Platform management transfer, and two certification framework corrections

infrastructure/evault-core/README.md

@@ -59,6 +59,11 @@ sudo nomad agent -dev -network-interface=eth0 -log-level=DEBUG -bind=0.0.0.0
 
 ## Project Setup
 
+Managed PlatformProfile enforcement requires `PUBLIC_REGISTRY_URL` (or `REGISTRY_URL`) and the same
+`REGISTRY_SHARED_SECRET` configured on Registry. eVault asks Registry to authorize writes only for the
+PlatformProfile ontology. Once an eName is managed, Registry outages fail those profile writes closed;
+other ontologies keep their existing behavior.
+
 1. Install dependencies:
 
 ```bash

infrastructure/evault-core/src/core/protocol/vault-access-guard.spec.ts

@@ -53,6 +53,56 @@ describe("VaultAccessGuard", () => {
  keys: [{ ...testJWK, d: undefined }], // Public key only
  },
  });
+ mockedAxios.post.mockResolvedValue({ data: { managed: false, allowed: true } });
+ process.env.REGISTRY_SHARED_SECRET = "registry-secret";
+ });
+
+ describe("managed PlatformProfile writes", () => {
+ const profileInput = {
+ ontology: "550e8400-e29b-41d4-a716-446655440000",
+ payload: { platformName: "example" },
+ acl: ["*"],
+ };
+
+ it("rejects a revoked legacy token before the resolver runs", async () => {
+ mockedAxios.post.mockResolvedValue({
+ data: { managed: true, allowed: false, reason: "The legacy platform token was revoked during migration" },
+ });
+ const resolver = vi.fn(async () => ({ id: "profile" }));
+ const wrapped = guard.middleware(resolver);
+ const context = createMockContext({
+ eName: "@platform",
+ request: { headers: new Headers({ authorization: "Bearer legacy-token" }) } as any,
+ });
+
+ await expect(wrapped(null, { id: "profile-1", input: profileInput }, context)).rejects.toThrow("revoked during migration");
+ expect(resolver).not.toHaveBeenCalled();
+ });
+
+ it("allows the active manager token at the original envelope", async () => {
+ mockedAxios.post.mockResolvedValue({ data: { managed: true, allowed: true } });
+ const resolver = vi.fn(async () => ({ id: "profile" }));
+ const wrapped = guard.middleware(resolver);
+ const managerToken = await createValidToken({
+ platform: "manager-a",
+ kind: "platform-manager",
+ managedEname: "@platform",
+ manager: "manager-a",
+ });
+ const context = createMockContext({
+ eName: "@platform",
+ request: { headers: new Headers({ authorization: `Bearer ${managerToken}` }) } as any,
+ });
+ mockedAxios.get.mockResolvedValue({ data: { keys: [{ ...testJWK, d: undefined }] } });
+
+ await wrapped(null, { id: "profile-1", input: profileInput }, context);
+ expect(mockedAxios.post).toHaveBeenCalledWith(
+ "http://localhost:4322/platforms/management/authorize-profile-write",
+ expect.objectContaining({ ename: "@platform", envelopeId: "profile-1", token: managerToken }),
+ expect.anything(),
+ );
+ expect(resolver).toHaveBeenCalledOnce();
+ });
  });
 
  const createMockContext = (overrides: Partial<VaultContext> = {}): VaultContext => {
@@ -887,4 +937,3 @@ describe("VaultAccessGuard", () => {
  });
  });
 });
-

infrastructure/evault-core/src/core/protocol/vault-access-guard.ts

@@ -18,10 +18,69 @@ type CachedJWKS = {
 const jwksCache = new Map<string, CachedJWKS>();
 const JWKS_TTL_MS = 24 * 60 * 60 * 1000;
 const JWKS_FETCH_TIMEOUT_MS = 5000;
+const PLATFORM_PROFILE_ONTOLOGY = "550e8400-e29b-41d4-a716-446655440000";
 
 export class VaultAccessGuard {
  constructor(private db: DbService) {}
 
+ private bearerToken(context: VaultContext): string | undefined {
+ const authHeader =
+ context.request?.headers?.get("authorization") ??
+ context.request?.headers?.get("Authorization");
+ return authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : undefined;
+ }
+
+ /**
+ * Migrated PlatformProfiles have one Registry-recorded manager. This check
+ * is intentionally scoped to that ontology so PPA decisions and every
+ * unrelated eVault document keep their existing authorization behavior.
+ */
+ private async validateManagedProfileWrite(
+ context: VaultContext,
+ input: { ontology?: unknown } | undefined,
+ envelopeId?: string,
+ ): Promise<void> {
+ if (input?.ontology !== PLATFORM_PROFILE_ONTOLOGY) return;
+ if (!context.eName) throw new Error("X-ENAME header is required for a platform profile write");
+ const registryUrl = process.env.PUBLIC_REGISTRY_URL || process.env.REGISTRY_URL;
+ const sharedSecret = process.env.REGISTRY_SHARED_SECRET;
+ if (!registryUrl || !sharedSecret) {
+ throw new Error("Managed platform profile authorization is unavailable");
+ }
+ try {
+ const response = await axios.post(
+ new URL("/platforms/management/authorize-profile-write", registryUrl).toString(),
+ {
+ ename: context.eName,
+ ontology: input.ontology,
+ ...(envelopeId && { envelopeId }),
+ ...(this.bearerToken(context) && { token: this.bearerToken(context) }),
+ },
+ {
+ timeout: JWKS_FETCH_TIMEOUT_MS,
+ headers: { Authorization: `Bearer ${sharedSecret}` },
+ },
+ );
+ if (response.data?.managed && !response.data?.allowed) {
+ throw new Error(response.data?.reason || "The platform profile is managed by another publisher");
+ }
+ } catch (error) {
+ if (error instanceof Error && (
+ error.message === "The platform profile is managed by another publisher" ||
+ error.message === "The legacy platform token was revoked during migration" ||
+ error.message === "The token is not the active platform manager" ||
+ error.message === "A platform manager token is required" ||
+ error.message === "The managed platform profile has a different envelope ID"
+ )) {
+ throw error;
+ }
+ const reason = axios.isAxiosError(error) && typeof error.response?.data?.error === "string"
+ ? error.response.data.error
+ : "Registry management verification failed";
+ throw new Error(reason);
+ }
+ }
+
  /**
  * Validates JWT token from Authorization header
  * @param authHeader - The Authorization header value
@@ -256,6 +315,10 @@ export class VaultAccessGuard {
  "acl" in args.input &&
  !args.id; // storeMetaEnvelope doesn't have id, updateMetaEnvelopeById does
 
+ await timed("guard.validateManagedProfileWrite", () =>
+ this.validateManagedProfileWrite(context, args.input, args.id),
+ );
+
  // CRITICAL: Validate authentication BEFORE executing any resolver
  await timed("guard.validateAuthentication", () =>
  this.validateAuthentication(context, isStoreOperation),

platforms/registry/api/REGISTRY_PROTOCOL.md

@@ -219,6 +219,27 @@ Authorization: Bearer <shared-secret>
 }
 ```
 
+### 5.1 Managed PlatformProfile Migration
+
+The management API is service-to-service only and requires
+`Authorization: Bearer <REGISTRY_SHARED_SECRET>`. It does not expose the submitted legacy token in
+responses or logs.
+
+- `POST /platforms/migrations/inspect-token` verifies a legacy platform JWT and returns its SHA-256
+ fingerprint.
+- `POST /platforms/migrations/activate` atomically binds an eName and its original PlatformProfile
+ envelope ID to one manager, records the supplied legacy-token fingerprint as revoked, and returns a
+ short-lived manager-scoped token. Repeating the identical transfer is idempotent; a competing
+ transfer returns `409`.
+- `POST /platforms/management/token` issues a new short-lived token only to the recorded manager.
+- `POST /platforms/management/authorize-profile-write` is called by eVault before a PlatformProfile
+ write. Unmanaged eNames retain legacy behavior. Managed profiles accept only their active manager
+ token and original envelope ID.
+
+The write restriction is scoped to User-profile ontology
+`550e8400-e29b-41d4-a716-446655440000`. PPA accreditation envelopes and unrelated eVault records are
+not management writes and retain their existing authorization paths.
+
 ### 6. Platform Discovery Protocol
 
