Architecture
Public Architecture
This page explains how the ECZ-ID public estate fits together: which surface does which job, where canonical state lives, how Resolver projects public proof, and how evidence is referenced. It describes boundaries and contracts, not private implementation.
INFORMATIVE Informative architecture
Canonical URL: https://www.ecocitizenz.org/pages/public-architecture
Surface boundaries Link to section: Surface boundaries
Each surface has one primary job and a defined authority. When two surfaces appear to claim the same authority, this matrix decides, and the weaker surface’s wording is corrected.
| Surface | Primary job | Authority | Does not claim |
|---|---|---|---|
| ecocitizenz.org (this site) | Governance, specifications, standards and institutional reference. | Documentary publication, only for explicitly controlled documents. Never live operational state. | Live state, transaction outcomes, regulatory endorsement, provisioning status or implementation authority. |
| ecocitizenz.com | Commercial and category front door. | Commercial discovery and category explanation. | To be the normative governance source or the current-proof surface. |
| Resolver | Current public proof. | Read-only public projection of backend-controlled state. | To be a checkout, control plane, policy engine or marketing page. |
| TrustOps | Acquisition, payment, entitlement, activation and lifecycle. | Operational commerce, entitlement and lifecycle within its scope. | To be normative governance, public proof or developer reference. |
| Developer Gateway | Implementation, interoperability, SDKs and schemas. | Implementation documentation for integration, not live proof. | To be the institutional governance source or live proof. |
| Dashboard | Authenticated operational workspace. | Operational control within an authorised user’s scope. Reached through TrustOps sign-in. | To be public proof or public governance. |
| Passport sites | Passport-specific discovery and acquisition. | Discovery and acquisition within each site’s published scope. | To replace parent governance, specifications or Resolver. |
| MSP | Managed-service and partner channel. | Managed-service and partner programme within its published scope. | Control of outcomes, Resolver truth or governance authority. |
Passport sites: Agents, MCP servers, APIs, IoT and connected products, Plugins, SDKs, Services and workloads.
Websites publish documentation. Backend state is canonical. Resolver verifies public proof.
Accountability chain Link to section: Accountability chain
- IDENTITY
- AUTHORITY
- DELEGATION
- INTENT
- CURRENT STATE
- DECISION
- ACTION
- RECEIPT
- EVIDENCE
- RE-VERIFY
| Stage | What it is | What it is not |
|---|---|---|
| Identity | Identifies a subject. | A grant of authority. |
| Authority | Scoped authority represented in ECZ-ID state. | Proof of every external legal power. |
| Delegation | An attributed grant of scoped authority. | Something inferred from a mere relationship. |
| Intent | A declared or requested intent. | A guarantee that anything will be executed. |
| Current state | Backend-controlled present state. | Anything shown on a static page such as this one. |
| Decision | A decision or context stage, where supported. | A replacement for the relying party’s own policy. |
| Action | An attributable, recorded action, where supported. | Proof of every downstream consequence. |
| Receipt | An event or evidence record. | Objective truth about the external world. |
| Evidence | Referenced evidence whose quality and relevance stay contextual. | Self-interpreting proof. |
| Re-verify | A current re-check. | Optional: earlier proof can become stale. |
Authority and state Link to section: Authority and state
The ECZ-ID backend is the canonical source of state: issuance, eligibility, entitlement, authority changes, lifecycle changes, suspension and revocation are controlled there through deterministic rules. The backend is not itself a public web surface.
TrustOps operates workflows over that state within its scope. It can show operational and entitlement status inside its own flows, but it is not the documentary governance source and it is not public proof.
This site describes the model. A static page cannot show current state.
Resolver model Link to section: Resolver model
- Read-only
- Resolver projects public-safe fields from backend state. It does not accept commands, take payment or change state.
- Current
- Resolver shows the current public proof and state available for an ECZ-ID or Passport. Earlier proof can become stale, which is why re-verification is a stage of the chain.
- For people and machines
- The same record is available in human-readable and machine-readable forms, so automated clients can re-check without interpreting prose.
- Bounded
- Resolver shows only what is safe to publish. Private provider data, credentials and internal records are never part of public proof.
Evidence model Link to section: Evidence model
ECZ-ID records receipts for system events and keeps references to supporting evidence such as manifest hashes, effective dates and public-safe receipt references.
A receipt records that an ECZ-ID system event or reference occurred. Its evidential meaning depends on its source and context; it is not proof of facts in the outside world. Evidence quality and relevance remain matters for the relying party.
Because history is retained, a past state can be reconstructed where the underlying records support it, even after the present state has changed.
What is deliberately not published Link to section: What is deliberately not published
Public architecture is disclosed at a safe level of abstraction. The following are never published on this site:
- Secrets, credentials, keys or tokens.
- Anti-abuse logic and privileged provisioning controls.
- Non-public security runbooks or sensitive network topology.
- Implementation detail that would materially increase attack surface.
Where to go next Link to section: Where to go next
Verify — Resolver
- Why leave this site
- This page explains rules. It cannot show whether a particular ECZ-ID, Passport or binding is current.
- Where you go
- Resolver (resolver.ecocitizenz.org)
- Authority there
- Current public proof: a read-only projection of backend-controlled state.
- What happens next
- Open the ECZ-ID or Passport record and re-check its current public status before you rely on it.
Implement — Developer Gateway
- Why leave this site
- You need schemas, SDKs, route indexes or integration patterns rather than governance text.
- Where you go
- Developer Gateway (developers.ecocitizenz.com)
- Authority there
- Implementation, interoperability, SDK and schema guidance. It is not live proof.
- What happens next
- Use the implementation guides and reference material. Live proof still comes from Resolver.