{ "schema_version": "1", "portal_version": "1.0.0-foundation", "updated_at": "2026-07-20", "source": "marco.public_portal", "provenance": "canonical_registry", "data": { "protocol": "marco.passport.core", "version": "1.0.0", "status": "CONSTITUTIONAL_DRAFT", "updated_at": "2026-07-21", "authority": "MARCO — Passport Core", "license": "Melega Ecosystem — protocol reference", "principles": [ { "id": "identity_is_a_subject", "title": "Identity is a Subject", "body": "Every participant in the ecosystem is a SUBJECT, never a 'user'. Subjects have subject-type, lifecycle and identity — not sessions, not accounts." }, { "id": "one_subject_one_passport", "title": "One Subject, One Passport", "body": "Every subject owns exactly one Passport. Passports are neither duplicated across organs nor replicated as private accounts inside them." }, { "id": "protocol_over_product", "title": "Protocol over Product", "body": "Passport Core is infrastructure. It provides identity, credentials, activity, presentation and verification — never a wallet, marketplace, DEX, treasury or space." }, { "id": "event_derived_state", "title": "State is Derived from Events", "body": "Organs never mutate Passport state directly. They emit verified events. Passport Core derives state from an append-only activity ledger." }, { "id": "minimum_disclosure", "title": "Minimum Disclosure", "body": "Verifiers receive only the claims required for a purpose. Passport Core never exposes the whole Passport as the default answer." }, { "id": "privacy_by_default", "title": "Privacy by Default", "body": "Every field defaults to PRIVATE. Public visibility is an explicit act. Presentations expire." }, { "id": "no_economic_authority", "title": "No Economic Authority", "body": "Passport Core never issues, holds, transfers, settles or authorizes M-Credits or any value. Economic authority remains with Treasury Runtime." }, { "id": "auditability", "title": "Auditability", "body": "Every lifecycle transition and every ledger entry is auditable. History is never overwritten." }, { "id": "extensibility", "title": "Extensibility", "body": "Subjects, credentials and claim types are extensible. Breaking changes require a new protocol major version." }, { "id": "portability", "title": "Portability", "body": "Passports are portable to any wallet surface that supports verifiable credentials and a scannable presentation. The portal is never the source of truth for the object." } ], "subjects": [ { "id": "HUMAN", "label": "Human", "role": "A natural person participating in the Melega ecosystem.", "requires": [ "proof-of-personhood (declared or credentialed)" ], "never": [ "displays legal name or KYC documents on the Passport", "is impersonated by an AI_AGENT" ] }, { "id": "AI_AGENT", "label": "AI Agent", "role": "An autonomous agent with declared authority and principal.", "requires": [ "declared principal", "declared capability scope", "declared authority bounds" ], "never": [ "claims personhood", "omits its principal", "claims economic authority" ] }, { "id": "ORGANIZATION", "label": "Organization", "role": "An institutional identity with delegated Passport relationships.", "requires": [ "declared operator", "at least one delegated signer" ], "never": [ "issues personal claims about its members without their explicit credential" ] }, { "id": "DIGITAL_SERVICE", "label": "Digital Service", "role": "A capability endpoint with declared interface and provenance.", "requires": [ "declared operator", "declared interface surface" ], "never": [ "claims subjectivity", "omits its operator" ] } ], "passport_number": { "format": "MP-YYMM-XXXXX", "example": "MP-2601-A00128", "legacy_format": "MC-######### (issued before MP071, still valid)", "is_public": true, "is_reusable": false, "is_mandatory": true, "policy": [ "Passport Number is the ONLY public human identifier.", "Passport Number is stable for the lifetime of the Passport.", "Passport Number is never reused across subjects, even after REVOKED or ARCHIVED.", "Sequential allocation is a protocol policy; it does not encode private