feat: (eID Wallet) New On-boarding Identity Lifecycle

[coodos]

Summary

NOTE: we have changed provider to DIDIT from Veriff, although veriff is still mentioned, DIDIT shall be considered whenver the word veriff appears here.

Onboarding must be KYC-first by default (Veriff) while allowing an explicit skip path. Regardless of verification outcome, the system must always create a base identity and baseline binding documents.

This issue defines:

• Identity lifecycle
• Onboarding control flow
• KYC integration points
• Assurance state transitions
• Audit requirements

Core principles

• Identity is created once
• Assurance level evolves over time
• KYC is default, not mandatory
• Skipping KYC is explicit and auditable
• Baseline cryptographic bindings always exist

Identity states

• UNVERIFIED
  • Baseline identity + binding docs exist
  • No Physical ID / KYC binding
• KYC_VERIFIED
  • Baseline identity + Veriff Physical ID binding exists

Baseline artifacts (always created)

1. ePassport
   • Remote CA signed
   • Binds eName to publicKey
2. Self-asserted profile binding
   • Self-signed
   • Binds user-asserted personal data to eName

lifecycle state machine

stateDiagram-v2
 [*] --> OnboardingStart

 OnboardingStart --> VeriffPrompted: default
 OnboardingStart --> Unverified: skip selected

 VeriffPrompted --> KycVerified: veriff success
 VeriffPrompted --> Unverified: cancel or fail

 Unverified --> VeriffPrompted: user starts KYC later
 KycVerified --> KycVerified: add binding docs

Loading

onboarding execution flow

flowchart TD
 A[Start onboarding] --> B[create keypair in phone provision eVault]
 B --> C[Issue ePassport via Remote CA]
 C --> D{Run Veriff now?}

 D -->|Yes| E[Execute Veriff KYC]
 D -->|Skip| H[Continue as unverified]

 E -->|Success| F[Create Physical ID binding CA-signed]
 E -->|Cancel or fail| H

 F --> G[Set assurance KYC_VERIFIED]
 H --> I[Set assurance UNVERIFIED]

 G --> J[Create self-asserted profile binding self-signed]
 I --> J

 J --> K[Create passphrase hash binding self-signed]
 K --> L[Onboarding complete]

Loading

Post-onboarding behavior

• UNVERIFIED users can initiate Veriff later via:
  • Settings
  • ePassport card
• Veriff success upgrades assurance to KYC_VERIFIED
• Identity (eName + key) is not regenerated during upgrades
• All transitions must emit audit events

Acceptance criteria

• Onboarding defaults into Veriff flow.
• Skip option exists, is explicit, and results in UNVERIFIED.
• ePassport is always issued for every user.
• Self-asserted profile binding is always created for every user.
• Veriff success creates a Physical ID binding document (CA-signed or CA-attested).
• Veriff success upgrades assurance to KYC_VERIFIED.
• UNVERIFIED users can initiate Veriff later from Settings or the ePassport card.
• All state transitions and binding-doc writes emit audit events.