identity-registry
identity-registry is the chaincode the other three ask before every action: who signed this, with which role, for which station, court or laboratory, and is the key valid now? It also holds the jurisdiction reference data that routing and access rules depend on, and the versioned on-ledger configuration. It has no private data.
Chaincode-level endorsement: any two of the four member organisations. Each record also carries a key-level policy naming its owner, so every write needs the owner's agreement and one other organisation's.
Records
| Record | What it holds | Owner (key-level policy) |
|---|---|---|
institution | One member organisation: MSP ID, kind (POLICE, JUDICIARY, FORENSICS), state codes, collection tag, name | The institution |
state, district, station, stationArea | Reference data of a state. A station has a code such as RJ-JAI-PS07, a kind, bilingual names, an optional bounding box and a status. Station areas map geohash cells to stations for Zero FIR routing. | The state police |
court, courtStation | Courts with their kind (JMFC, CJM, ACJM, MM, CMM, Sessions, Special, High Court), eCourts establishment code, the stations they serve and transfer targets | Judiciary |
lab | A laboratory with its states and divisions, each with a turnaround target in days | Forensics |
key, officialKey, sessionKey | An official's, service's or gateway's public key with roles, designation, jurisdiction, validity and status | The key's institution |
did | A citizen's DID document: up to 10 keys, KYC method and level, status and links | The DID's state police and the judiciary |
delegation | A magistrate's link court while on leave, for at most 90 days | Judiciary |
configPointer, config, configProposal | Versioned configuration and proposals to change it | A majority of all members |
anchor | Creation guards | As the record they guard |
Names of stations, courts and laboratories are public reference data. Names of officials and citizens are never stored here.
System functions
These functions take no signed action. Only an MSP administrator can submit them, and they are signed offline with the administrators' signing tool.
| Function | What it does |
|---|---|
InitNetwork | Once per channel. Creates the founding institutions, states, anchors and version 1 of every configuration name. |
AddInstitution | Adds a new institution, such as another state's police, after the channel configuration admits its MSP. A majority of existing members must endorse it. |
BootstrapRegistrar | Creates an institution's registrar key, with a proof that the registrar holds the key |
AdminRevokeKey | Revokes a key when no registrar can sign, for example a compromised registrar or a lost gateway |
Signed actions
| Action | Who signs | What it does |
|---|---|---|
key.register | A registrar of the institution | Registers an official's, service's or gateway's key (gateways may also be registered by the MSP administrator). With supersedes, replaces an older key. |
key.revoke | A registrar, or the key itself | Revokes a key: lost, compromised, left service, transferred, error or other |
key.register_session, key.revoke_session | The official's device key (a registrar may also revoke) | Adds or ends a session-only key that may sign read requests only |
did.register | A police KYC_ATTESTOR service, with the citizen's proof of possession inside | Creates a citizen's DID with its first key and KYC method and level |
did.add_key, did.revoke_key | The citizen's existing key, or a KYC attestor | Adds or revokes one of the citizen's device keys |
did.link | A KYC attestor | Links an old DID to a new one after a lost phone, by proof with the old key or a fresh identity check |
ref.district, ref.station, ref.station_area | The state police's registrar | Creates or updates districts, stations and station areas |
ref.court | The judiciary's registrar | Creates or updates a court and the stations it serves |
ref.lab | The laboratories' registrar | Creates or updates a laboratory and its divisions |
jurisdiction.delegate, jurisdiction.revoke_delegation | A magistrate going on leave, the delegate, or the judiciary's registrar | Lets another magistrate act for a court for up to 90 days |
config.propose, config.approve | Registrars of different institutions | Changes a configuration value. A new version takes effect once registrars of three institutions agree. |
On-ledger configuration
Rules that may change over time are configuration, not code. Each decision that depends on configuration records the version it used, so a time limit or a duplicate score can be reproduced later.
| Name | Controls |
|---|---|
actions.maxAgeMs | Maximum age of each action type |
filing | Minimum KYC level to file, attachment limits |
signature173 | The three-day signature period of BNSS s.173(1)(ii) |
statutory | Durations of the statutory clocks |
law.sections | Per BNS section: cognizable, bailable, maximum and minimum term, life sentence, flags such as identity-protected offences |
designations | Designation codes with the dspOrAbove and expert329 flags |
dup, hint.models | Duplicate-hint weights and bands, and the registered similarity models |
kyc, keys | Whether the simulator is allowed; level caps; key validity; keys per DID |
finalReport, police | Whether only the SHO may file a final report; the arrest safeguards every arrest must record |
docs | Document kinds a documents service may register |
erasure.rules | Statutory erasure rules, empty by default |
governance | Approvals needed for a configuration change (2, so three institutions in all) |
sms | The numbers the SIM check's SMS goes to, per institution |
categories, exhibitCategories, labAskCodes | Code lists for complaint categories, exhibit categories and laboratory requests |
Queries
| Query | Returns |
|---|---|
ResolveSigner(actor, atMs) | Everything Gate 1 needs about a signer at a given time: key, institution, roles, designation, flags, jurisdiction, delegated courts, status and validity, or the DID's status and KYC level |
ResolveCreator | The submitting certificate's MSP, its gateway key and whether it is active or an MSP administrator |
GetInstitution, ListInstitutions | Institutions |
GetKey, ListKeysByOfficial, ListKeys, SearchKeys | Keys |
GetDID | A DID document |
GetStation, ListStations, SearchStations, ResolveArea | Stations, and the stations covering a geohash cell |
GetCourt, CourtsForStation, GetLab, GetDelegations | Courts, laboratories and delegations |
GetConfig, GetConfigProposal | The configuration value in force at a time, and proposals |
GetRecord, GetHistory | Any record and its versions, newest first, for the backend's integrity check |
Source: digifir-chaincode docs/SPEC.md section 2 and section 10.2.