 **Method**: `GET /platforms`

platforms/registry/api/src/config/database.ts

@@ -1,6 +1,7 @@
 import { DataSource } from "typeorm"
 import { Vault } from "../entities/Vault"
 import { SoftwareVersion } from "../entities/SoftwareVersion"
+import { PlatformManagement } from "../entities/PlatformManagement"
 // Import Verification entity from evault-core if available (shared database)
 import * as dotenv from "dotenv"
 import { join } from "path"
@@ -13,7 +14,7 @@ export const AppDataSource = new DataSource({
  url: process.env.REGISTRY_DATABASE_URL || "postgresql://postgres:postgres@localhost:5432/registry",
  synchronize: false,
  logging: process.env.DB_LOGGING === "true",
- entities: [Vault, SoftwareVersion],
+ entities: [Vault, SoftwareVersion, PlatformManagement],
  // Verification entity will be handled by evault-core provisioning service
  migrations: [join(__dirname, "../migrations/*.{ts,js}")],
  migrationsTableName: "migrations",

platforms/registry/api/src/entities/PlatformManagement.ts

@@ -0,0 +1,22 @@
+import { Column, CreateDateColumn, Entity, PrimaryColumn, UpdateDateColumn } from "typeorm";
+
+@Entity()
+export class PlatformManagement {
+ @PrimaryColumn()
+ ename!: string;
+
+ @Column()
+ manager!: string;
+
+ @Column()
+ profileEnvelopeId!: string;
+
+ @Column({ type: "varchar", length: 64 })
+ revokedTokenFingerprint!: string;
+
+ @CreateDateColumn({ type: "timestamptz" })
+ createdAt!: Date;
+
+ @UpdateDateColumn({ type: "timestamptz" })
+ updatedAt!: Date;
+}

platforms/registry/api/src/index.ts

@@ -7,6 +7,7 @@ import { generateEntropy, generatePlatformToken, generateKeyBindingCertificate,
 import { UriResolutionService } from "./services/UriResolutionService";
 import { VaultService } from "./services/VaultService";
 import { SoftwareVersionService, SoftwareVersionConflictError, softwareVersionEName } from "./services/SoftwareVersionService";
+import { PlatformManagementService, PlatformManagementConflictError } from "./services/PlatformManagementService";
 
 import fs from "node:fs";
 
@@ -56,6 +57,7 @@ const initializeDatabase = async () => {
 // Initialize VaultService
 const vaultService = new VaultService(AppDataSource.getRepository("Vault"));
 const softwareVersionService = new SoftwareVersionService(AppDataSource.getRepository("SoftwareVersion"));
+const platformManagementService = new PlatformManagementService(AppDataSource.getRepository("PlatformManagement"));
 
 // Initialize UriResolutionService (simplified for multi-tenant architecture)
 const uriResolutionService = new UriResolutionService();
@@ -188,6 +190,61 @@ server.post("/platforms/certification", async (request, reply) => {
  }
 });
 
+server.post(
+ "/platforms/migrations/inspect-token",
+ { preHandler: checkSharedSecret },
+ async (request, reply) => {
+ try {
+ const { token } = request.body as { token?: string };
+ if (!token) return reply.status(400).send({ error: "token is required" });
+ return await platformManagementService.inspectLegacyToken(token);
+ } catch (error) {
+ return reply.status(401).send({ error: error instanceof Error ? error.message : "Invalid platform token" });
+ }
+ },
+);
+
+server.post(
+ "/platforms/migrations/activate",
+ { preHandler: checkSharedSecret },
+ async (request, reply) => {
+ try {
+ const input = request.body as { ename?: string; manager?: string; profileEnvelopeId?: string; legacyToken?: string };
+ if (!input.ename || !input.manager || !input.profileEnvelopeId || !input.legacyToken) {
+ return reply.status(400).send({ error: "ename, manager, profileEnvelopeId, and legacyToken are required" });
+ }
+ return await platformManagementService.transfer(input as Required<typeof input>);
+ } catch (error) {
+ if (error instanceof PlatformManagementConflictError) return reply.status(409).send({ error: error.message });
+ return reply.status(401).send({ error: error instanceof Error ? error.message : "Migration activation failed" });
+ }
+ },
+);
+
+server.post(
+ "/platforms/management/token",
+ { preHandler: checkSharedSecret },
+ async (request, reply) => {
+ try {
+ const { ename, manager } = request.body as { ename?: string; manager?: string };
+ if (!ename || !manager) return reply.status(400).send({ error: "ename and manager are required" });
+ return { token: await platformManagementService.managerToken(ename, manager) };
+ } catch (error) {
+ return reply.status(403).send({ error: error instanceof Error ? error.message : "Manager token denied" });
+ }
+ },
+);
+
+server.post(
+ "/platforms/management/authorize-profile-write",
+ { preHandler: checkSharedSecret },
+ async (request, reply) => {
+ const input = request.body as { ename?: string; ontology?: string; envelopeId?: string; token?: string };
+ if (!input.ename || !input.ontology) return reply.status(400).send({ error: "ename and ontology are required" });
+ return platformManagementService.authorizeProfileWrite(input as Required<Pick<typeof input, "ename" | "ontology">> & typeof input);
+ },
+);
+
 // Generate key binding certificate (JWT binding ename and publicKey)
 server.post(
  "/key-binding-certificate",

platforms/registry/api/src/jwt.ts

@@ -66,20 +66,50 @@ export async function generatePlatformToken(platform: string): Promise<string> {
  return token;
 }
 
-export async function verifyPlatformToken(token: string): Promise<string | null> {
+export async function generateManagedPlatformToken(ename: string, manager: string): Promise<string> {
+ await initializeKeys();
+ return new SignJWT({
+ platform: manager,
+ kind: "platform-manager",
+ managedEname: ename,
+ manager,
+ })
+ .setProtectedHeader({ alg: "ES256", kid: "entropy-key-1" })
+ .setJti(globalThis.crypto.randomUUID())
+ .setIssuedAt()
+ .setExpirationTime("1h")
+ .sign(privateKey);
+}
+
+export type PlatformTokenClaims = {
+ platform: string;
+ kind?: string;
+ managedEname?: string;
+ manager?: string;
+};
+
+export async function verifyPlatformTokenClaims(token: string): Promise<PlatformTokenClaims | null> {
  await initializeKeys();
  try {
  const { payload } = await import("jose").then(({ jwtVerify }) =>
  jwtVerify(token, publicKey, { algorithms: ["ES256"] })
  );
- return typeof payload.platform === "string" && payload.platform.trim()
- ? payload.platform
- : null;
+ if (typeof payload.platform !== "string" || !payload.platform.trim()) return null;
+ return {
+ platform: payload.platform,
+ ...(typeof payload.kind === "string" && { kind: payload.kind }),
+ ...(typeof payload.managedEname === "string" && { managedEname: payload.managedEname }),
+ ...(typeof payload.manager === "string" && { manager: payload.manager }),
+ };
  } catch {
  return null;
  }
 }
 
+export async function verifyPlatformToken(token: string): Promise<string | null> {
+ return (await verifyPlatformTokenClaims(token))?.platform ?? null;
+}
+
 // Generate and sign a JWT binding ename and publicKey together
 export async function generateKeyBindingCertificate(
  ename: string,

platforms/registry/api/src/migrations/1788090000000-platform-management.ts

@@ -0,0 +1,21 @@
+import type { MigrationInterface, QueryRunner } from "typeorm";
+
+export class PlatformManagement1788090000000 implements MigrationInterface {
+ name = "PlatformManagement1788090000000";
+
+ async up(queryRunner: QueryRunner): Promise<void> {
+ await queryRunner.query(`CREATE TABLE "platform_management" (
+ "ename" character varying NOT NULL,
+ "manager" character varying NOT NULL,
+ "profileEnvelopeId" character varying NOT NULL,
+ "revokedTokenFingerprint" character varying(64) NOT NULL,
+ "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(),
+ "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(),
+ CONSTRAINT "PK_platform_management_ename" PRIMARY KEY ("ename")
+ )`);
+ }
+
+ async down(queryRunner: QueryRunner): Promise<void> {
+ await queryRunner.query(`DROP TABLE "platform_management"`);
+ }
+}

infrastructure/evault-core/README.md

@@ -59,6 +59,11 @@ sudo nomad agent -dev -network-interface=eth0 -log-level=DEBUG -bind=0.0.0.0
 
