# Verifable

> Verifable connects continuing product records, Wallet authority and Veritas evidence for trade,
> public services, circular operations and regenerative outcomes. Digital
> Product Passports give things a continuing account; one Wallet gives people and the organisations
> they represent a visible way to understand, share and act. It serves batteries,
> textiles, electronics, construction products and other or custom groups, including existing, used,
> reclaimed and second-life things. Open protocols carry records and authority between participants;
> Veritas keeps evidence, relationships, uncertainty and possible futures queryable. Construction,
> construction projects and real estate are the deepest vertical
> focus; project finance is a longer horizon, not a current Verifable product or financing offer.
> The shared trust fabric uses decentralized identifiers, W3C Verifiable Credentials and open
> identity protocols. Lumoin Oy is a Finnish company, so Verifable is built and operated inside the
> European Union and under EU law.

Status words used in this file mean exactly this:
  Shipped              implemented in the code this origin serves, reachable at the URL given.
  Shipped (sandbox)    implemented, but running against the pre-seeded `test` tenant whose signing
                       keys are regenerated on every server restart. Sandbox credentials carry no
                       legal or regulatory weight and must not be used in a production wallet.
  In development       partially implemented; the remaining gap is named on the line.
  Planned              designed and written down, not built.
The machine-checkable version of every claim below, each with a verification pointer, is at /facts;
what is being built rather than running is at /notes/.

## Accountable agent offering

Verifable's agentic product model starts with one bounded operation and one attributable result. In
the public tailor example, an agent may prepare one repair event for one garment, using only the
field view and update authority required for that job. The common operation binds principal, agent,
resource, action, limits, delegation or evidence, policy decision, proposed semantic change and
receipt. Human approval appears only where policy requires it.

- Enterprise-managed trust uses OAuth 2.1, CIMD and ID-JAG as the identity path across
  organisational trust domains. CIMD server resolution, ID-JAG mint and redeem, RFC 9207 issuer
  handling, client creation and a dual-era OAuth-protected MCP server binding are implemented and
  tested in VerifableSystem. OpenID Federation, AuthZEN and the complete operation contract are
  implemented. Named-origin activation and partner evidence are recorded independently.
- KYA-OS is the named portable DID/VC authority route beside OAuth/ID-JAG, for an independent
  specialist without a shared directory. DID, VC 2.0, Data Integrity, status and detached-proof
  primitives exist. This public deployment does not activate or provide end-to-end evidence for
  the Entity Card, ZCAP-LD delegation, KYA-header, per-call-proof, revocation and DPP/MCP binding.
- MCP is an integration route, not identity or authorization. The runnable local Veritas reference
  contains three stdio tools: sparql_query, graph_analytics and graph_analytics_list. Verifable.Server
  also implements current 2026-07-28 and legacy 2025-11-25 Streamable HTTP at POST /mcp/{segment},
  its own RFC 9728 metadata and tenant OAuth with mcp.tools scope. Its tools are resolve_did,
  sparql_query, public dpp_chain_walk and governed product_passport_get. The passport tool takes only
  a product identifier; caller, tenant, represented principal and disclosure tier derive from the
  validated token. Where tenant configuration allows the dpp.stakeholder scope, that grant receives
  the full signed credential; other grants receive a masked public projection with restricted fields
  absent and proof removed. Every served or refused
  read writes dpp.passport.read action evidence, joined to the decision evidence by traceId. The HTTP
  and MCP reads dispatch through the same typed operation so their disclosure behavior cannot drift.
  The exact scoped capability note is /mcp/veritas-local-capabilities.json. This hosted binding proves
  transport, the OAuth resource gate and that governed read composition. The full MCP product contract
  is broader than either binding. This public origin advertises no MCP URL; named-origin deployment
  and accepted external partner evidence remain separate proof states.
- On 10 August 2026, Lumoin committed Verifable to the OpenID Foundation AIIM MCP Security
  Interoperability Event in the OAuth Authorization Server, OpenID Provider for ID-JAG issuance,
  Resource OAuth Authorization Server for ID-JAG redemption, and MCP Server roles. The full contract
  and hosted reference binding are implemented; named-origin activation and partner-result evidence remain.
  Participation is not certification.
- The public interoperability Sandbox is a separate proving surface: its test tenant runs OID4VCI
  issuance and OID4VP presentation and exposes profiles, metadata and terminal states. The staged
  organisation-authority and agent steps are labelled as such.
- The Wallet Playground is the directory-and-test layer inside that Sandbox. It follows the useful
  France Identité Playground pattern: identify a wallet, issuer or verifier, read its exact profile,
  then move to an available runnable ceremony. France Identité onboarding, listing and a dated
  external exchange remain pending. This is distinct from /playground/, the Developer Playground
  for editing and inspecting technical artifacts.

