegations, resolves documents and delegations, revokes, lists, and maintains each DID's append-only lifecycle log.
|
Package didregistry is the domain service of the DID-lifecycle registry: it registers self-sovereign Owner DIDs, issues Pipeline/Process DIDs under owner-signed delegations, resolves documents and delegations, revokes, lists, and maintains each DID's append-only lifecycle log. |
|
pkg/services/didregistry/handler
Package handler is the proto↔domain boundary for DIDService: it converts connect request/response messages to and from the didregistry domain types and maps domain sentinel errors to Connect codes.
|
Package handler is the proto↔domain boundary for DIDService: it converts connect request/response messages to and from the didregistry domain types and maps domain sentinel errors to Connect codes. |
|
pkg/services/didregistry/store
Package store defines the persistence contracts of the DID registry service.
|
Package store defines the persistence contracts of the DID registry service. |
|
pkg/services/didregistry/store/yamlstore
Package yamlstore is the filesystem DIDStore: the did:dplaax hierarchy maps to a directory tree and each DID node holds its document, delegation, status, and append-only lifecycle log as files.
|
Package yamlstore is the filesystem DIDStore: the did:dplaax hierarchy maps to a directory tree and each DID node holds its document, delegation, status, and append-only lifecycle log as files. |
|
pkg/services/payloadresolver
Package payloadresolver is the publisher's serving-boundary domain for by-reference payload delivery: it retains the payload bytes a producing process emitted (keyed by their content address) together with the set of pipeline DIDs that emitted them, and serves them back by content address.
|
Package payloadresolver is the publisher's serving-boundary domain for by-reference payload delivery: it retains the payload bytes a producing process emitted (keyed by their content address) together with the set of pipeline DIDs that emitted them, and serves them back by content address. |
|
pkg/services/payloadresolver/client
Package client is the production network client for a PayloadService: it dereferences a by-reference payload by content address from a publisher's serving boundary.
|
Package client is the production network client for a PayloadService: it dereferences a by-reference payload by content address from a publisher's serving boundary. |
|
pkg/services/payloadresolver/filestore
Package filestore is the file-backed payloadresolver.Store — the durable serving substrate for by-reference payload delivery.
|
Package filestore is the file-backed payloadresolver.Store — the durable serving substrate for by-reference payload delivery. |
|
pkg/services/payloadresolver/handler
Package handler is the proto↔domain boundary for PayloadService: it verifies each request's L2 wireauth proof in-band (no L1 interceptor — mirrors the chain.v1 peer surface), admits the caller against the payload's owner set, and streams the bytes back.
|
Package handler is the proto↔domain boundary for PayloadService: it verifies each request's L2 wireauth proof in-band (no L1 interceptor — mirrors the chain.v1 peer surface), admits the caller against the payload's owner set, and streams the bytes back. |
|
pkg/services/payloadresolver/memstore
Package memstore is the in-memory payloadresolver.Store — the non-durable sibling of filestore, for tests and ephemeral deployments.
|
Package memstore is the in-memory payloadresolver.Store — the non-durable sibling of filestore, for tests and ephemeral deployments. |
|
pkg/services/schemaregistry
Package schemaregistry is the domain service of the append-only schema registry: it assigns content-addressed versions, validates schema bodies at admission, and enforces idempotent registration over a SchemaStore.
|
Package schemaregistry is the domain service of the append-only schema registry: it assigns content-addressed versions, validates schema bodies at admission, and enforces idempotent registration over a SchemaStore. |
|
pkg/services/schemaregistry/handler
Package handler is the proto↔domain boundary for SchemaService: it converts connect request/response messages to and from the schemaregistry domain types and maps domain sentinel errors to Connect codes.
|
Package handler is the proto↔domain boundary for SchemaService: it converts connect request/response messages to and from the schemaregistry domain types and maps domain sentinel errors to Connect codes. |
|
pkg/services/schemaregistry/store
Package store defines the persistence contract of the schema registry.
|
Package store defines the persistence contract of the schema registry. |
|
pkg/services/schemaregistry/store/yamlstore
Package yamlstore is the filesystem SchemaStore: one YAML record per version at {root}/{name}/{version}.yaml.
|
Package yamlstore is the filesystem SchemaStore: one YAML record per version at {root}/{name}/{version}.yaml. |
|
pkg/services/signer
Package signer is the KMS-model signing service: it exposes the crypto.Signer seam over the network so private keys never cross the RPC boundary.