 ## Project Setup
 
+Managed PlatformProfile enforcement requires `PUBLIC_REGISTRY_URL` (or `REGISTRY_URL`) and the same
+`REGISTRY_SHARED_SECRET` configured on Registry. eVault asks Registry to authorize writes only for the
+PlatformProfile ontology. Once an eName is managed, Registry outages fail those profile writes closed;
+other ontologies keep their existing behavior.
+
 1. Install dependencies:
 
 ```bash

infrastructure/evault-core/src/core/protocol/vault-access-guard.spec.ts

@@ -53,6 +53,56 @@ describe("VaultAccessGuard", () => {
  keys: [{ ...testJWK, d: undefined }], // Public key only
  },
  });
+ mockedAxios.post.mockResolvedValue({ data: { managed: false, allowed: true } });
+ process.env.REGISTRY_SHARED_SECRET = "registry-secret";
+ });
+
+ describe("managed PlatformProfile writes", () => {
+ const profileInput = {
+ ontology: "550e8400-e29b-41d4-a716-446655440000",
+ payload: { platformName: "example" },
+ acl: ["*"],
+ };
+
+ it("rejects a revoked legacy token before the resolver runs", async () => {
+ mockedAxios.post.mockResolvedValue({
+ data: { managed: true, allowed: false, reason: "The legacy platform token was revoked during migration" },
+ });
+ const resolver = vi.fn(async () => ({ id: "profile" }));
+ const wrapped = guard.middleware(resolver);
+ const context = createMockContext({
+ eName: "@platform",
+ request: { headers: new Headers({ authorization: "Bearer legacy-token" }) } as any,
+ });
+
+ await expect(wrapped(null, { id: "profile-1", input: profileInput }, context)).rejects.toThrow("revoked during migration");
+ expect(resolver).not.toHaveBeenCalled();
+ });
+
+ it("allows the active manager token at the original envelope", async () => {
+ mockedAxios.post.mockResolvedValue({ data: { managed: true, allowed: true } });
+ const resolver = vi.fn(async () => ({ id: "profile" }));
+ const wrapped = guard.middleware(resolver);
+ const managerToken = await createValidToken({
+ platform: "manager-a",
+ kind: "platform-manager",
+ managedEname: "@platform",
+ manager: "manager-a",
+ });
+ const context = createMockContext({
+ eName: "@platform",
+ request: { headers: new Headers({ authorization: `Bearer ${managerToken}` }) } as any,
+ });
+ mockedAxios.get.mockResolvedValue({ data: { keys: [{ ...testJWK, d: undefined }] } });
+
+ await wrapped(null, { id: "profile-1", input: profileInput }, context);
+ expect(mockedAxios.post).toHaveBeenCalledWith(
+ "http://localhost:4322/platforms/management/authorize-profile-write",
+ expect.objectContaining({ ename: "@platform", envelopeId: "profile-1", token: managerToken }),
+ expect.anything(),
+ );
+ expect(resolver).toHaveBeenCalledOnce();
+ });
  });
 
  const createMockContext = (overrides: Partial<VaultContext> = {}): VaultContext => {
@@ -887,4 +937,3 @@ describe("VaultAccessGuard", () => {
  });
  });
 });
-

infrastructure/evault-core/src/core/protocol/vault-access-guard.ts

@@ -18,10 +18,69 @@ type CachedJWKS = {
 const jwksCache = new Map<string, CachedJWKS>();
 const JWKS_TTL_MS = 24 * 60 * 60 * 1000;
 const JWKS_FETCH_TIMEOUT_MS = 5000;
+const PLATFORM_PROFILE_ONTOLOGY = "550e8400-e29b-41d4-a716-446655440000";
 
 export class VaultAccessGuard {
  constructor(private db: DbService) {}
 
+ private bearerToken(context: VaultContext): string | undefined {
+ const authHeader =
+ context.request?.headers?.get("authorization") ??
+ context.request?.headers?.get("Authorization");
+ return authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : undefined;
+ }
+
+ /**
+ * Migrated PlatformProfiles have one Registry-recorded manager. This check
+ * is intentionally scoped to that ontology so PPA decisions and every
+ * unrelated eVault document keep their existing authorization behavior.
+ */
+ private async validateManagedProfileWrite(
+ context: VaultContext,
+ input: { ontology?: unknown } | undefined,
+ envelopeId?: string,
+ ): Promise<void> {
+ if (input?.ontology !== PLATFORM_PROFILE_ONTOLOGY) return;
+ if (!context.eName) throw new Error("X-ENAME header is required for a platform profile write");
+ const registryUrl = process.env.PUBLIC_REGISTRY_URL || process.env.REGISTRY_URL;
+ const sharedSecret = process.env.REGISTRY_SHARED_SECRET;
+ if (!registryUrl || !sharedSecret) {
+ throw new Error("Managed platform profile authorization is unavailable");
+ }
+ try {
+ const response = await axios.post(
+ new URL("/platforms/management/authorize-profile-write", registryUrl).toString(),
+ {
+ ename: context.eName,
+ ontology: input.ontology,
+ ...(envelopeId && { envelopeId }),
+ ...(this.bearerToken(context) && { token: this.bearerToken(context) }),
+ },
+ {
+ timeout: JWKS_FETCH_TIMEOUT_MS,
+ headers: { Authorization: `Bearer ${sharedSecret}` },
+ },
+ );
+ if (response.data?.managed && !response.data?.allowed) {
+ throw new Error(response.data?.reason || "The platform profile is managed by another publisher");
+ }
+ } catch (error) {
+ if (error instanceof Error && (
+ error.message === "The platform profile is managed by another publisher" ||
+ error.message === "The legacy platform token was revoked during migration" ||
+ error.message === "The token is not the active platform manager" ||
+ error.message === "A platform manager token is required" ||
+ error.message === "The managed platform profile has a different envelope ID"
+ )) {
+ throw error;
+ }
+ const reason = axios.isAxiosError(error) && typeof error.response?.data?.error === "string"
+ ? error.response.data.error
+ : "Registry management verification failed";
+ throw new Error(reason);
+ }
+ }
+
  /**
  * Validates JWT token from Authorization header
  * @param authHeader - The Authorization header value
@@ -256,6 +315,10 @@ export class VaultAccessGuard {
  "acl" in args.input &&
  !args.id; // storeMetaEnvelope doesn't have id, updateMetaEnvelopeById does
 
+ await timed("guard.validateManagedProfileWrite", () =>
+ this.validateManagedProfileWrite(context, args.input, args.id),
+ );
+
  // CRITICAL: Validate authentication BEFORE executing any resolver
  await timed("guard.validateAuthentication", () =>
  this.validateAuthentication(context, isStoreOperation),

platforms/registry/api/REGISTRY_PROTOCOL.md

@@ -219,6 +219,27 @@ Authorization: Bearer <shared-secret>
 }
 ```
 
+### 5.1 Managed PlatformProfile Migration
+
+The management API is service-to-service only and requires
+`Authorization: Bearer <REGISTRY_SHARED_SECRET>`. It does not expose the submitted legacy token in
+responses or logs.
+
+- `POST /platforms/migrations/inspect-token` verifies a legacy platform JWT and returns its SHA-256
+ fingerprint.
+- `POST /platforms/migrations/activate` atomically binds an eName and its original PlatformProfile
+ envelope ID to one manager, records the supplied legacy-token fingerprint as revoked, and returns a
+ short-lived manager-scoped token. Repeating the identical transfer is idempotent; a competing
+ transfer returns `409`.
+- `POST /platforms/management/token` issues a new short-lived token only to the recorded manager.
+- `POST /platforms/management/authorize-profile-write` is called by eVault before a PlatformProfile
+ write. Unmanaged eNames retain legacy behavior. Managed profiles accept only their active manager
+ token and original envelope ID.
+
+The write restriction is scoped to User-profile ontology
+`550e8400-e29b-41d4-a716-446655440000`. PPA accreditation envelopes and unrelated eVault records are
+not management writes and retain their existing authorization paths.
+
 ### 6. Platform Discovery Protocol
 
 **Method**: `GET /platforms`

platforms/registry/api/src/config/database.ts

@@ -1,6 +1,7 @@
 import { DataSource } from "typeorm"
 import { Vault } from "../entities/Vault"
 import { SoftwareVersion } from "../entities/SoftwareVersion"
+import { PlatformManagement } from "../entities/PlatformManagement"
 // Import Verification entity from evault-core if available (shared database)
 import * as dotenv from "dotenv"
 import { join } from "path"
@@ -13,7 +14,7 @@ export const AppDataSource = new DataSource({
  url: process.env.REGISTRY_DATABASE_URL || "postgresql://postgres:postgres@localhost:5432/registry",
  synchronize: false,
  logging: process.env.DB_LOGGING === "true",
- entities: [Vault, SoftwareVersion],
+ entities: [Vault, SoftwareVersion, PlatformManagement],
  // Verification entity will be handled by evault-core provisioning service
  migrations: [join(__dirname, "../migrations/*.{ts,js}")],
  migrationsTableName: "migrations",

platforms/registry/api/src/entities/PlatformManagement.ts

@@ -0,0 +1,22 @@
+import { Column, CreateDateColumn, Entity, PrimaryColumn, UpdateDateColumn } from "typeorm";
+
+@Entity()
+export class PlatformManagement {
+ @PrimaryColumn()
+ ename!: string;
+
+ @Column()
+ manager!: string;
+
+ @Column()
+ profileEnvelopeId!: string;
+
+ @Column({ type: "varchar", length: 64 })
+ revokedTokenFingerprint!: string;
+
+ @CreateDateColumn({ type: "timestamptz" })
+ createdAt!: Date;
+
+ @UpdateDateColumn({ type: "timestamptz" })
+ updatedAt!: Date;
+}

platforms/registry/api/src/index.ts

@@ -7,6 +7,7 @@ import { generateEntropy, generatePlatformToken, generateKeyBindingCertificate,
 import { UriResolutionService } from "./services/UriResolutionService";
 import { VaultService } from "./services/VaultService";
 import { SoftwareVersionService, SoftwareVersionConflictError, softwareVersionEName } from "./services/SoftwareVersionService";
+import { PlatformManagementService, PlatformManagementConflictError } from "./services/PlatformManagementService";
 
 import fs from "node:fs";
 
@@ -56,6 +57,7 @@ const initializeDatabase = async () => {
 // Initialize VaultService
 const vaultService = new VaultService(AppDataSource.getRepository("Vault"));
 const softwareVersionService = new SoftwareVersionService(AppDataSource.getRepository("SoftwareVersion"));
+const platformManagementService = new PlatformManagementService(AppDataSource.getRepository("PlatformManagement"));
 
 // Initialize UriResolutionService (simplified for multi-tenant architecture)
 const uriResolutionService = new UriResolutionService();
@@ -188,6 +190,61 @@ server.post("/platforms/certification", async (request, reply) => {
  }
 });
 