## What an agent can do here

- GET /feedback/feedback.submit.schema.json — Read the exact anonymous-by-default feedback.submit
  request, receipt and typed-problem contract. Public pages contain the same contextual form, but
  it is revealed only when the origin-stamped configuration activates a same-origin
  feedback.submit binding. Page path and reply email remain separate explicit opt-ins; query,
  fragment, cookies, wallet contents and hidden analytics are not included. When the binding is
  inactive, contextual entries remain absent and no substitute transport is presented. The
  dedicated /feedback/ contract page keeps the exact preview visible but disables its Send control.
- GET /product-passports/workbench-manifest.json — Discover the browser-local Product Passport
  workbench and its seven source-bound starting points. The stable manifest points only to immutable,
  SHA-256-addressed JSON-LD profiles, scenarios, protected local context data and draft schemas. Each
  profile separates source artifacts and assertions from semantic mappings, access policies and editor
  presentation. The current release is explicitly marked as a migration projection awaiting full RDF
  lift and human ratification; digest integrity does not confer regulatory authority. The workbench
  publishes no callable API or MCP operation. Shipped.
- POST /product/passports — Issue a product passport. The credentialSubject is validated against the
  product group's SHACL shape before anything is signed; the product gets a
  did:web:<host>:product:<id> identity, and the signed passport plus its DID document are served at
  stable URLs, so the product DID resolves for third-party resolvers. Shipped.
- GET /resolve/{productId} — Resolve a product identifier to an ISO/IEC 18975 typed link-set,
  returned as RFC 9264 application/linkset+json with matching RFC 8288 Link headers: anchor = the
  product DID, plus a dpp / dcc / dte link array per issued UNTP credential. ?linkType= narrows to
  one relation. Unknown product ids return 404 with an empty link-set. Shipped.
- GET /01/{gtin} — GS1 Digital Link-style HTTP access path (AI 01 = GTIN), resolving to the same
  link-set as the DID path. In development: the GTIN is parsed as a lookup key without deep
  check-digit validation, and full Digital Link syntax is deferred.
- GET /product/{id}/dpp.json — Read an issued passport. The read is tier-gated through an AuthZEN
  policy decision point; the caller's tier comes from the authenticated session. Shipped.
- GET /product/{id}/credential-offer — Create an OID4VCI Credential Offer for a product's battery
  passport, redeemable by any wallet through the ordinary OID4VCI endpoints. Shipped.
- POST /untp/verify — Verify a UNTP credential supplied as a compact vc+jwt. The issuer.id selects
  the trust anchor: an in-process tenant key, an out-of-band-enrolled foreign issuer key, or a live
  resolution of a did:web issuer's DID document over an SSRF-guarded outbound transport. Verdicts
  come back in-band with HTTP 200. Shipped.
- POST /vc/issue, POST /vc/verify — Sign and verify a W3C Verifiable Credential (VCDM 2.0) with an
  eddsa-jcs-2022 Data Integrity proof. RFC 8785 JCS canonicalization signs every property and
  fetches no JSON-LD context, so verification depends on no external resource. Tampering returns a
  verdict (isValid: false, SignatureInvalid), not an error. Shipped.
- POST /vc/validate — Validate a credential against an embedded schema (?schema=credential for the
  VCDM 2.0 envelope, ?schema=battery-passport for the EU battery passport attribute clusters).
  Findings carry RFC 6901 JSON Pointers into both the credential and the schema. Remote $ref
  resolution is off. Shipped.
- POST /vc/bbs/issue, POST /vc/bbs/derive, POST /vc/bbs/verify — BBS selective disclosure: issue a
  multi-message credential, derive a proof revealing a subset, verify the derived proof. Shipped.
- GET /did/resolve, GET /resolver/{identifier} — Resolve a DID server-side. did:key is computed
  in-process; did:web documents are fetched by the server, so there is no browser CORS wall.
  Shipped for did:key and did:web. did:webvh: planned.
- GET|POST /sparql — SPARQL Protocol against the shared temporary public provenance store; SELECT and ASK return
  application/sparql-results+json. Malformed queries return 400 with span-bearing parser
  diagnostics. Shipped for a server-held in-memory store. This public endpoint's temporary storage
  is not the capability boundary of the Veritas database described below.
- POST /shacl/validate — Validate an RDF document against a SHACL shapes document; the report
  carries conforms plus per-result focus node, path, severity, source shape, and constraint
  component. Parse problems come back in-band, because the diagnosis is the product. Shipped.
- POST /rdf/inspect, GET /cbor/inspect — Parse and inspect RDF and CBOR; CBOR returns Extended
  Diagnostic Notation linked to the byte spans that encode each item. Shipped.
- POST /connect/test/oid4vci/offer — Create an OID4VCI Pre-Authorized Code Credential Offer from the
  test tenant's catalog. Shipped (sandbox).
- POST /connect/test/oid4vp/request — Create an OID4VP presentation request against the test
  tenant's verifier. Shipped (sandbox).
- GET /health — Liveness. Shipped.
- GET /openapi/verifable-server.json — The whole surface at once: an OpenAPI 3.1.1 contract,
  version-controlled and emitted by the server build, served unhashed at a stable URL. Start here
  if you want the shape rather than the prose.

