Identity Library Architecture

This document explains the design and implementation of the SEA™ Identity Library.

Dual-State Identity Model

SEA™ implements a two-stage identity lifecycle per SDS-050:

1
2
3
4
5
6
7
8
9

┌─────────────────┐    attest()     ┌─────────────────┐
│   ifl:hash      │ ───────────────>│   ifl:token     │
│  (pre-mint)     │                 │  (attested)     │
└─────────────────┘                 └─────────────────┘
   │                                   │
   │ Deterministic                     │ Federated
   │ Offline-capable                   │ Ledger-backed
   │ Content-addressed                 │ Time-stamped
   │ Unstable until frozen             │ Immutable

Pre-Mint Identity (ifl:hash)

Format: ifl:hash:<sha256-hex>

Properties:

Algorithm:

1
2
3
4
5

function computePreMintIdentity(artifact: SemanticArtifact): string {
  const canonical = normalizeCanonical(artifact);
  const hash = sha256(canonical);
  return `ifl:hash:${hash}`;
}

Canonical Normalization

Per SDS-050 §1.1.1:

  1. Field ordering: Alphabetical
  2. Number normalization: Consistent precision
  3. Unicode normalization: NFC form
  4. Timestamp normalization: UTC

Attested Identity (ifl:token)

Format: ifl:token:<ledger-id>:<sequence-number>

Properties:

Invariants

ID Rule
I-PM-01 Pre-mint identity MUST be reproducible across all environments
I-PM-02 Pre-mint identity computation MUST NOT require network access
I-PM-03 Pre-mint identity MUST change if semantic definition changes
I-PM-04 Pre-mint identity MUST NOT encode timestamps or environment data
I-AT-01 Attested identity MUST reference exactly one pre-mint identity
I-AT-02 Attested identity MUST be signed by authorized role (R-RM or R-LC)

File Structure

1
2
3
4

libs/sea/domain/src/lib/identity/
├── hash-id.ts       # Core identity functions
├── hash-id.spec.ts  # Unit tests
└── index.ts         # Module exports