+server.post(
+ "/platforms/migrations/inspect-token",
+ { preHandler: checkSharedSecret },
+ async (request, reply) => {
+ try {
+ const { token } = request.body as { token?: string };
+ if (!token) return reply.status(400).send({ error: "token is required" });
+ return await platformManagementService.inspectLegacyToken(token);
+ } catch (error) {
+ return reply.status(401).send({ error: error instanceof Error ? error.message : "Invalid platform token" });
+ }
+ },
+);
+
+server.post(
+ "/platforms/migrations/activate",
+ { preHandler: checkSharedSecret },
+ async (request, reply) => {
+ try {
+ const input = request.body as { ename?: string; manager?: string; profileEnvelopeId?: string; legacyToken?: string };
+ if (!input.ename || !input.manager || !input.profileEnvelopeId || !input.legacyToken) {
+ return reply.status(400).send({ error: "ename, manager, profileEnvelopeId, and legacyToken are required" });
+ }
+ return await platformManagementService.transfer(input as Required<typeof input>);
+ } catch (error) {
+ if (error instanceof PlatformManagementConflictError) return reply.status(409).send({ error: error.message });
+ return reply.status(401).send({ error: error instanceof Error ? error.message : "Migration activation failed" });
+ }
+ },
+);
+
+server.post(
+ "/platforms/management/token",
+ { preHandler: checkSharedSecret },
+ async (request, reply) => {
+ try {
+ const { ename, manager } = request.body as { ename?: string; manager?: string };
+ if (!ename || !manager) return reply.status(400).send({ error: "ename and manager are required" });
+ return { token: await platformManagementService.managerToken(ename, manager) };
+ } catch (error) {
+ return reply.status(403).send({ error: error instanceof Error ? error.message : "Manager token denied" });
+ }
+ },
+);
+
+server.post(
+ "/platforms/management/authorize-profile-write",
+ { preHandler: checkSharedSecret },
+ async (request, reply) => {
+ const input = request.body as { ename?: string; ontology?: string; envelopeId?: string; token?: string };
+ if (!input.ename || !input.ontology) return reply.status(400).send({ error: "ename and ontology are required" });
+ return platformManagementService.authorizeProfileWrite(input as Required<Pick<typeof input, "ename" | "ontology">> & typeof input);
+ },
+);
+
 // Generate key binding certificate (JWT binding ename and publicKey)
 server.post(
  "/key-binding-certificate",

platforms/registry/api/src/jwt.ts

@@ -66,20 +66,50 @@ export async function generatePlatformToken(platform: string): Promise<string> {
  return token;
 }
 
-export async function verifyPlatformToken(token: string): Promise<string | null> {
+export async function generateManagedPlatformToken(ename: string, manager: string): Promise<string> {
+ await initializeKeys();
+ return new SignJWT({
+ platform: manager,
+ kind: "platform-manager",
+ managedEname: ename,
+ manager,
+ })
+ .setProtectedHeader({ alg: "ES256", kid: "entropy-key-1" })
+ .setJti(globalThis.crypto.randomUUID())
+ .setIssuedAt()
+ .setExpirationTime("1h")
+ .sign(privateKey);
+}
+
+export type PlatformTokenClaims = {
+ platform: string;
+ kind?: string;
+ managedEname?: string;
+ manager?: string;
+};
+
+export async function verifyPlatformTokenClaims(token: string): Promise<PlatformTokenClaims | null> {
  await initializeKeys();
  try {
  const { payload } = await import("jose").then(({ jwtVerify }) =>
  jwtVerify(token, publicKey, { algorithms: ["ES256"] })
  );
- return typeof payload.platform === "string" && payload.platform.trim()
- ? payload.platform
- : null;
+ if (typeof payload.platform !== "string" || !payload.platform.trim()) return null;
+ return {
+ platform: payload.platform,
+ ...(typeof payload.kind === "string" && { kind: payload.kind }),
+ ...(typeof payload.managedEname === "string" && { managedEname: payload.managedEname }),
+ ...(typeof payload.manager === "string" && { manager: payload.manager }),
+ };
  } catch {
  return null;
  }
 }
 
+export async function verifyPlatformToken(token: string): Promise<string | null> {
+ return (await verifyPlatformTokenClaims(token))?.platform ?? null;
+}
+
 // Generate and sign a JWT binding ename and publicKey together
 export async function generateKeyBindingCertificate(
  ename: string,

platforms/registry/api/src/migrations/1788090000000-platform-management.ts

@@ -0,0 +1,21 @@
+import type { MigrationInterface, QueryRunner } from "typeorm";
+
+export class PlatformManagement1788090000000 implements MigrationInterface {
+ name = "PlatformManagement1788090000000";
+
+ async up(queryRunner: QueryRunner): Promise<void> {
+ await queryRunner.query(`CREATE TABLE "platform_management" (
+ "ename" character varying NOT NULL,
+ "manager" character varying NOT NULL,
+ "profileEnvelopeId" character varying NOT NULL,
+ "revokedTokenFingerprint" character varying(64) NOT NULL,
+ "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(),
+ "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(),
+ CONSTRAINT "PK_platform_management_ename" PRIMARY KEY ("ename")
+ )`);
+ }
+
+ async down(queryRunner: QueryRunner): Promise<void> {
+ await queryRunner.query(`DROP TABLE "platform_management"`);
+ }
+}

infrastructure/evault-core/README.md

@@ -59,6 +59,11 @@ sudo nomad agent -dev -network-interface=eth0 -log-level=DEBUG -bind=0.0.0.0
 
 ## Project Setup
 
+Managed PlatformProfile enforcement requires `PUBLIC_REGISTRY_URL` (or `REGISTRY_URL`) and the same
+`REGISTRY_SHARED_SECRET` configured on Registry. eVault asks Registry to authorize writes only for the
+PlatformProfile ontology. Once an eName is managed, Registry outages fail those profile writes closed;
+other ontologies keep their existing behavior.
+
 1. Install dependencies:
 
 ```bash

infrastructure/evault-core/src/core/protocol/vault-access-guard.spec.ts

@@ -53,6 +53,56 @@ describe("VaultAccessGuard", () => {
  keys: [{ ...testJWK, d: undefined }], // Public key only
  },
  });
+ mockedAxios.post.mockResolvedValue({ data: { managed: false, allowed: true } });
+ process.env.REGISTRY_SHARED_SECRET = "registry-secret";
+ });
+
+ describe("managed PlatformProfile writes", () => {
+ const profileInput = {
+ ontology: "550e8400-e29b-41d4-a716-446655440000",
+ payload: { platformName: "example" },
+ acl: ["*"],
+ };
+
+ it("rejects a revoked legacy token before the resolver runs", async () => {
+ mockedAxios.post.mockResolvedValue({
+ data: { managed: true, allowed: false, reason: "The legacy platform token was revoked during migration" },
+ });
+ const resolver = vi.fn(async () => ({ id: "profile" }));
+ const wrapped = guard.middleware(resolver);
+ const context = createMockContext({
+ eName: "@platform",
+ request: { headers: new Headers({ authorization: "Bearer legacy-token" }) } as any,
+ });
+
+ await expect(wrapped(null, { id: "profile-1", input: profileInput }, context)).rejects.toThrow("revoked during migration");
+ expect(resolver).not.toHaveBeenCalled();
+ });
+
+ it("allows the active manager token at the original envelope", async () => {
+ mockedAxios.post.mockResolvedValue({ data: { managed: true, allowed: true } });
+ const resolver = vi.fn(async () => ({ id: "profile" }));
+ const wrapped = guard.middleware(resolver);
+ const managerToken = await createValidToken({
+ platform: "manager-a",
+ kind: "platform-manager",
+ managedEname: "@platform",
+ manager: "manager-a",
+ });
+ const context = createMockContext({
+ eName: "@platform",
+ request: { headers: new Headers({ authorization: `Bearer ${managerToken}` }) } as any,
+ });
+ mockedAxios.get.mockResolvedValue({ data: { keys: [{ ...testJWK, d: undefined }] } });
+
+ await wrapped(null, { id: "profile-1", input: profileInput }, context);
+ expect(mockedAxios.post).toHaveBeenCalledWith(
+ "http://localhost:4322/platforms/management/authorize-profile-write",
+ expect.objectContaining({ ename: "@platform", envelopeId: "profile-1", token: managerToken }),
+ expect.anything(),
+ );
+ expect(resolver).toHaveBeenCalledOnce();
+ });
  });
 
  const createMockContext = (overrides: Partial<VaultContext> = {}): VaultContext => {
@@ -887,4 +937,3 @@ describe("VaultAccessGuard", () => {
  });
  });
 });
-

infrastructure/evault-core/src/core/protocol/vault-access-guard.ts

@@ -18,10 +18,69 @@ type CachedJWKS = {
 const jwksCache = new Map<string, CachedJWKS>();
 const JWKS_TTL_MS = 24 * 60 * 60 * 1000;
 const JWKS_FETCH_TIMEOUT_MS = 5000;
+const PLATFORM_PROFILE_ONTOLOGY = "550e8400-e29b-41d4-a716-446655440000";
 
 export class VaultAccessGuard {
  constructor(private db: DbService) {}
 
+ private bearerToken(context: VaultContext): string | undefined {
+ const authHeader =
+ context.request?.headers?.get("authorization") ??
+ context.request?.headers?.get("Authorization");
+ return authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : undefined;
+ }
+
+ /**
+ * Migrated PlatformProfiles have one Registry-recorded manager. This check
+ * is intentionally scoped to that ontology so PPA decisions and every
+ * unrelated eVault document keep their existing authorization behavior.
+ */
+ private async validateManagedProfileWrite(
+ context: VaultContext,
+ input: { ontology?: unknown } | undefined,
+ envelopeId?: string,
+ ): Promise<void> {
+ if (input?.ontology !== PLATFORM_PROFILE_ONTOLOGY) return;
+ if (!context.eName) throw new Error("X-ENAME header is required for a platform profile write");
+ const registryUrl = process.env.PUBLIC_REGISTRY_URL || process.env.REGISTRY_URL;
+ const sharedSecret = process.env.REGISTRY_SHARED_SECRET;
+ if (!registryUrl || !sharedSecret) {
+ throw new Error("Managed platform profile authorization is unavailable");
+ }
+ try {
+ const response = await axios.post(
+ new URL("/platforms/management/authorize-profile-write", registryUrl).toString(),
+ {
+ ename: context.eName,
+ ontology: input.ontology,
+ ...(envelopeId && { envelopeId }),
+ ...(this.bearerToken(context) && { token: this.bearerToken(context) }),
+ },
+ {
+ timeout: JWKS_FETCH_TIMEOUT_MS,
+ headers: { Authorization: `Bearer ${sharedSecret}` },
+ },
+ );
+ if (response.data?.managed && !response.data?.allowed) {
+ throw new Error(response.data?.reason || "The platform profile is managed by another publisher");
+ }
+ } catch (error) {
+ if (error instanceof Error && (
+ error.message === "The platform profile is managed by another publisher" ||
+ error.message === "The legacy platform token was revoked during migration" ||
+ error.message === "The token is not the active platform manager" ||
+ error.message === "A platform manager token is required" ||
+ error.message === "The managed platform profile has a different envelope ID"
+ )) {
+ throw error;
+ }
+ const reason = axios.isAxiosError(error) && typeof error.response?.data?.error === "string"
+ ? error.response.data.error
+ : "Registry management verification failed";
+ throw new Error(reason);
+ }
+ }
+
  /**
  * Validates JWT token from Authorization header
  * @param authHeader - The Authorization header value
@@ -256,6 +315,10 @@ export class VaultAccessGuard {
  "acl" in args.input &&
  !args.id; // storeMetaEnvelope doesn't have id, updateMetaEnvelopeById does
 
+ await timed("guard.validateManagedProfileWrite", () =>
+ this.validateManagedProfileWrite(context, args.input, args.id),
+ );
+
  // CRITICAL: Validate authentication BEFORE executing any resolver
  await timed("guard.validateAuthentication", () =>
  this.validateAuthentication(context, isStoreOperation),

platforms/registry/api/REGISTRY_PROTOCOL.md

@@ -219,6 +219,27 @@ Authorization: Bearer <shared-secret>
 }
 ```
 