information." ] }, "passport_id": { "format": "opaque_ulid", "example": "01J8Z9WQK4M0N4B0Y7F1E2C3A5", "is_public": false, "is_stable": true, "policy": [ "Passport ID is the immutable technical identifier.", "Passport ID is used only in protocol payloads and verifier receipts.", "Passport ID is never displayed as the public identifier." ] }, "lifecycle": [ { "id": "ISSUED", "label": "Issued", "intent": "The Passport exists in the registry but has not been activated by its subject.", "entry_conditions": [ "subject registered", "passport number allocated" ], "allowed_next": [ "ACTIVATED", "REVOKED", "ARCHIVED" ], "auditable": true }, { "id": "ACTIVATED", "label": "Activated", "intent": "The subject has taken possession of the Passport.", "entry_conditions": [ "primary wallet or subject key bound" ], "allowed_next": [ "PRIVATE", "PUBLIC", "SUSPENDED", "RECOVERY", "REVOKED" ], "auditable": true }, { "id": "PRIVATE", "label": "Private", "intent": "The Passport is active; only PROOF_ONLY disclosures are possible.", "entry_conditions": [ "ACTIVATED" ], "allowed_next": [ "PUBLIC", "CONNECTED", "SUSPENDED", "RECOVERY", "REVOKED" ], "auditable": true }, { "id": "PUBLIC", "label": "Public", "intent": "The Passport carries a public presentation surface (handle, tier).", "entry_conditions": [ "ACTIVATED", "handle claimed" ], "allowed_next": [ "PRIVATE", "CONNECTED", "SUSPENDED", "REVOKED" ], "auditable": true }, { "id": "CONNECTED", "label": "Connected", "intent": "The Passport is bound to at least one wallet and one organ.", "entry_conditions": [ "primary wallet bound", "≥1 organ integration attested" ], "allowed_next": [ "VERIFIED", "ACCESS_ENABLED", "SUSPENDED", "REVOKED" ], "auditable": true }, { "id": "VERIFIED", "label": "Verified", "intent": "The Passport has at least one active credential of subject-type.", "entry_conditions": [ "≥1 non-revoked subject credential" ], "allowed_next": [ "ACCESS_ENABLED", "MARKET_ENABLED", "SUSPENDED", "REVOKED" ], "auditable": true }, { "id": "ACCESS_ENABLED", "label": "Access enabled", "intent": "The Passport can present access claims to organs and merchants.", "entry_conditions": [ "VERIFIED", "tier assigned" ], "allowed_next": [ "MARKET_ENABLED", "SUSPENDED", "REVOKED" ], "auditable": true }, { "id": "MARKET_ENABLED", "label": "Market enabled", "intent": "External economic organs (Treasury Runtime, Marketplace) accept this Passport as counterparty identity. Passport Core still holds no funds.", "entry_conditions": [ "ACCESS_ENABLED", "Treasury Runtime attestation" ], "allowed_next": [ "SUSPENDED", "REVOKED" ], "auditable": true }, { "id": "SUSPENDED", "label": "Suspended", "intent": "Presentation and verification are frozen; ledger continues to accept receipts.", "entry_conditions": [ "policy trigger", "recovery request", "authority action" ], "allowed_next": [ "PRIVATE", "PUBLIC", "REVOKED", "ARCHIVED" ], "auditable": true }, { "id": "RECOVERY", "label": "Recovery", "intent": "The subject is in a documented recovery flow; only recovery presentations are valid.", "entry_conditions": [ "recovery initiated" ], "allowed_next": [ "ACTIVATED", "PRIVATE", "REVOKED" ], "auditable": true }, { "id": "REVOKED", "label": "Revoked", "intent": "The Passport is permanently invalidated. Presentations always fail.", "entry_conditions": [ "authority revocation", "subject-initiated destruction" ], "allowed_next": [ "ARCHIVED" ], "auditable": true }, { "id": "ARCHIVED", "label": "Archived", "intent": "The Passport is preserved for audit only. Never returns to any active state.", "entry_conditions": [ "REVOKED", "retention window elapsed" ], "allowed_next": [], "auditable": true } ], "modules": [ { "id": "identity_registry", "label": "Identity Registry", "responsibility": "Owns the mapping between Passport Number, Passport ID, subject type and lifecycle state.", "emits": [ "passport.issued", "passport.activated", "passport.lifecycle_changed" ], "consumes": [ "subject.registered", "authority.action" ], "never": [ "mutates credentials", "mutates wallets", "authorizes payments" ] }, { "id": "subject_registry", "label": "Subject Registry", "responsibility": "Owns the canonical description of each subject (type, principal, operator, declared