Web Civics mark Web Civics Databox Worksite hazard symbol IN DEVELOPMENT Site & contents contain errors

Data plane

Records, receipts and evidence.

After the Smithy accepts a source event, the deposit gateway commits exact accepted bytes, signs a receipt and appends evidence. Changes never silently overwrite history.

Deposit pipeline

Fail closed at every step.

  1. 1

    Idempotency

    Replayed sourceEventId is rejected, not double-committed.

  2. 2

    Bounds

    Payloads capped (1 MB) and constrained to allowed media types.

  3. 3

    Quarantine

    Binary evidence passes a fail-closed scanner before acceptance.

  4. 4

    Class checks

    recordClass, legalBasis and purpose must be declared.

  5. 5

    Commit

    Exact accepted bytes stored at an opaque acceptedResource URL.

  6. 6

    Receipt

    ES256 JWS acceptance receipt returned in the deposit report.

  7. 7

    Evidence

    Exchange recorded in the append-only evidence ledger.

Immutability

Append-only, supersede, tombstone.

Supersede

A new version links back to the prior record so history remains inspectable.

Tombstone

A record is retired with an auditable marker rather than a silent delete.

Crypto-erase

Where permitted by retention policy: retained-then-unrecoverable deletion.

Durable ledger

Recent work adds DurableEvidenceLedger and WORM storage audit ledger paths for stronger retention guarantees.

Access & retrieval

Assurance-gated notify-then-pull.

Assurance

Record sensitivity is enforced against the assurance of the current authentication — identity proofing, authenticator strength, freshness — not merely account ownership. A profile may require step-up before payload access, and may suppress existence where an exception requires it.

Notify-then-pull

The program deposits a record; the Databox sends a minimal notification; the person’s agent authenticates and pulls the record into storage of their own choosing. Organisation credentials never become authority to browse the consumer Pod.

Corrections & dispositions

Consumer-initiated corrections and contested records go through governed review. Signed dispositions (corrected, statement-associated, partially-corrected, denied, …) remain linked to the evidence chain. Where CKAN publication is enabled, dispositions can propagate to the open-data portal.

Related

Policy, Smithy and deep guides.

Smithy API Records & receipts guide Policies & ODRL