+### 5.1 Managed PlatformProfile Migration
+
+The management API is service-to-service only and requires
+`Authorization: Bearer <REGISTRY_SHARED_SECRET>`. It does not expose the submitted legacy token in
+responses or logs.
+
+- `POST /platforms/migrations/inspect-token` verifies a legacy platform JWT and returns its SHA-256
+ fingerprint.
+- `POST /platforms/migrations/activate` atomically binds an eName and its original PlatformProfile
+ envelope ID to one manager, records the supplied legacy-token fingerprint as revoked, and returns a
+ short-lived manager-scoped token. Repeating the identical transfer is idempotent; a competing
+ transfer returns `409`.
+- `POST /platforms/management/token` issues a new short-lived token only to the recorded manager.
+- `POST /platforms/management/authorize-profile-write` is called by eVault before a PlatformProfile
+ write. Unmanaged eNames retain legacy behavior. Managed profiles accept only their active manager
+ token and original envelope ID.
+
+The write restriction is scoped to User-profile ontology
+`550e8400-e29b-41d4-a716-446655440000`. PPA accreditation envelopes and unrelated eVault records are
+not management writes and retain their existing authorization paths.
+
 ### 6. Platform Discovery Protocol
 
 **Method**: `GET /platforms`

platforms/registry/api/src/config/database.ts

@@ -1,6 +1,7 @@
 import { DataSource } from "typeorm"
 import { Vault } from "../entities/Vault"
 import { SoftwareVersion } from "../entities/SoftwareVersion"
+import { PlatformManagement } from "../entities/PlatformManagement"
 // Import Verification entity from evault-core if available (shared database)
 import * as dotenv from "dotenv"
 import { join } from "path"
@@ -13,7 +14,7 @@ export const AppDataSource = new DataSource({
  url: process.env.REGISTRY_DATABASE_URL || "postgresql://postgres:postgres@localhost:5432/registry",
  synchronize: false,
  logging: process.env.DB_LOGGING === "true",
- entities: [Vault, SoftwareVersion],
+ entities: [Vault, SoftwareVersion, PlatformManagement],
  // Verification entity will be handled by evault-core provisioning service
  migrations: [join(__dirname, "../migrations/*.{ts,js}")],
  migrationsTableName: "migrations",

platforms/registry/api/src/entities/PlatformManagement.ts

@@ -0,0 +1,22 @@
+import { Column, CreateDateColumn, Entity, PrimaryColumn, UpdateDateColumn } from "typeorm";
+
+@Entity()
+export class PlatformManagement {
+ @PrimaryColumn()
+ ename!: string;
+
+ @Column()
+ manager!: string;
+
+ @Column()
+ profileEnvelopeId!: string;
+
+ @Column({ type: "varchar", length: 64 })
+ revokedTokenFingerprint!: string;
+
+ @CreateDateColumn({ type: "timestamptz" })
+ createdAt!: Date;
+
+ @UpdateDateColumn({ type: "timestamptz" })
+ updatedAt!: Date;
+}

platforms/registry/api/src/index.ts

@@ -7,6 +7,7 @@ import { generateEntropy, generatePlatformToken, generateKeyBindingCertificate,
 import { UriResolutionService } from "./services/UriResolutionService";
 import { VaultService } from "./services/VaultService";
 import { SoftwareVersionService, SoftwareVersionConflictError, softwareVersionEName } from "./services/SoftwareVersionService";
+import { PlatformManagementService, PlatformManagementConflictError } from "./services/PlatformManagementService";
 
 import fs from "node:fs";
 
@@ -56,6 +57,7 @@ const initializeDatabase = async () => {
 // Initialize VaultService
 const vaultService = new VaultService(AppDataSource.getRepository("Vault"));
 const softwareVersionService = new SoftwareVersionService(AppDataSource.getRepository("SoftwareVersion"));
+const platformManagementService = new PlatformManagementService(AppDataSource.getRepository("PlatformManagement"));
 
 // Initialize UriResolutionService (simplified for multi-tenant architecture)
 const uriResolutionService = new UriResolutionService();
@@ -188,6 +190,61 @@ server.post("/platforms/certification", async (request, reply) => {
  }
 });
 
+server.post(
+ "/platforms/migrations/inspect-token",
+ { preHandler: checkSharedSecret },
+ async (request, reply) => {
+ try {
+ const { token } = request.body as { token?: string };
+ if (!token) return reply.status(400).send({ error: "token is required" });
+ return await platformManagementService.inspectLegacyToken(token);
+ } catch (error) {
+ return reply.status(401).send({ error: error instanceof Error ? error.message : "Invalid platform token" });
+ }
+ },
+);
+
+server.post(
+ "/platforms/migrations/activate",
+ { preHandler: checkSharedSecret },
+ async (request, reply) => {
+ try {
+ const input = request.body as { ename?: string; manager?: string; profileEnvelopeId?: string; legacyToken?: string };
+ if (!input.ename || !input.manager || !input.profileEnvelopeId || !input.legacyToken) {
+ return reply.status(400).send({ error: "ename, manager, profileEnvelopeId, and legacyToken are required" });
+ }
+ return await platformManagementService.transfer(input as Required<typeof input>);
+ } catch (error) {
+ if (error instanceof PlatformManagementConflictError) return reply.status(409).send({ error: error.message });
+ return reply.status(401).send({ error: error instanceof Error ? error.message : "Migration activation failed" });
+ }
+ },
+);
+
+server.post(
+ "/platforms/management/token",
+ { preHandler: checkSharedSecret },
+ async (request, reply) => {
+ try {
+ const { ename, manager } = request.body as { ename?: string; manager?: string };
+ if (!ename || !manager) return reply.status(400).send({ error: "ename and manager are required" });
+ return { token: await platformManagementService.managerToken(ename, manager) };
+ } catch (error) {
+ return reply.status(403).send({ error: error instanceof Error ? error.message : "Manager token denied" });
+ }
+ },
+);
+
+server.post(
+ "/platforms/management/authorize-profile-write",
+ { preHandler: checkSharedSecret },
+ async (request, reply) => {
+ const input = request.body as { ename?: string; ontology?: string; envelopeId?: string; token?: string };
+ if (!input.ename || !input.ontology) return reply.status(400).send({ error: "ename and ontology are required" });
+ return platformManagementService.authorizeProfileWrite(input as Required<Pick<typeof input, "ename" | "ontology">> & typeof input);
+ },
+);
+
 // Generate key binding certificate (JWT binding ename and publicKey)
 server.post(
  "/key-binding-certificate",

platforms/registry/api/src/jwt.ts

@@ -66,20 +66,50 @@ export async function generatePlatformToken(platform: string): Promise<string> {
  return token;
 }
 