authority).", "emits": [ "subject.registered", "subject.updated" ], "consumes": [ "credential.issued (as attestation of subject facts)" ], "never": [ "stores personal documents", "stores KYC evidence in raw form" ] }, { "id": "handle_registry", "label": "Handle Registry", "responsibility": "Owns unique, human-readable handles (@marco), reserved names, transfer policy and history.", "emits": [ "handle.claimed", "handle.transferred", "handle.released" ], "consumes": [ "passport.activated" ], "never": [ "reveals private handles of PRIVATE passports" ] }, { "id": "wallet_registry", "label": "Wallet Registry", "responsibility": "Owns bindings between Passport IDs and wallet addresses (primary, secondary, recovery).", "emits": [ "wallet.bound", "wallet.rotated", "wallet.replaced", "wallet.revoked" ], "consumes": [ "passport.activated", "authority.action" ], "never": [ "stores private keys", "signs transactions", "authorizes payments" ] }, { "id": "credential_registry", "label": "Credential Registry", "responsibility": "Owns verifiable credential references (human, organization, agent, age, jurisdiction), issuers and revocation status.", "emits": [ "credential.issued", "credential.revoked", "credential.expired" ], "consumes": [ "issuer.attestation" ], "never": [ "stores raw personal documents on-chain or in cleartext" ] }, { "id": "activity_ledger", "label": "Activity Ledger", "responsibility": "Append-only ledger of verified activity events emitted by organs. Never mutated. Never overwritten.", "emits": [ "activity.recorded" ], "consumes": [ "organ.event (verified via Event Fabric)" ], "never": [ "invents activity", "mutates prior entries", "resolves economic balances" ] }, { "id": "access_engine", "label": "Access Engine", "responsibility": "Derives tier (Explorer, Silver, Gold, Platinum) from credentials and ledger. Independent from reputation and holdings.", "emits": [ "tier.assigned", "tier.changed" ], "consumes": [ "credential.*", "activity.recorded" ], "never": [ "reads private wallet balances", "confuses holdings with identity" ] }, { "id": "privacy_engine", "label": "Privacy Engine", "responsibility": "Enforces field-level visibility (PUBLIC, CIVILIZATION, PRIVATE, PROOF_ONLY) and default-private policy.", "emits": [ "visibility.changed" ], "consumes": [ "subject.preference", "authority.policy" ], "never": [ "allows a verifier to exceed the requested disclosure" ] }, { "id": "presentation_engine", "label": "Presentation Engine", "responsibility": "Generates purpose-scoped, expiring presentations from a Passport under a disclosure policy.", "emits": [ "presentation.issued", "presentation.expired" ], "consumes": [ "verifier.request", "privacy.policy" ], "never": [ "issues a presentation without an explicit purpose" ] }, { "id": "verifier_engine", "label": "Verifier Engine", "responsibility": "Answers claim-scoped verification requests and returns a signed verifier receipt.", "emits": [ "verification.completed" ], "consumes": [ "presentation.issued" ], "never": [ "returns the whole Passport", "leaks fields not required by the request" ] } ], "events": [ { "id": "passport.issued", "category": "lifecycle", "emitted_by": "identity_registry", "payload": [ "passport_id", "passport_number", "subject_type", "issued_at" ], "idempotency": "required" }, { "id": "passport.activated", "category": "lifecycle", "emitted_by": "identity_registry", "payload": [ "passport_id", "activated_at", "primary_wallet_ref?" ], "idempotency": "required" }, { "id": "passport.lifecycle_changed", "category": "lifecycle", "emitted_by": "identity_registry", "payload": [ "passport_id", "from_state", "to_state", "reason", "authority", "at" ], "idempotency": "required" }, { "id": "handle.claimed", "category": "identity", "emitted_by": "handle_registry", "payload": [ "passport_id", "handle", "claimed_at" ], "idempotency": "required" }, { "id": "handle.transferred", "category": "identity", "emitted_by": "handle_registry", "payload": [ "handle", "from_passport", "to_passport", "policy_ref", "at" ], "idempotency": "required" }, { "id": "wallet.bound", "category": "wallet", "emitted_by": "wallet_registry", "payload": [ "passport_id", "wallet_ref", "role", "attestation" ], "idempotency": "required" }, { "id": "wallet.rotated", "category": "wallet", "emitted_by": "wallet_registry", "payload": [ "passport_id", "from_wallet", "to_wallet", "reason", "at" ], "idempotency": "required" }, { "id": "credential.issued", "category": "credential", "emitted_by": "credential_registry", "payload": [ "passport_id", "credential_type", "issuer_ref", "expires_at?" ], "idempotency": "required" }, { "id": "credential.revoked", "category": "credential", "emitted_by": "credential_registry", "payload": [ "credential_ref", "reason", "at" ], "idempotency": "required" }, { "id": "activity.recorded", "category": "activity", "emitted_by": "activity_ledger", "payload": [ "activity_id", "passport_id", "source_organ", "receipt_ref", "schema_version", "visibility", "at" ], "idempotency": "required" }, { "id": "presentation.issued", "category": "verification", "emitted_by": "presentation_engine", "payload": [ "presentation_id", "passport_id", "purpose", "claims[]", "expires_at" ], "idempotency": "not_applicable" }, { "id": "verification.completed", "category": "verification", "emitted_by": "verifier_engine", "payload": [ "verification_id", "presentation_ref", "purpose", "result", "verifier_ref", "at" ], "idempotency": "required" } ], "activity_ledger": { "fields": [ { "field": "activity_id", "type": "ULID", "required": true, "description": "Ledger-unique identifier." }, { "field": "passport_id", "type": "opaque_ulid", "required": true, "description": "Subject reference." }, { "field": "source_organ", "type": "string", "required": true, "description": "Emitting organ (dex, space, radar, smartdrop, labs, marketplace, events, mission, verifier, credentials)." }, { "field": "schema_version", "type": "semver", "required": true, "description": "Schema of the event payload." }, { "field": "timestamp", "type": "ISO8601", "required": true, "description": "Server-observed time." }, { "field": "verification_status", "type": "enum(unverified|verified|revoked)", "required": true, "description": "Set by Event Fabric attestation." }, { "field": "visibility", "type": "enum(PUBLIC|CIVILIZATION|PRIVATE|PROOF_ONLY)", "required": true, "description": "Default PRIVATE." }, { "field": "provenance", "type": "URI", "required": true, "description": "Reference to the emitting organ's receipt." }, { "field": "receipt_ref", "type": "URI", "required": true, "description": "Content-addressed receipt of the underlying action." }, { "field": "idempotency_key", "type": "string", "required": true, "description": "Stable across retries. Second submission is a no-op." }, { "field": "payload", "type": "object", "required": true, "description": "Organ-specific event data. Never contains PII." } ], "organs": [ "dex", "space", "radar", "smartdrop", "labs", "marketplace", "events", "mission", "verifier", "credentials" ], "append_only": true, "idempotency_required": true }, "privacy": { "visibility": [ { "id": "PUBLIC", "label": "Public", "intent": "Readable by anyone, without a verifier request." }, { "id": "CIVILIZATION", "label": "Civilization", "intent": "Readable by any active Passport." }, { "id": "PRIVATE", "label": "Private", "intent": "Readable only by the subject." }, { "id": "PROOF_ONLY", "label": "Proof only", "intent": "Never disclosed as a value — only as a proof that a predicate holds." } ], "rules": [ "Default visibility is PRIVATE.", "A visibility upgrade requires an explicit subject action.", "Verifiers never receive more than they requested.", "PROOF_ONLY fields are never returned as values, only as proofs.", "The verifier receipt records the exact set of disclosed claims." ] }, "presentation": { "modes": [ { "id": "wallet", "label": "Wallet Mode", "intent": "Compact secure presentation on the subject's wallet surface." }, { "id": "expanded", "label": "Expanded Mode", "intent": "Rich identity, access, activity and credit view for the subject." }, { "id": "verifier", "label": "Verifier Mode", "intent": "Minimum-disclosure verification for a merchant or organ." }, { "id": "merchant", "label": "Merchant