|
Package signer is the KMS-model signing service: it exposes the crypto.Signer seam over the network so private keys never cross the RPC boundary. |
|
pkg/services/signer/client
Package client is the production crypto.Signer that routes signing to a remote SignerService, so private keys stay server-side (the KMS model).
|
Package client is the production crypto.Signer that routes signing to a remote SignerService, so private keys stay server-side (the KMS model). |
|
pkg/services/signer/handler
Package handler is the proto↔domain boundary for SignerService: it converts connect request/response messages to and from the signer domain and maps domain sentinel errors to Connect codes.
|
Package handler is the proto↔domain boundary for SignerService: it converts connect request/response messages to and from the signer domain and maps domain sentinel errors to Connect codes. |
|
pkg/services/tlogservice
Package tlogservice is the read service behind dplaax.tlog.v1.TlogService: a registry of the node's per-loop emission logs (keyed by log id = the producing loop's output subject), serving signed checkpoints and record ranges for transport-loss reconciliation.
|
Package tlogservice is the read service behind dplaax.tlog.v1.TlogService: a registry of the node's per-loop emission logs (keyed by log id = the producing loop's output subject), serving signed checkpoints and record ranges for transport-loss reconciliation. |
|
pkg/services/tlogservice/handler
Package handler is the proto↔domain boundary for TlogService: it converts wire messages to and from the tlogservice domain and maps sentinel errors to Connect codes (errors.Is, never string matching).
|
Package handler is the proto↔domain boundary for TlogService: it converts wire messages to and from the tlogservice domain and maps sentinel errors to Connect codes (errors.Is, never string matching). |
|
pkg/services/vcresolver
Package vcresolver stores VCs submitted by pipeline runtimes and resolves previousCredential chains across registry boundaries.
|
Package vcresolver stores VCs submitted by pipeline runtimes and resolves previousCredential chains across registry boundaries. |
|
pkg/services/vcresolver/batchresolver
Package batchresolver drains the vcresolver unresolved pool: a background Runner periodically lists queued predecessor holes, fetches each missing credential from a peer's VCResolverService, verifies its content address, and re-submits it through the local StoreVC seam — which fills the hole and enqueues the next-deeper predecessor.
|
Package batchresolver drains the vcresolver unresolved pool: a background Runner periodically lists queued predecessor holes, fetches each missing credential from a peer's VCResolverService, verifies its content address, and re-submits it through the local StoreVC seam — which fills the hole and enqueues the next-deeper predecessor. |
|
pkg/services/vcresolver/client
Package client is the production network client for a VCResolverService: it resolves pipeline credentials by content address and publishes issued credentials to the store.
|
Package client is the production network client for a VCResolverService: it resolves pipeline credentials by content address and publishes issued credentials to the store. |
|
pkg/services/vcresolver/filestore
Package filestore is the file-backed implementation of the vcresolver Store and Pool — the durable evidence substrate (spec: evidence-persistence, driven by e2e finding #23: a restart must not erase the audit evidence).
|
Package filestore is the file-backed implementation of the vcresolver Store and Pool — the durable evidence substrate (spec: evidence-persistence, driven by e2e finding #23: a restart must not erase the audit evidence). |
|
pkg/services/vcresolver/handler
Package handler is the proto↔domain boundary for VCResolverService: it converts connect request/response messages to and from the vcresolver domain and maps domain sentinel errors to Connect codes.
|
Package handler is the proto↔domain boundary for VCResolverService: it converts connect request/response messages to and from the vcresolver domain and maps domain sentinel errors to Connect codes. |
|
pkg/services/vcresolver/internal/storecontract
Package storecontract is the shared behavioral suite for vcresolver Store and Pool implementations: the mem and file stores both run it, so their semantics (upsert merge, ordering, sentinel errors) cannot drift apart silently — the parity the evidence-persistence spec pins.
|
Package storecontract is the shared behavioral suite for vcresolver Store and Pool implementations: the mem and file stores both run it, so their semantics (upsert merge, ordering, sentinel errors) cannot drift apart silently — the parity the evidence-persistence spec pins. |
|
pkg/services/vcresolver/memstore
Package memstore is the in-memory PoC implementation of the vcresolver Store and Pool.
|
Package memstore is the in-memory PoC implementation of the vcresolver Store and Pool. |
|
Package orgverify verifies that a did:dplaax Owner DID's orgId (FQDN) is endorsed by the actual domain owner via a DNS TXT record at _dplaax-org.<orgId>.