-export async function verifyPlatformToken(token: string): Promise<string | null> {
+export async function generateManagedPlatformToken(ename: string, manager: string): Promise<string> {
+ await initializeKeys();
+ return new SignJWT({
+ platform: manager,
+ kind: "platform-manager",
+ managedEname: ename,
+ manager,
+ })
+ .setProtectedHeader({ alg: "ES256", kid: "entropy-key-1" })
+ .setJti(globalThis.crypto.randomUUID())
+ .setIssuedAt()
+ .setExpirationTime("1h")
+ .sign(privateKey);
+}
+
+export type PlatformTokenClaims = {
+ platform: string;
+ kind?: string;
+ managedEname?: string;
+ manager?: string;
+};
+
+export async function verifyPlatformTokenClaims(token: string): Promise<PlatformTokenClaims | null> {
  await initializeKeys();
  try {
  const { payload } = await import("jose").then(({ jwtVerify }) =>
  jwtVerify(token, publicKey, { algorithms: ["ES256"] })
  );
- return typeof payload.platform === "string" && payload.platform.trim()
- ? payload.platform
- : null;
+ if (typeof payload.platform !== "string" || !payload.platform.trim()) return null;
+ return {
+ platform: payload.platform,
+ ...(typeof payload.kind === "string" && { kind: payload.kind }),
+ ...(typeof payload.managedEname === "string" && { managedEname: payload.managedEname }),
+ ...(typeof payload.manager === "string" && { manager: payload.manager }),
+ };
  } catch {
  return null;
  }
 }
 
+export async function verifyPlatformToken(token: string): Promise<string | null> {
+ return (await verifyPlatformTokenClaims(token))?.platform ?? null;
+}
+
 // Generate and sign a JWT binding ename and publicKey together
 export async function generateKeyBindingCertificate(
  ename: string,

platforms/registry/api/src/migrations/1788090000000-platform-management.ts

@@ -0,0 +1,21 @@
+import type { MigrationInterface, QueryRunner } from "typeorm";
+
+export class PlatformManagement1788090000000 implements MigrationInterface {
+ name = "PlatformManagement1788090000000";
+
+ async up(queryRunner: QueryRunner): Promise<void> {
+ await queryRunner.query(`CREATE TABLE "platform_management" (
+ "ename" character varying NOT NULL,
+ "manager" character varying NOT NULL,
+ "profileEnvelopeId" character varying NOT NULL,
+ "revokedTokenFingerprint" character varying(64) NOT NULL,
+ "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(),
+ "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(),
+ CONSTRAINT "PK_platform_management_ename" PRIMARY KEY ("ename")
+ )`);
+ }
+
+ async down(queryRunner: QueryRunner): Promise<void> {
+ await queryRunner.query(`DROP TABLE "platform_management"`);
+ }
+}

infrastructure/evault-core/README.md

@@ -59,6 +59,11 @@ sudo nomad agent -dev -network-interface=eth0 -log-level=DEBUG -bind=0.0.0.0
 
 ## Project Setup
 
+Managed PlatformProfile enforcement requires `PUBLIC_REGISTRY_URL` (or `REGISTRY_URL`) and the same
+`REGISTRY_SHARED_SECRET` configured on Registry. eVault asks Registry to authorize writes only for the
+PlatformProfile ontology. Once an eName is managed, Registry outages fail those profile writes closed;
+other ontologies keep their existing behavior.
+
 1. Install dependencies:
 
 ```bash

infrastructure/evault-core/src/core/protocol/vault-access-guard.spec.ts

@@ -53,6 +53,56 @@ describe("VaultAccessGuard", () => {
  keys: [{ ...testJWK, d: undefined }], // Public key only
  },
  });
+ mockedAxios.post.mockResolvedValue({ data: { managed: false, allowed: true } });
+ process.env.REGISTRY_SHARED_SECRET = "registry-secret";
+ });
+
+ describe("managed PlatformProfile writes", () => {
+ const profileInput = {
+ ontology: "550e8400-e29b-41d4-a716-446655440000",
+ payload: { platformName: "example" },
+ acl: ["*"],
+ };
+
+ it("rejects a revoked legacy token before the resolver runs", async () => {
+ mockedAxios.post.mockResolvedValue({
+ data: { managed: true, allowed: false, reason: "The legacy platform token was revoked during migration" },
+ });
+ const resolver = vi.fn(async () => ({ id: "profile" }));
+ const wrapped = guard.middleware(resolver);
+ const context = createMockContext({
+ eName: "@platform",
+ request: { headers: new Headers({ authorization: "Bearer legacy-token" }) } as any,
+ });
+
+ await expect(wrapped(null, { id: "profile-1", input: profileInput }, context)).rejects.toThrow("revoked during migration");
+ expect(resolver).not.toHaveBeenCalled();
+ });
+
+ it("allows the active manager token at the original envelope", async () => {
+ mockedAxios.post.mockResolvedValue({ data: { managed: true, allowed: true } });
+ const resolver = vi.fn(async () => ({ id: "profile" }));
+ const wrapped = guard.middleware(resolver);
+ const managerToken = await createValidToken({
+ platform: "manager-a",
+ kind: "platform-manager",
+ managedEname: "@platform",
+ manager: "manager-a",
+ });
+ const context = createMockContext({
+ eName: "@platform",
+ request: { headers: new Headers({ authorization: `Bearer ${managerToken}` }) } as any,
+ });
+ mockedAxios.get.mockResolvedValue({ data: { keys: [{ ...testJWK, d: undefined }] } });
+
+ await wrapped(null, { id: "profile-1", input: profileInput }, context);
+ expect(mockedAxios.post).toHaveBeenCalledWith(
+ "http://localhost:4322/platforms/management/authorize-profile-write",
+ expect.objectContaining({ ename: "@platform", envelopeId: "profile-1", token: managerToken }),
+ expect.anything(),
+ );
+ expect(resolver).toHaveBeenCalledOnce();
+ });
  });
 
  const createMockContext = (overrides: Partial<VaultContext> = {}): VaultContext => {
@@ -887,4 +937,3 @@ describe("VaultAccessGuard", () => {
  });
  });
 });
-

infrastructure/evault-core/src/core/protocol/vault-access-guard.ts

@@ -18,10 +18,69 @@ type CachedJWKS = {
 const jwksCache = new Map<string, CachedJWKS>();
 const JWKS_TTL_MS = 24 * 60 * 60 * 1000;
 const JWKS_FETCH_TIMEOUT_MS = 5000;
+const PLATFORM_PROFILE_ONTOLOGY = "550e8400-e29b-41d4-a716-446655440000";
 
 export class VaultAccessGuard {
  constructor(private db: DbService) {}
 
+ private bearerToken(context: VaultContext): string | undefined {
+ const authHeader =
+ context.request?.headers?.get("authorization") ??
+ context.request?.headers?.get("Authorization");
+ return authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : undefined;
+ }
+
+ /**
+ * Migrated PlatformProfiles have one Registry-recorded manager. This check
+ * is intentionally scoped to that ontology so PPA decisions and every
+ * unrelated eVault document keep their existing authorization behavior.
+ */
+ private async validateManagedProfileWrite(
+ context: VaultContext,
+ input: { ontology?: unknown } | undefined,
+ envelopeId?: string,
+ ): Promise<void> {
+ if (input?.ontology !== PLATFORM_PROFILE_ONTOLOGY) return;
+ if (!context.eName) throw new Error("X-ENAME header is required for a platform profile write");
+ const registryUrl = process.env.PUBLIC_REGISTRY_URL || process.env.REGISTRY_URL;
+ const sharedSecret = process.env.REGISTRY_SHARED_SECRET;
+ if (!registryUrl || !sharedSecret) {
+ throw new Error("Managed platform profile authorization is unavailable");
+ }
+ try {
+ const response = await axios.post(
+ new URL("/platforms/management/authorize-profile-write", registryUrl).toString(),
+ {
+ ename: context.eName,
+ ontology: input.ontology,
+ ...(envelopeId && { envelopeId }),
+ ...(this.bearerToken(context) && { token: this.bearerToken(context) }),
+ },
+ {
+ timeout: JWKS_FETCH_TIMEOUT_MS,
+ headers: { Authorization: `Bearer ${sharedSecret}` },
+ },
+ );
+ if (response.data?.managed && !response.data?.allowed) {
+ throw new Error(response.data?.reason || "The platform profile is managed by another publisher");
+ }
+ } catch (error) {
+ if (error instanceof Error && (
+ error.message === "The platform profile is managed by another publisher" ||
+ error.message === "The legacy platform token was revoked during migration" ||
+ error.message === "The token is not the active platform manager" ||
+ error.message === "A platform manager token is required" ||
+ error.message === "The managed platform profile has a different envelope ID"
+ )) {
+ throw error;
+ }
+ const reason = axios.isAxiosError(error) && typeof error.response?.data?.error === "string"
+ ? error.response.data.error
+ : "Registry management verification failed";
+ throw new Error(reason);
+ }
+ }
+
  /**
  * Validates JWT token from Authorization header
  * @param authHeader - The Authorization header value
@@ -256,6 +315,10 @@ export class VaultAccessGuard {
  "acl" in args.input &&
  !args.id; // storeMetaEnvelope doesn't have id, updateMetaEnvelopeById does
 
+ await timed("guard.validateManagedProfileWrite", () =>
+ this.validateManagedProfileWrite(context, args.input, args.id),
+ );
+
  // CRITICAL: Validate authentication BEFORE executing any resolver
  await timed("guard.validateAuthentication", () =>
  this.validateAuthentication(context, isStoreOperation),

platforms/registry/api/REGISTRY_PROTOCOL.md

@@ -219,6 +219,27 @@ Authorization: Bearer <shared-secret>
 }
 ```
 