Mode", "intent": "Purpose-scoped presentation for point-of-service interactions." }, { "id": "event", "label": "Event Mode", "intent": "Presentation for event access with proof of eligibility." }, { "id": "machine", "label": "Machine Mode", "intent": "Structured JSON-LD credential exchange between organs." } ], "flow": [ "1. Verifier submits a Request { purpose, required_claims[], acceptable_issuers[], nonce, ttl }.", "2. Privacy Engine evaluates the subject's policy against the Request.", "3. Presentation Engine builds a Disclosure containing only the accepted claims.", "4. A signed, single-use, expiring Presentation is issued.", "5. The Presentation is delivered to the Verifier through the chosen surface.", "6. Verifier Engine validates the Presentation and returns a signed Verifier Receipt." ] }, "verifier": { "claims": [ { "id": "passport.active", "description": "Passport is ACTIVATED and not SUSPENDED/REVOKED." }, { "id": "subject.is_human", "description": "Subject type is HUMAN." }, { "id": "subject.is_agent", "description": "Subject type is AI_AGENT." }, { "id": "subject.is_organization", "description": "Subject type is ORGANIZATION." }, { "id": "tier.at_least", "description": "Access tier ≥ requested tier." }, { "id": "credential.has", "description": "Passport holds a non-revoked credential of the requested type." }, { "id": "age.at_least", "description": "Age requirement satisfied without revealing date of birth." }, { "id": "jurisdiction.in", "description": "Jurisdiction claim in the requested set, without revealing residency detail." }, { "id": "benefit.eligible", "description": "Subject is eligible for a declared benefit program." } ], "never_returns": [ "the full Passport", "wallet addresses", "activity history", "raw credentials", "any personally identifiable information", "any economic balance" ] }, "access": { "tiers": [ { "id": "explorer", "label": "Explorer", "intent": "Entry state. Discover the ecosystem before holding.", "derived_from": [ "credentials?", "activity_ledger" ] }, { "id": "silver", "label": "Silver", "intent": "Base access for verified Passport holders.", "derived_from": [ "subject_credential", "activity_ledger" ] }, { "id": "gold", "label": "Gold", "intent": "Elevated access. Thresholds not yet published.", "derived_from": [ "subject_credential", "activity_ledger", "policy" ] }, { "id": "platinum", "label": "Platinum", "intent": "Long-standing citizens and foundational nodes.", "derived_from": [ "subject_credential", "activity_ledger", "policy" ] } ], "rules": [ "Access is independent from reputation.", "Reputation is independent from holdings.", "Holdings never directly modify identity.", "Tier is derived; it is never a stored, arbitrary value." ] }, "handles": { "format": "@[a-z0-9_]{2,32}", "unique": true, "case_sensitive": false, "transferable": true, "reservation": [ "@marco", "@melega", "@kiri", "@treasury", "@space", "@radar", "@smartdrop", "@labs", "@passport", "@verifier" ], "conflict_resolution": "First-claim wins. Reserved handles are held by MARCO authority and never auto-issued. Impersonation is grounds for suspension.", "history": "All transfers are recorded as handle.transferred events." }, "wallets": { "roles": [ { "id": "primary", "label": "Primary", "intent": "The active binding used for attestations." }, { "id": "secondary", "label": "Secondary", "intent": "Additional signer for organs that require multi-address identity." }, { "id": "recovery", "label": "Recovery", "intent": "Used exclusively during RECOVERY lifecycle transitions." } ], "rules": [ "Wallets are bindings, not identities.", "Passport Core never stores private keys, seed phrases or wallet secrets.", "Wallet rotation preserves Passport ID and history.", "Wallet revocation is a lifecycle-relevant authority action." ] }, "credentials": { "types": [ { "id": "human_verified", "label": "Human Verified", "issuer_class": "identity_authority", "selective_disclosure": true }, { "id": "organization_verified", "label": "Organization Verified", "issuer_class": "org_authority", "selective_disclosure": true }, { "id": "agent_verified", "label": "Agent