Unhandled failures are returned as RFC 9457 problem+json with no exception detail leaked.

## Standards and regulations, with status

Regulation (EU) 2024/1183 (eIDAS 2.0, amending Regulation (EU) No 910/2014)
  The protocol layer this regulation's wallet ecosystem runs on is implemented in the sandbox:
  OID4VCI issuance, OID4VP presentation, SD-JWT VC and ISO/IEC 18013-5 mdoc credential formats, and
  a HAIP-shaped PID configuration whose metadata declares key attestation. Shipped (sandbox).
  Conformance testing against the EUDI Architecture and Reference Framework: in development.

Regulation (EU) 2024/1781 (ESPR — Ecodesign for Sustainable Products Regulation)
  The framework under which Digital Product Passports become mandatory per product group. Verifable
  implements common passport mechanics across product groups — signed credentials, a resolvable
  product identity, tiered access and an event history. The public guided battery form and its
  battery-specific SHACL profile are shipped. Textile and electronics have versioned community
  readiness starting points; construction and custom groups use the common record. Their public
  group-specific guided editors and any product-specific conformity claims retain the individually
  stated status at /product-groups/.

Regulation (EU) 2023/1542 (Batteries Regulation)
  Shipped. The guided form at /product-passports/issue/ carries this regulation's battery passport
  attribute clusters, issuance is gated on the matching SHACL shape, and ?schema=battery-passport
  validates the same clusters standalone.

Regulation (EU) 2024/3110 (Construction Products Regulation)
  In development. The construction product group's guided form is not wired yet; the design is
  described at /lifecycle/building-logbook/ and /lifecycle/product-logbook/.

UN Transparency Protocol (UNTP)
  Shipped. UNTP-shaped DigitalProductPassport, DigitalConformityCredential, and
  DigitalTraceabilityEvent credential configurations, secured as enveloping JWS (vc+jwt), plus
  POST /untp/verify and dpp / dcc / dte typed links in the resolver link-set.

W3C Verifiable Credentials Data Model 2.0
  Shipped. Issue, verify, and validate against the structural envelope.

W3C Data Integrity, eddsa-jcs-2022 (RFC 8785 JSON Canonicalization Scheme)
  Shipped. The proof suite used by /vc/issue and the passport issuance path.

Bitstring Status List
  Shipped (sandbox). Issued credentials are stamped with a BitstringStatusListEntry pointing at the
  tenant's hosted status list; the OID4VP verifier checks the live list, so a revoked index is
  rejected on presentation.

OpenID for Verifiable Credential Issuance 1.0 (OID4VCI)
  Shipped (sandbox). Pre-Authorized Code grant, an issuer at /connect/test/, published metadata at
  /.well-known/openid-credential-issuer, and a credential catalog documented at /sandbox/.

OpenID for Verifiable Presentations 1.0 (OID4VP)
  Shipped (sandbox). A verifier at the same tenant segment, with nonce and audience binding and a
  session transcript for mdoc presentations.

SD-JWT VC (dc+sd-jwt)
  Shipped (sandbox). The PID configuration verifable.identity.sdjwt.1, plus a HAIP variant.

ISO/IEC 18013-5 mdoc (mso_mdoc)
  Shipped (sandbox). The PID configuration verifable.identity.mso_mdoc.pid.1, issued as an mdoc
  document with a COSE_Sign1 IssuerAuth; the verifier holds both our own issuance key and foreign
  IACA root certificates as trust anchors.

ISO/IEC 18975
  Shipped. Typed link-set resolution from a product identifier, over RFC 9264 and RFC 8288.