+### 5.1 Managed PlatformProfile Migration
+
+The management API is service-to-service only and requires
+`Authorization: Bearer <REGISTRY_SHARED_SECRET>`. It does not expose the submitted legacy token in
+responses or logs.
+
+- `POST /platforms/migrations/inspect-token` verifies a legacy platform JWT and returns its SHA-256
+ fingerprint.
+- `POST /platforms/migrations/activate` atomically binds an eName and its original PlatformProfile
+ envelope ID to one manager, records the supplied legacy-token fingerprint as revoked, and returns a
+ short-lived manager-scoped token. Repeating the identical transfer is idempotent; a competing
+ transfer returns `409`.
+- `POST /platforms/management/token` issues a new short-lived token only to the recorded manager.
+- `POST /platforms/management/authorize-profile-write` is called by eVault before a PlatformProfile
+ write. Unmanaged eNames retain legacy behavior. Managed profiles accept only their active manager
+ token and original envelope ID.
+
+The write restriction is scoped to User-profile ontology
+`550e8400-e29b-41d4-a716-446655440000`. PPA accreditation envelopes and unrelated eVault records are
+not management writes and retain their existing authorization paths.
+
 ### 6. Platform Discovery Protocol
 
 **Method**: `GET /platforms`

platforms/registry/api/src/config/database.ts

@@ -1,6 +1,7 @@
 import { DataSource } from "typeorm"
 import { Vault } from "../entities/Vault"
 import { SoftwareVersion } from "../entities/SoftwareVersion"
+import { PlatformManagement } from "../entities/PlatformManagement"
 // Import Verification entity from evault-core if available (shared database)
 import * as dotenv from "dotenv"
 import { join } from "path"
@@ -13,7 +14,7 @@ export const AppDataSource = new DataSource({
  url: process.env.REGISTRY_DATABASE_URL || "postgresql://postgres:postgres@localhost:5432/registry",
  synchronize: false,
  logging: process.env.DB_LOGGING === "true",
- entities: [Vault, SoftwareVersion],
+ entities: [Vault, SoftwareVersion, PlatformManagement],
  // Verification entity will be handled by evault-core provisioning service
  migrations: [join(__dirname, "../migrations/*.{ts,js}")],
  migrationsTableName: "migrations",

platforms/registry/api/src/entities/PlatformManagement.ts

@@ -0,0 +1,22 @@
+import { Column, CreateDateColumn, Entity, PrimaryColumn, UpdateDateColumn } from "typeorm";
+
+@Entity()
+export class PlatformManagement {
+ @PrimaryColumn()
+ ename!: string;
+
+ @Column()
+ manager!: string;
+
+ @Column()
+ profileEnvelopeId!: string;
+
+ @Column({ type: "varchar", length: 64 })
+ revokedTokenFingerprint!: string;
+
+ @CreateDateColumn({ type: "timestamptz" })
+ createdAt!: Date;
+
+ @UpdateDateColumn({ type: "timestamptz" })
+ updatedAt!: Date;
+}

platforms/registry/api/src/index.ts

@@ -7,6 +7,7 @@ import { generateEntropy, generatePlatformToken, generateKeyBindingCertificate,
 import { UriResolutionService } from "./services/UriResolutionService";
 import { VaultService } from "./services/VaultService";
 import { SoftwareVersionService, SoftwareVersionConflictError, softwareVersionEName } from "./services/SoftwareVersionService";
+import { PlatformManagementService, PlatformManagementConflictError } from "./services/PlatformManagementService";
 
 import fs from "node:fs";
 
@@ -56,6 +57,7 @@ const initializeDatabase = async () => {
 // Initialize VaultService
 const vaultService = new VaultService(AppDataSource.getRepository("Vault"));
 const softwareVersionService = new SoftwareVersionService(AppDataSource.getRepository("SoftwareVersion"));
+const platformManagementService = new PlatformManagementService(AppDataSource.getRepository("PlatformManagement"));
 
 // Initialize UriResolutionService (simplified for multi-tenant architecture)
 const uriResolutionService = new UriResolutionService();
@@ -188,6 +190,61 @@ server.post("/platforms/certification", async (request, reply) => {
  }
 });
 
+server.post(
+ "/platforms/migrations/inspect-token",
+ { preHandler: checkSharedSecret },
+ async (request, reply) => {
+ try {
+ const { token } = request.body as { token?: string };
+ if (!token) return reply.status(400).send({ error: "token is required" });
+ return await platformManagementService.inspectLegacyToken(token);
+ } catch (error) {
+ return reply.status(401).send({ error: error instanceof Error ? error.message : "Invalid platform token" });
+ }
+ },
+);
+
+server.post(
+ "/platforms/migrations/activate",
+ { preHandler: checkSharedSecret },
+ async (request, reply) => {
+ try {
+ const input = request.body as { ename?: string; manager?: string; profileEnvelopeId?: string; legacyToken?: string };
+ if (!input.ename || !input.manager || !input.profileEnvelopeId || !input.legacyToken) {
+ return reply.status(400).send({ error: "ename, manager, profileEnvelopeId, and legacyToken are required" });
+ }
+ return await platformManagementService.transfer(input as Required<typeof input>);
+ } catch (error) {
+ if (error instanceof PlatformManagementConflictError) return reply.status(409).send({ error: error.message });
+ return reply.status(401).send({ error: error instanceof Error ? error.message : "Migration activation failed" });
+ }
+ },
+);
+
+server.post(
+ "/platforms/management/token",
+ { preHandler: checkSharedSecret },
+ async (request, reply) => {
+ try {
+ const { ename, manager } = request.body as { ename?: string; manager?: string };
+ if (!ename || !manager) return reply.status(400).send({ error: "ename and manager are required" });
+ return { token: await platformManagementService.managerToken(ename, manager) };
+ } catch (error) {
+ return reply.status(403).send({ error: error instanceof Error ? error.message : "Manager token denied" });
+ }
+ },
+);
+
+server.post(
+ "/platforms/management/authorize-profile-write",
+ { preHandler: checkSharedSecret },
+ async (request, reply) => {
+ const input = request.body as { ename?: string; ontology?: string; envelopeId?: string; token?: string };
+ if (!input.ename || !input.ontology) return reply.status(400).send({ error: "ename and ontology are required" });
+ return platformManagementService.authorizeProfileWrite(input as Required<Pick<typeof input, "ename" | "ontology">> & typeof input);
+ },
+);
+
 // Generate key binding certificate (JWT binding ename and publicKey)
 server.post(
  "/key-binding-certificate",

platforms/registry/api/src/jwt.ts

@@ -66,20 +66,50 @@ export async function generatePlatformToken(platform: string): Promise<string> {
  return token;
 }
 
-export async function verifyPlatformToken(token: string): Promise<string | null> {
+export async function generateManagedPlatformToken(ename: string, manager: string): Promise<string> {
+ await initializeKeys();
+ return new SignJWT({
+ platform: manager,
+ kind: "platform-manager",
+ managedEname: ename,
+ manager,
+ })
+ .setProtectedHeader({ alg: "ES256", kid: "entropy-key-1" })
+ .setJti(globalThis.crypto.randomUUID())
+ .setIssuedAt()
+ .setExpirationTime("1h")
+ .sign(privateKey);
+}
+
+export type PlatformTokenClaims = {
+ platform: string;
+ kind?: string;
+ managedEname?: string;
+ manager?: string;
+};
+
+export async function verifyPlatformTokenClaims(token: string): Promise<PlatformTokenClaims | null> {
  await initializeKeys();
  try {
  const { payload } = await import("jose").then(({ jwtVerify }) =>
  jwtVerify(token, publicKey, { algorithms: ["ES256"] })
  );
- return typeof payload.platform === "string" && payload.platform.trim()
- ? payload.platform
- : null;
+ if (typeof payload.platform !== "string" || !payload.platform.trim()) return null;
+ return {
+ platform: payload.platform,
+ ...(typeof payload.kind === "string" && { kind: payload.kind }),
+ ...(typeof payload.managedEname === "string" && { managedEname: payload.managedEname }),
+ ...(typeof payload.manager === "string" && { manager: payload.manager }),
+ };
  } catch {
  return null;
  }
 }
 
+export async function verifyPlatformToken(token: string): Promise<string | null> {
+ return (await verifyPlatformTokenClaims(token))?.platform ?? null;
+}
+
 // Generate and sign a JWT binding ename and publicKey together
 export async function generateKeyBindingCertificate(
  ename: string,

platforms/registry/api/src/migrations/1788090000000-platform-management.ts

@@ -0,0 +1,21 @@
+import type { MigrationInterface, QueryRunner } from "typeorm";
+
+export class PlatformManagement1788090000000 implements MigrationInterface {
+ name = "PlatformManagement1788090000000";
+
+ async up(queryRunner: QueryRunner): Promise<void> {
+ await queryRunner.query(`CREATE TABLE "platform_management" (
+ "ename" character varying NOT NULL,
+ "manager" character varying NOT NULL,
+ "profileEnvelopeId" character varying NOT NULL,
+ "revokedTokenFingerprint" character varying(64) NOT NULL,
+ "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(),
+ "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(),
+ CONSTRAINT "PK_platform_management_ename" PRIMARY KEY ("ename")
+ )`);
+ }
+
+ async down(queryRunner: QueryRunner): Promise<void> {
+ await queryRunner.query(`DROP TABLE "platform_management"`);
+ }
+}

infrastructure/evault-core/README.md

@@ -59,6 +59,11 @@ sudo nomad agent -dev -network-interface=eth0 -log-level=DEBUG -bind=0.0.0.0
 