|
Package orgverify verifies that a did:dplaax Owner DID's orgId (FQDN) is endorsed by the actual domain owner via a DNS TXT record at _dplaax-org.<orgId>. |
|
pipeline
|
|
|
chained
Package chained implements the Chained Process event processor.
|
Package chained implements the Chained Process event processor. |
|
chained/converter
Package converter defines the Converter interface and subset output validation for the ConvertFlow pipeline step.
|
Package converter defines the Converter interface and subset output validation for the ConvertFlow pipeline step. |
|
chained/converter/jsonata
Package jsonata implements converter.Converter using JSONata expressions (github.com/blues/jsonata-go).
|
Package jsonata implements converter.Converter using JSONata expressions (github.com/blues/jsonata-go). |
|
chained/filter
Package filter defines the FilterFlow step contract: stateless conditional pass/drop over a single event payload.
|
Package filter defines the FilterFlow step contract: stateless conditional pass/drop over a single event payload. |
|
chained/filter/jsonata
Package jsonata implements filter.Filter using JSONata expressions (github.com/blues/jsonata-go).
|
Package jsonata implements filter.Filter using JSONata expressions (github.com/blues/jsonata-go). |
|
contract
Package contract defines the Pipeline Contract — the public contract every Pipeline Process conforms to on at least one I/O side.
|
Package contract defines the Pipeline Contract — the public contract every Pipeline Process conforms to on at least one I/O side. |
|
provenance
Package provenance defines the process-facing interfaces over the VC machinery in vc — shared signing/verification mechanics carrying no process semantics.
|
Package provenance defines the process-facing interfaces over the VC machinery in vc — shared signing/verification mechanics carrying no process semantics. |
|
provenance/chainwalk
Package chainwalk implements provenance.ChainVerifier by walking a credential chain from its head: it resolves each previousCredential by content address, assembles the chain origin-first, and delegates the per-credential and chain-structure verification to an injected core (vc.Verifier.VerifyChain semantics).
|
Package chainwalk implements provenance.ChainVerifier by walking a credential chain from its head: it resolves each previousCredential by content address, assembles the chain origin-first, and delegates the per-credential and chain-structure verification to an injected core (vc.Verifier.VerifyChain semantics). |
|
provenance/vcdid
Package vcdid is the DID/VC-backed implementation of the provenance signing capabilities: it adapts vc.Builder (Ed25519 Data Integrity signing behind a crypto.Signer) to the process-facing provenance.SourceSigner and provenance.ChainedSigner interfaces.
|
Package vcdid is the DID/VC-backed implementation of the provenance signing capabilities: it adapts vc.Builder (Ed25519 Data Integrity signing behind a crypto.Signer) to the process-facing provenance.SourceSigner and provenance.ChainedSigner interfaces. |
|
sink
Package sink implements the Sink Process runtime: it consumes a pipeline-conformant envelope, verifies the credential (or chain), writes the payload to an external system, and produces nothing in-network.
|
Package sink implements the Sink Process runtime: it consumes a pipeline-conformant envelope, verifies the credential (or chain), writes the payload to an external system, and produces nothing in-network. |
|
sink/console
Package console implements sink.Writer as an NDJSON emitter — the observation-only reference sink.
|
Package console implements sink.Writer as an NDJSON emitter — the observation-only reference sink. |
|
sink/file
Package file implements sink.Writer as a durable NDJSON append stream — the second reference sink surface.
|
Package file implements sink.Writer as a durable NDJSON append stream — the second reference sink surface. |
|
source/aggregate
Package aggregate implements the aggregate Source Process runtime: a stateful pool + window mechanic that consumes N Pipeline-conformant ingress inputs and, on a timer/window trigger, folds them into a single FirstDrop carrying a multi-source vc.SourceCommitment (transformationClaim provin:aggregate).
|
Package aggregate implements the aggregate Source Process runtime: a stateful pool + window mechanic that consumes N Pipeline-conformant ingress inputs and, on a timer/window trigger, folds them into a single FirstDrop carrying a multi-source vc.SourceCommitment (transformationClaim provin:aggregate). |
|
source/ingest
Package ingest implements the Source Process event processor for external ingestion (N=0): raw external bytes become a FirstDrop credential — a fresh chain origin.
|
Package ingest implements the Source Process event processor for external ingestion (N=0): raw external bytes become a FirstDrop credential — a fresh chain origin. |
|
source/ingest/apipush
Package apipush is the reference HTTP push adapter for external ingestion (pipeline/source/ingest/README.md): POST push accepts a JSON payload and publishes the bytes verbatim to a Source Process's input queue; GET health reports the underlying transport's liveness.
