TRACEPORT
Attestation Architecture. Current, Intended, and Refactored Alignment
| Concept | BRC-43 / BKDS Term | PushDrop Parameter | How BRC-42/43 Intends It to Work | How Traceport Prepares for That |
|---|---|---|---|---|
| Security Level | securityLevel | part of [securityLevel, protocolName] tuple | Defines permission model:
|
Uses 1 for self-attestation (no external permission). Keeps structure so higher levels (2+) can be added later for customer-specific or counterparty attestations. |
| Protocol ID | protocolID (string) | protocolName in [SecurityLevel, ProtocolName] | Unique namespace defining context of derivation. Used to isolate key universes across applications or use cases. | Moves from 'tp'/'traceport-charity' → canonical, namespaced IDs like traceport.charity.donation or acme.legal.compliance. Each tenant gets its own protocol namespace. |
| Key ID | keyID (string) | keyID field in PushDrop.lock() | Identifies a specific key within a protocol. Open-ended format; protocol defines its meaning (e.g., "invoice-001" or hash). | Currently attestation-${hash}. Refactor uses deterministic form like donationrecord-2025q4 or acme-contracts-q4. Supports both reproducibility and human traceability. |
| Counterparty | counterparty (public key or self) | counterparty param in PushDrop.lock() | Public key of the other party in the BKDS shared-secret derivation. For self, same key used both sides; for anyone, uses constant key = 1 * G. | Currently always 'self'. System is BKDS-ready — can later include customer public keys when registry or external counterparties come online. |
| Invoice String | <securityLevel>-<protocolID>-<keyID> | built internally by BKDS derivation | Core input for deterministic key derivation. Both parties (or self) can compute same derived key using this string. | Not currently stored visibly. Refactor will generate and log canonical invoice numbers (e.g., 1-traceport.charity.donation-donationrecord-2025q4) for audit and registry integration. |
| Derived Key | result of BKDS derivation | PushDrop locking key (publicKey in script) | Deterministically derived from root private key(s) + invoice. Produces matching child key for each protocol/keyID/counterparty. | Derived today via self-BKDS (loopback mode). Refactor keeps same derivation but formalizes metadata under generateCanonicalMetadata(). |
| Attestation Data | payload / message hash | fields in PushDrop.lock() | Off-chain data that's being attested; may be signed and included in script for permanent proof. | Hash of off-chain attestation record (charity, enterprise, etc.). Same mechanism continues — linked by keyID and registry metadata. |
| Registry Metadata | (not defined in BRC-43) | off-chain Mongo entry | Not part of BRC-43, but in practice, systems store extended protocol information off-chain. | Adds registryMetadata in Mongo with sector, org, protocol, schemaVersion, etc., to support discoverability and verification. |
| Security Model (Permissions) | implicit in securityLevel | n/a | Wallet/client mediates permissions between apps and users; ensures safe key use. | For now, permission layer implicit (Traceport controls keys). Later, when users have client wallets, this can map to on-device approvals. |
| Protocol Discovery / Registry | external service | future integration | Allows third parties to look up protocol details and verify attestations by protocol ID. | Traceport registry will expose protocol metadata and allow verifiers to confirm signatures or compliance levels. |