This document lists required software components for each conformance profile. Implementations MAY substitute equivalent technology if behavioral requirements are met.
| Attribute | Requirement |
|---|
| Purpose | Accept trust events from producers |
| Protocols | HTTPS JSON (mandatory); webhook HMAC (Enterprise+) |
| Validation | JSON Schema per event catalogue |
| Outputs | Acceptance receipt with pti_id |
Core: API only. Enterprise+: webhook + CSV batch processor.
| Attribute | Requirement |
|---|
| Purpose | Versioned registry of event_type → schema |
| Versioning | catalogue_version per RFC-010 |
| Access | Read-only for producers; admin publish workflow |
Minimum: one primary context with ≥3 event types (e.g., loan_disbursement, loan_repayment, loan_default).
| Attribute | Requirement |
|---|
| Purpose | PTI-ID lifecycle and entity binding |
| Inputs | entity_id, search attributes |
| Outputs | pti_id, confidence, review tickets |
| Storage | Hashed strong identifiers |
Enterprise+ MUST include operator review UI or API for merge/split.
| Attribute | Requirement |
|---|
| Purpose | Store RFC-005 nodes and edges |
| Operations | append_event, explain_outcome, timeline |
| Integrity | No orphan events; immutable edges |
Acceptable technologies: PostgreSQL with adjacency tables, Neo4j, Amazon Neptune, etc.
| Attribute | Requirement |
|---|
| Purpose | Derive signals and materialize outcomes |
| Trigger | Queue messages on new events |
| Rules | Versioned derivation_rule strings |
| Idempotency | Safe replay on duplicate queue delivery |
ML models MAY be used; model_version MUST appear in predictive tier evidence.
| Attribute | Requirement |
|---|
| Purpose | Fast lookup reads |
| Key | (pti_id, context_id, outcome_version) |
| Invalidation | On relevant event or rule version bump |
| Attribute | Requirement |
|---|
| Endpoints | subjects.search, reports.generate, reports.get |
| Optional | reports.verify (Enterprise+) |
| Auth | Consumer-scoped credentials |
| Contract | OpenAPI 3.1 published |
| Attribute | Requirement |
|---|
| Purpose | Construct and sign RFC-012 manifests |
| Canonicalization | JCS before sign |
| Algorithms | Ed25519 or RSA-3072+ |
| Isolation | Separate from lookup read path |
Government profile MUST use HSM-backed signing.
| Attribute | Requirement |
|---|
| Evaluates | Context enablement, tier, purpose, consent |
| Integration | Called synchronously on ingest and lookup |
| Default | Deny |
Centralized engine RECOMMENDED over scattered conditional logic.
| Attribute | Requirement |
|---|
| Stores | consent_id, scope, timestamps |
| API | Grant, withdraw, query |
| Propagation | Cache invalidation ≤ 15 minutes |
| Attribute | Requirement |
|---|
| Events | Lookups, consent changes, admin actions |
| Properties | Append-only, tenant-scoped read |
| Retention | Per governance schedule |
| Attribute | Requirement |
|---|
| Handles | Access, export, erasure, rectification |
| Orchestration | Graph + report + consent stores |
| SLA | Published in privacy policy |
Core MAY use manual ticket workflow with same outcomes.
| Attribute | Requirement |
|---|
| Purpose | Send/receive RFC-006 packages |
| Components | JWKS cache, PRL poller, signature verifier |
| Required for | Government profile; optional Enterprise |
| Attribute | Requirement |
|---|
| Purpose | Offline queue uplink, conflict resolution |
| Protocol | HTTPS package upload |
| Local | Embedded event store + audit |
| Attribute | Requirement |
|---|
| Isolation | Separate credentials and data |
| Parity | Same RFC behavior as production |
| Fixtures | Seed kit for conformance tests |
| Component | Requirement |
|---|
| TLS termination | Public endpoints |
| Secrets manager | API keys, webhook secrets |
| Message queue | Async scoring (SQS, RabbitMQ, Kafka, etc.) |
| Object storage | CSV uploads, report archives |
| CI/CD | Schema and OpenAPI contract tests |
| SIEM | Security event aggregation (Enterprise+) |
| From → To | Ingest | Identity | Graph | Scoring | Lookup | Signing | Policy |
|---|
| Ingest | , | ✓ | ✓ | queue | , | , | ✓ |
| Lookup | , | ✓ | ✓ | , | , | ✓ | ✓ |
| Scoring | , | , | ✓ | , | , | , | , |
| Federation | , | ✓ | ✓ | , | ✓ | verify | ✓ |
| Profile | vCPU | RAM | Storage |
|---|
| Core pilot | 4 | 16 GB | 200 GB SSD |
| Enterprise | 16+ | 64 GB+ | 1 TB+ with replication |
| Government | Multi-AZ per operator policy | | |
| Edge node | 2 | 8 GB | 64 GB local |