|
Package apipush is the reference HTTP push adapter for external ingestion (pipeline/source/ingest/README.md): POST push accepts a JSON payload and publishes the bytes verbatim to a Source Process's input queue; GET health reports the underlying transport's liveness. |
|
transport
Package transport defines the pub-sub boundary between Pipeline Processes.
|
Package transport defines the pub-sub boundary between Pipeline Processes. |
|
transport/envelopecodec
Package envelopecodec is the wire codec for pipeline envelopes — the reference implementation of contract.EnvelopeCodec over the dplaax.pipeline.v1 wire form.
|
Package envelopecodec is the wire codec for pipeline envelopes — the reference implementation of contract.EnvelopeCodec over the dplaax.pipeline.v1 wire form. |
|
transport/nats
Package nats is the production NATS backend for the pipeline transport boundary: it implements transport.Publisher and transport.Subscriber over the nats.go client.
|
Package nats is the production NATS backend for the pipeline transport boundary: it implements transport.Publisher and transport.Subscriber over the nats.go client. |
|
Package resolver defines DID Document resolution.
|
Package resolver defines DID Document resolution. |
|
local
Package local is the in-memory resolver.Resolver for tests and fixtures: a DID → DID Document map.
|
Package local is the in-memory resolver.Resolver for tests and fixtures: a DID → DID Document map. |
|
Package schema defines payload validation against registered schemas — the client-side contract of the schema registry.
|
Package schema defines payload validation against registered schemas — the client-side contract of the schema registry. |
|
internal/schemadoc
Package schemadoc is the single JSON Schema document policy shared by the schema-registry admission check (schema.ValidateJSONSchema) and the in-memory validator implementation (schema/local): strict-decode the document (the only JSON decode path permitted on protocol boundaries — duplicate keywords, trailing data and invalid Unicode are rejected), pin the dialect to Draft 2020-12 (the library's default tracks "latest supported" and shifts), and deny external $ref so a schema is self-contained as a structural guarantee.
|
Package schemadoc is the single JSON Schema document policy shared by the schema-registry admission check (schema.ValidateJSONSchema) and the in-memory validator implementation (schema/local): strict-decode the document (the only JSON decode path permitted on protocol boundaries — duplicate keywords, trailing data and invalid Unicode are rejected), pin the dialect to Draft 2020-12 (the library's default tracks "latest supported" and shifts), and deny external $ref so a schema is self-contained as a structural guarantee. |
|
local
Package local is the in-memory schema.Validator for the PoC and in-org deployments: a SchemaRef.ID → registered JSON Schema map, the validation counterpart of resolver/local.
|
Package local is the in-memory schema.Validator for the PoC and in-org deployments: a SchemaRef.ID → registered JSON Schema map, the validation counterpart of resolver/local. |
|
Package tlog defines the per-organization transparency log contract: append-only, tamper-evident, independently verifiable record sequences.
|
Package tlog defines the per-organization transparency log contract: append-only, tamper-evident, independently verifiable record sequences. |
|
filelog
Package filelog is the durable PoC implementation of tlog.Log: an append-only, hash-chained NDJSON file, replay-verified at open.
|
Package filelog is the durable PoC implementation of tlog.Log: an append-only, hash-chained NDJSON file, replay-verified at open. |
|
internal/logcontract
Package logcontract is the shared behavioral suite for tlog.Log implementations: the mem and file logs both run it, so their semantics (dense zero-based indexes, the exact chain-hash formula, record immutability, out-of-range errors) cannot drift apart silently.
|
Package logcontract is the shared behavioral suite for tlog.Log implementations: the mem and file logs both run it, so their semantics (dense zero-based indexes, the exact chain-hash formula, record immutability, out-of-range errors) cannot drift apart silently. |
|
memlog
Package memlog is a minimal in-memory tlog.Log: an append-only, hash-chained, tamper-evident record sequence held in memory.
|
Package memlog is a minimal in-memory tlog.Log: an append-only, hash-chained, tamper-evident record sequence held in memory. |
|
Package vc implements W3C Verifiable Credentials with Data Integrity proofs: the credential model, proof creation/verification, cryptosuite dispatch, and trust evaluation for PipelinePassCredential — the VC issued at every pipeline process boundary.
|
Package vc implements W3C Verifiable Credentials with Data Integrity proofs: the credential model, proof creation/verification, cryptosuite dispatch, and trust evaluation for PipelinePassCredential — the VC issued at every pipeline process boundary. |
Click to show internal directories.
Click to hide internal directories.