GS1 Digital Link
  Passports can carry a GS1 Digital Link identifier (AI 01 GTIN, optional AI 21 serial) validated
  against GS1 URI syntax and the mod-10 check digit, printed on the passport and encoded as a QR
  data carrier. The did:web product identity remains the primary identity; the GS1 Digital Link is
  an alternate address for the same passport. Resolution of GS1 identifiers to typed product
  services is in development.

W3C Decentralized Identifiers
  Shipped: resolution server-side for did:key and did:web, and a did:web identity for every issued product.
  In development: the platform's own did:web:verifable.eu document is not served yet
  (/.well-known/did.json returns 404), so that identifier does not resolve today.

WebAuthn / FIDO2 passkeys
  Shipped: registration and authentication endpoints plus a session endpoint. In development:
  durable passkey storage — records are held in memory today.

OpenID Federation
  In development. Entity-statement resolution exists in the server; enterprise federation onboarding
  is deliberately sequenced after the free tier.

AuthZEN
  Shipped. Policy decisions gate the tiered passport read, and decisions are inspectable at /ops.html.

SPARQL 1.2, SHACL, JSON-LD, RDF
  Shipped. Query, validate, and inspect over HTTP; the public semantic workbench is at
  /veritas/editor/. OWL 2 source can be inspected there, but public OWL reasoning is not claimed.

OGC GeoSPARQL 1.1 / ISO/DIS 19186-1
  Implemented in the Veritas release candidate, not exposed by the bounded public Workbench today.
  Veritas keeps location with product and lifecycle evidence and can ask what is within, touching,
  overlapping or nearby. The support is implemented and tested; full conformance is not claimed.
  GeoSPARQL 1.1 is an approved OGC standard. ISO/DIS 19186-1 is under development at DIS ballot
  stage; it is not yet a published ISO International Standard.

Veritas evidence database
  Release candidate. The repository address is announced and opens shortly; it may return not found
  until publication. The first-party engine runs in memory or with durable storage, explores possible worlds without changing current
  facts, recovers from interrupted writes, lets independent peers converge, and explains how answers
  were reached. The Web Studio can run its browser engine or connect to a local CLI over a GET/POST
  SPARQL query endpoint. The same CLI build separately includes stdio MCP access for bounded
  questions and graph analytics. That local read-only adapter writes runtime logs to stderr but does
  not itself persist call history or emit a domain-operation receipt; its client or production host
  owns those policies. Separately, Verifable.Server implements and integration-tests the hosted
  OAuth-protected MCP reference described above, including its governed product_passport_get read and
  trace-linked action evidence; its named public deployment and external partner result are distinct
  proof states. SPARQL SERVICE federation is implemented; its own scoped OAuth
  binding is not active or end-to-end proven in this public deployment. An additional
  consensus mode is in advanced testing; TPM-backed storage encryption is not active today.

Local evidence gateway and semantic onboarding
  The full product contract covers local and retained source mapping, scoped source authority,
  protected storage, governed review and transfer, semantic migration, catalogue-scale issuance and
  agent access through shared operation semantics. This public deployment activates browser-local
  Product Passport mapping, the browser/WASM Studio, local CLI, SPARQL query endpoint and local CLI
  MCP reference. The hosted MCP server binding is implemented in Verifable.Server but has no URL on
  this public origin. This deployment does not activate Entra sign-in, hardware-backed local protection, production
  MES/ERP/CRM/PIM connectors, OAuth-protected transfer, bulk import, vendor migration or batch
  issuance, and it records no end-to-end proof for those bindings.

Lumoin standards participation
  Lumoin has participated in European Digital Product Passport standardisation through Finland's
  SFS/SR 229 group, contributing to work connected with CEN-CLC/JTC 24, Digital Product Passport —
  Framework and System. Participation is not committee ownership, certification or endorsement.

Veritas-backed wallet credential storage
  Implemented and tested, but opt-in. The installed wallet still uses SQLite by default.

Hardware-backed wallet key protection
  In development. The current app does not use hardware-backed protection for production holder keys.

## Wallet Playground

The Wallet Playground is Verifable's public test environment: bring a compatible holder wallet,
receive a synthetic credential or present one requested claim, and inspect the issuer or verifier's
observed result. Its anonymous OID4VCI issuer and OID4VP verifier expose discovery metadata, exact
profiles, raw endpoints, status transitions, and explicit test-tenant limits. France Identité is a
named external reference environment; a mapped target is not a completed exchange. Lumoin
participates in the FIDES Community. Participation is not an official listing, certification,
or interoperability result.