Verified", "issuer_class": "agent_authority", "selective_disclosure": true }, { "id": "age_credential", "label": "Age", "issuer_class": "identity_authority", "selective_disclosure": true }, { "id": "jurisdiction_credential", "label": "Jurisdiction", "issuer_class": "identity_authority", "selective_disclosure": true } ], "rules": [ "Credentials are verifiable credential REFERENCES; raw evidence is never stored by Passport Core.", "Every credential supports selective disclosure through the Presentation Engine.", "Revocation is authoritative: a revoked credential fails verification immediately.", "Personal documents (passports, IDs, KYC evidence) are never persisted by Passport Core." ] }, "security": { "never_stores": [ "private keys", "seed phrases", "wallet secrets", "passwords", "raw KYC documents", "government-issued document images", "biometric templates" ], "never_authorizes": [ "payments", "settlement", "value transfer", "economic issuance" ], "always": [ "logs every lifecycle transition", "logs every credential issuance and revocation", "logs every verifier interaction", "expires every presentation", "signs every verifier receipt" ], "threat_model_summary": "Passport Core is a valuable identity target. It compensates by holding no economic authority, no wallet secrets and no raw personal documents. The worst case in a full compromise is the ability to forge presentations — which is mitigated by verifier signatures, credential issuer signatures and time-bound nonces." }, "dependencies": { "consumes": [ { "id": "civilization_event_fabric", "role": "Attests that events emitted by organs are verified." }, { "id": "wallet_binding_service", "role": "Proves control of a wallet without exposing keys.", "status": "PLANNED" }, { "id": "credential_issuers", "role": "External issuers that sign verifiable credentials." }, { "id": "treasury_runtime", "role": "Referenced for MARKET_ENABLED lifecycle attestations. Passport Core never invokes Treasury Runtime for settlement.", "status": "EXTERNAL" } ], "does_not_own": [ "M-Credit issuance or accounting", "settlement", "trade execution", "space infrastructure", "radar signals", "smartdrop campaigns", "labs products", "civilization state (KIRI)" ], "consumers": [ { "id": "marco_portal", "role": "First consumer. Renders public informational surfaces." }, { "id": "marketplace", "role": "Future consumer. Uses Passport for counterparty identity." }, { "id": "space", "role": "Future consumer. Uses Passport for access." }, { "id": "radar", "role": "Future consumer. May emit verified activity for the ledger." }, { "id": "smartdrop", "role": "Future consumer. Uses tier and eligibility claims." }, { "id": "labs", "role": "Future consumer. Uses Passport for access." }, { "id": "treasury_runtime", "role": "Future consumer. Uses Passport as counterparty identity." } ] }, "acceptance_criteria": [ "Every subject has exactly one Passport with one Passport Number.", "Every lifecycle transition emits an auditable event.", "Every activity ledger entry is append-only and idempotent.", "Every field defaults to PRIVATE visibility.", "Every presentation is purpose-scoped, single-use and expiring.", "Every verification returns only the requested claims plus a signed receipt.", "No module writes to another module's state directly.", "No private keys, seed phrases or raw KYC documents are ever stored.", "No economic authority, settlement or payment authorization is ever exposed.", "The protocol registry AND the machine-readable API return the same content, versioned identically." ], "migration": [ "Semantic versioning at the protocol level. This registry is v1.0.0.", "Backwards-compatible additions (new subject fields, new credential types) increment the MINOR version.", "Additive events increment the MINOR version and must be ignorable by existing consumers.", "Breaking changes (removing a field, changing a state transition, altering a claim shape) require a MAJOR version and a documented migration window.", "Every consumer must pin to a MAJOR version. Cross-major consumption is explicitly forbidden." ] }, "registry_version": "1.0.0", "canonical_url": "/api/public/passport-core" }