View source on GitHub →

SDIS & Steward System - Deployment Status

Date: December 12, 2025
Status: ✅ Infrastructure Deployed, ⚠️ Steward System Needs Implementation

🎯 What's Working Now

1. ICN Gateway Deployed ✅

  • URL: http://10.8.30.40:30080
  • Health Check: http://10.8.30.40:30080/v1/health → Working
  • SDIS Health: http://10.8.30.40:30080/v1/sdis/health → Working

2. SDIS API Endpoints ✅

All SDIS endpoints are deployed and accessible:

Enrollment Endpoints

  • POST /v1/sdis/enrollment/start - Start enrollment ceremony
  • GET /v1/sdis/enrollment/{id} - Get ceremony status
  • POST /v1/sdis/enrollment/{id}/finalize - Finalize enrollment

Recovery Endpoints

  • POST /v1/sdis/recovery/start - Start recovery ceremony
  • GET /v1/sdis/recovery/{id} - Get recovery status
  • POST /v1/sdis/recovery/{id}/complete - Complete recovery

Anchor Management

  • GET /v1/sdis/anchor/{id} - Get anchor details
  • POST /v1/sdis/anchor/rotate-keys - Rotate keys
  • GET /v1/sdis/anchor/{id}/history - Get rotation history
  • POST /v1/sdis/anchor/devices/add - Add device
  • GET /v1/sdis/anchor/{id}/devices - List devices

Verification Endpoints

  • POST /v1/sdis/verify/level1 - QR scan verification (offline)
  • POST /v1/sdis/verify/level2 - Binding verification (hybrid)
  • POST /v1/sdis/verify/level3 - Full STARK verification (network)

3. Code Structure ✅

All SDIS code is implemented in:

icn/crates/icn-gateway/src/api/sdis/
├── anchor.rs           # Anchor management endpoints
├── enrollment.rs       # Full enrollment ceremony
├── ephemeral.rs        # Ephemeral proof generation
├── mod.rs              # Module configuration
├── qr.rs               # QR code encoding/decoding
├── recovery.rs         # Recovery ceremony
├── simple_enrollment.rs # Simplified enrollment flow
└── verify.rs           # Multi-level verification

4. Pilot UI Deployed ✅

  • URL: http://10.8.30.40:30030
  • Static files served via nginx
  • Ready for SDIS UI integration

⚠️ What's Missing: Steward System

The SDIS system is fully deployed but cannot process enrollments yet because the Steward system is not implemented.

What Are Stewards?

Stewards are trusted members who:

  1. Vouch for new members during enrollment
  2. Verify identity proofs (government ID, biometrics, organizational sponsorship)
  3. Sign vouches that upgrade enrollment trust levels
  4. Form a trust threshold (e.g., 3 stewards required for Level 2 enrollment)

Steward System Components Needed

1. Steward Role & Permissions

  • Define Steward role in cooperative governance
  • Add steward permissions to trust graph
  • Steward appointment/removal via governance proposals
  • Minimum trust threshold for stewards (e.g., 0.7)

2. Steward Credential System

  • Issue steward credentials (signed by cooperative)
  • Steward DID → Coop mapping in ledger
  • Revocation mechanism for removed stewards
  • Credential expiry and renewal

3. Vouch Data Structure

struct StewardVouch {
    enrollment_id: String,
    steward_did: String,
    pathway_verified: EnrollmentPathway,
    verification_notes: String,
    signature: Signature,
    timestamp: u64,
}

4. Enrollment State Machine

Level 0: Started           → QR code issued
Level 1: Device Verified   → Device scanned QR, proved possession
Level 2: Steward Vouched   → N stewards approved (threshold)
Level 3: Anchor Created    → Permanent DID issued

5. Steward API Endpoints

  • GET /v1/steward/pending - List pending enrollments
  • GET /v1/steward/enrollment/{id} - Get enrollment details
  • POST /v1/steward/vouch - Submit vouch for enrollment
  • GET /v1/steward/my-vouches - List steward's vouches
  • GET /v1/steward/stats - Steward dashboard stats

6. Steward UI (Pilot UI)

  • Login as steward (DID authentication)
  • Pending enrollments list
  • Enrollment detail view (show pathway proof)
  • Vouch button with confirmation
  • Vouch history and statistics
  • Mobile-responsive design

7. EnrollmentManager Actor

  • Track enrollment state (Level 0 → 3)
  • Collect steward vouches
  • Check threshold (e.g., 3 vouches required)
  • Create Anchor when threshold met
  • Gossip enrollment updates to peers
  • Persist enrollments to store

8. Integration Points

  • Gateway → EnrollmentManager handle
  • EnrollmentManager → Identity actor (create Anchor)
  • EnrollmentManager → Ledger (record enrollment)
  • EnrollmentManager → Trust graph (initial trust edges)
  • Gateway → Governance (steward assignments)

📋 Next Steps

Phase 1: Steward Infrastructure (1-2 days)

  1. Create EnrollmentManager actor in icn-core
  2. Define steward role in governance system
  3. Implement vouch data structure and validation
  4. Add enrollment state transitions

Phase 2: Steward API (1 day)

  1. Create /v1/steward/* endpoints in gateway
  2. Wire up EnrollmentManager to gateway
  3. Add authentication middleware for stewards
  4. Test with curl/Postman

Phase 3: Steward UI (2-3 days)

  1. Add steward dashboard to Pilot UI
  2. Pending enrollments list component
  3. Enrollment review and vouch flow
  4. Real-time updates via WebSocket

Phase 4: Testing & Documentation (1 day)

  1. End-to-end enrollment test (3 stewards)
  2. Recovery ceremony test
  3. Write steward onboarding guide
  4. Video walkthrough

🚀 Testing the Current System

Test SDIS Health

curl http://10.8.30.40:30080/v1/sdis/health

Test Gateway Health

curl http://10.8.30.40:30080/v1/health

Check Pod Status

ssh ubuntu@10.8.30.40 'sudo kubectl get pods -n icn'

View Gateway Logs

ssh ubuntu@10.8.30.40 'sudo kubectl logs -n icn -l component=daemon --tail=50'

📚 Architecture References

  • SDIS Design: docs/SDIS_STEWARD_ROADMAP.md
  • Enrollment Flow: icn/crates/icn-gateway/src/api/sdis/enrollment.rs (lines 1-12)
  • Trust Graph: icn/crates/icn-trust/
  • Governance: icn/crates/icn-governance/

🎯 Current Priority

Implement the Steward System to make SDIS enrollments functional. Without stewards, the enrollment endpoints return errors because there's no one to vouch for new members.

Once stewards are implemented, the full flow will be:

  1. User starts enrollment → receives QR code
  2. User scans QR on mobile → proves device possession (Level 1)
  3. Stewards review enrollment → submit vouches
  4. Threshold reached (e.g., 3 vouches) → Anchor created (Level 2)
  5. User receives permanent DID + recovery codes

Status Summary:
✅ Infrastructure: Deployed and working
⚠️ Stewards: Not yet implemented
🎯 Next: Build EnrollmentManager + Steward UI

← Back to Docs