## Key URLs

- /                                    The story: what this is for, and who it is for.
- /facts                               Every claim about what runs today, each with a way to check it.
- /notes/                              Field notes on evidence and possibility, continuing records, Wallet agency, and open protocols.
- /docs/                               Developer map: consoles, live API reference, contracts.
- /openapi/verifable-server.json       The OpenAPI 3.1.1 contract. Stable, unhashed, machine-first.
- /sandbox/                            Wallet Playground: bring a compatible holder wallet, receive
                                       a synthetic credential or present one requested claim, and
                                       inspect the live result and technical evidence. No account.
- /product-passports/issue/            Guided battery passport form, SHACL-gated.
- /playground/                         Developer Playground: DID resolver, CBOR inspector, VC
                                       author/sign/verify, battery passport and built environment.
- /resolver/                           Resolve a DID or a product identifier through the server.
- /product-passports/                  Cross-product DPP workspace: public examples, existing/used
                                       things, custom templates, provenance and current boundaries.
- /product-groups/                     Battery, textile, electronics, construction, detergent and other
                                       groups: offer, public profile maturity and legal context.
- /built-environment/                  Existing-asset record path plus the place graph for construction
                                       products, water, maintenance evidence, reuse and the project-finance horizon.
- /value-chains/                       Trade and circularity: local circulation, international hand-offs
                                       and local-to-local knowledge transfer with exact status boundaries.
- /wallets/                            Verifable Wallet for personal and Business contexts: native holder pilot, public
                                       issuer/verifier, human agency, organisation authority,
                                       a structured planner, and circular work serving regenerative outcomes.
- /wallet/                             Zero-install Web Wallet: receive supported credential offers
                                       into the session-only browser store, inspect activity and
                                       stored summaries, and keep native keys/credentials separate.
- /feedback/                           Optional anonymous-by-default feedback form and exact payload
                                       preview; submission is deployment-gated by feedback.submit.
- /feedback/feedback.submit.schema.json
                                       Machine-readable request, receipt and typed-problem contract.
- /agents/                             Accountable-agent offering: one tailor repair, enterprise-managed
                                       and portable authority paths, a common policy/receipt contract,
                                       a full product contract and deployment-specific activation.
- /veritas/                            Veritas evidence database: deployment modes, worlds, durability,
                                       replication, trace, MCP and integration boundaries.
- /mcp/veritas-local-capabilities.json
                                       Machine-readable full MCP contract, primitive evidence, binding activation and proof state.
- /veritas/editor/                     SPARQL, RDF inspection, SHACL validation, OWL 2 source.
- /platform/at-protocol/               Integration-tested DPP-to-public-conversation foundation:
                                       standard Bluesky post + public passport link, exact boundaries.
- /network/                            Connected-client preview for feeds, posts, passport links and
                                       disclosure review; production persistence and hardening remain.
- /ops.html                            Policy decisions, event streams, trace lookup.
- /pricing                             What costs nothing today.
- /company                             Lumoin Oy: jurisdiction, open source, public artifacts.
- /llms.txt                            This file.

## Source

- https://github.com/Lumoin/Verifable — announced repository address for the native Verifable
  Wallet. The wallet source release and its licence are not public yet; the public protocol stack is
  linked below.
- https://github.com/Lumoin/Verifiable — .NET decentralized identifiers, verifiable credentials,
  protocols, and cryptographic routines. Apache-2.0.
- https://github.com/Lumoin/Lumoin.Veridical — zero-knowledge proofs, polynomial commitments,
  folding schemes, BBS selective disclosure, split-ECDSA sole-control signing. Apache-2.0.
- https://github.com/Lumoin/Lumoin.Verisync — conflict-free replicated data types, causal contexts,
  leaderless consensus. Apache-2.0.
- https://github.com/lumoin/Lumoin.Veritas — announced repository address for the Veritas evidence
  database. Opening in the next few days; it may return not found until publication. Apache-2.0.
The Apache-2.0 grant covers the code. The Verifable name, logo, and domains are Lumoin Oy
trademarks and are not licensed with it; see TRADEMARK.md in the wallet repository.

## Company and contact

Lumoin Oy, a Finnish limited company (Oy), VAT identifier FI28496474. Verifable is a Lumoin product.
The platform's intended identifier is did:web:verifable.eu; its DID document is not served yet.
Email: hello@lumoin.com. Company enquiries: contact@lumoin.com.
Bluesky: https://bsky.app/profile/lumoin.bsky.social
LinkedIn: https://www.linkedin.com/company/lumoin
Web: https://lumoin.com

## The door

Nothing here is behind a form. Read /facts, run the sandbox, issue a passport, query the store — then
open an account when you want the passports and credentials to stay yours: /app/.