 ## Project Setup
 
+Managed PlatformProfile enforcement requires `PUBLIC_REGISTRY_URL` (or `REGISTRY_URL`) and the same
+`REGISTRY_SHARED_SECRET` configured on Registry. eVault asks Registry to authorize writes only for the
+PlatformProfile ontology. Once an eName is managed, Registry outages fail those profile writes closed;
+other ontologies keep their existing behavior.
+
 1. Install dependencies:
 
 ```bash

infrastructure/evault-core/src/core/protocol/vault-access-guard.spec.ts

@@ -53,6 +53,56 @@ describe("VaultAccessGuard", () => {
  keys: [{ ...testJWK, d: undefined }], // Public key only
  },
  });
+ mockedAxios.post.mockResolvedValue({ data: { managed: false, allowed: true } });
+ process.env.REGISTRY_SHARED_SECRET = "registry-secret";
+ });
+
+ describe("managed PlatformProfile writes", () => {
+ const profileInput = {
+ ontology: "550e8400-e29b-41d4-a716-446655440000",
+ payload: { platformName: "example" },
+ acl: ["*"],
+ };
+
+ it("rejects a revoked legacy token before the resolver runs", async () => {
+ mockedAxios.post.mockResolvedValue({
+ data: { managed: true, allowed: false, reason: "The legacy platform token was revoked during migration" },
+ });
+ const resolver = vi.fn(async () => ({ id: "profile" }));
+ const wrapped = guard.middleware(resolver);
+ const context = createMockContext({
+ eName: "@platform",
+ request: { headers: new Headers({ authorization: "Bearer legacy-token" }) } as any,
+ });
+
+ await expect(wrapped(null, { id: "profile-1", input: profileInput }, context)).rejects.toThrow("revoked during migration");
+ expect(resolver).not.toHaveBeenCalled();
+ });
+
+ it("allows the active manager token at the original envelope", async () => {
+ mockedAxios.post.mockResolvedValue({ data: { managed: true, allowed: true } });
+ const resolver = vi.fn(async () => ({ id: "profile" }));
+ const wrapped = guard.middleware(resolver);
+ const managerToken = await createValidToken({
+ platform: "manager-a",
+ kind: "platform-manager",
+ managedEname: "@platform",
+ manager: "manager-a",
+ });
+ const context = createMockContext({
+ eName: "@platform",
+ request: { headers: new Headers({ authorization: `Bearer ${managerToken}` }) } as any,
+ });
+ mockedAxios.get.mockResolvedValue({ data: { keys: [{ ...testJWK, d: undefined }] } });
+
+ await wrapped(null, { id: "profile-1", input: profileInput }, context);
+ expect(mockedAxios.post).toHaveBeenCalledWith(
+ "http://localhost:4322/platforms/management/authorize-profile-write",
+ expect.objectContaining({ ename: "@platform", envelopeId: "profile-1", token: managerToken }),
+ expect.anything(),
+ );
+ expect(resolver).toHaveBeenCalledOnce();
+ });
  });
 
  const createMockContext = (overrides: Partial<VaultContext> = {}): VaultContext => {
@@ -887,4 +937,3 @@ describe("VaultAccessGuard", () => {
  });
  });
 });
-

infrastructure/evault-core/src/core/protocol/vault-access-guard.ts

@@ -18,10 +18,69 @@ type CachedJWKS = {
 const jwksCache = new Map<string, CachedJWKS>();
 const JWKS_TTL_MS = 24 * 60 * 60 * 1000;
 const JWKS_FETCH_TIMEOUT_MS = 5000;
+const PLATFORM_PROFILE_ONTOLOGY = "550e8400-e29b-41d4-a716-446655440000";
 
 export class VaultAccessGuard {
  constructor(private db: DbService) {}
 
+ private bearerToken(context: VaultContext): string | undefined {
+ const authHeader =
+ context.request?.headers?.get("authorization") ??
+ context.request?.headers?.get("Authorization");
+ return authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : undefined;
+ }
+
+ /**
+ * Migrated PlatformProfiles have one Registry-recorded manager. This check
+ * is intentionally scoped to that ontology so PPA decisions and every
+ * unrelated eVault document keep their existing authorization behavior.
+ */
+ private async validateManagedProfileWrite(
+ context: VaultContext,
+ input: { ontology?: unknown } | undefined,
+ envelopeId?: string,
+ ): Promise<void> {
+ if (input?.ontology !== PLATFORM_PROFILE_ONTOLOGY) return;
+ if (!context.eName) throw new Error("X-ENAME header is required for a platform profile write");
+ const registryUrl = process.env.PUBLIC_REGISTRY_URL || process.env.REGISTRY_URL;
+ const sharedSecret = process.env.REGISTRY_SHARED_SECRET;
+ if (!registryUrl || !sharedSecret) {
+ throw new Error("Managed platform profile authorization is unavailable");
+ }
+ try {
+ const response = await axios.post(
+ new URL("/platforms/management/authorize-profile-write", registryUrl).toString(),
+ {
+ ename: context.eName,
+ ontology: input.ontology,
+ ...(envelopeId && { envelopeId }),
+ ...(this.bearerToken(context) && { token: this.bearerToken(context) }),
+ },
+ {
+ timeout: JWKS_FETCH_TIMEOUT_MS,
+ headers: { Authorization: `Bearer ${sharedSecret}` },
+ },
+ );
+ if (response.data?.managed && !response.data?.allowed) {
+ throw new Error(response.data?.reason || "The platform profile is managed by another publisher");
+ }
+ } catch (error) {
+ if (error instanceof Error && (
+ error.message === "The platform profile is managed by another publisher" ||
+ error.message === "The legacy platform token was revoked during migration" ||
+ error.message === "The token is not the active platform manager" ||
+ error.message === "A platform manager token is required" ||
+ error.message === "The managed platform profile has a different envelope ID"
+ )) {
+ throw error;
+ }
+ const reason = axios.isAxiosError(error) && typeof error.response?.data?.error === "string"
+ ? error.response.data.error
+ : "Registry management verification failed";
+ throw new Error(reason);
+ }
+ }
+
  /**
  * Validates JWT token from Authorization header
  * @param authHeader - The Authorization header value
@@ -256,6 +315,10 @@ export class VaultAccessGuard {
  "acl" in args.input &&
  !args.id; // storeMetaEnvelope doesn't have id, updateMetaEnvelopeById does
 
+ await timed("guard.validateManagedProfileWrite", () =>
+ this.validateManagedProfileWrite(context, args.input, args.id),
+ );
+
  // CRITICAL: Validate authentication BEFORE executing any resolver
  await timed("guard.validateAuthentication", () =>
  this.validateAuthentication(context, isStoreOperation),

platforms/registry/api/REGISTRY_PROTOCOL.md

@@ -219,6 +219,27 @@ Authorization: Bearer <shared-secret>
 }
 ```
 
+### 5.1 Managed PlatformProfile Migration
+
+The management API is service-to-service only and requires
+`Authorization: Bearer <REGISTRY_SHARED_SECRET>`. It does not expose the submitted legacy token in
+responses or logs.
+
+- `POST /platforms/migrations/inspect-token` verifies a legacy platform JWT and returns its SHA-256
+ fingerprint.
+- `POST /platforms/migrations/activate` atomically binds an eName and its original PlatformProfile
+ envelope ID to one manager, records the supplied legacy-token fingerprint as revoked, and returns a
+ short-lived manager-scoped token. Repeating the identical transfer is idempotent; a competing
+ transfer returns `409`.
+- `POST /platforms/management/token` issues a new short-lived token only to the recorded manager.
+- `POST /platforms/management/authorize-profile-write` is called by eVault before a PlatformProfile
+ write. Unmanaged eNames retain legacy behavior. Managed profiles accept only their active manager
+ token and original envelope ID.
+
+The write restriction is scoped to User-profile ontology
+`550e8400-e29b-41d4-a716-446655440000`. PPA accreditation envelopes and unrelated eVault records are
+not management writes and retain their existing authorization paths.
+
 ### 6. Platform Discovery Protocol
 
 **Method**: `GET /platforms`

platforms/registry/api/src/config/database.ts

@@ -1,6 +1,7 @@
 import { DataSource } from "typeorm"
 import { Vault } from "../entities/Vault"
 import { SoftwareVersion } from "../entities/SoftwareVersion"
+import { PlatformManagement } from "../entities/PlatformManagement"
 // Import Verification entity from evault-core if available (shared database)
 import * as dotenv from "dotenv"
 import { join } from "path"
@@ -13,7 +14,7 @@ export const AppDataSource = new DataSource({
  url: process.env.REGISTRY_DATABASE_URL || "postgresql://postgres:postgres@localhost:5432/registry",
  synchronize: false,
  logging: process.env.DB_LOGGING === "true",
- entities: [Vault, SoftwareVersion],
+ entities: [Vault, SoftwareVersion, PlatformManagement],
  // Verification entity will be handled by evault-core provisioning service
  migrations: [join(__dirname, "../migrations/*.{ts,js}")],
  migrationsTableName: "migrations",

platforms/registry/api/src/entities/PlatformManagement.ts

@@ -0,0 +1,22 @@
+import { Column, CreateDateColumn, Entity, PrimaryColumn, UpdateDateColumn } from "typeorm";
+
+@Entity()
+export class PlatformManagement {
+ @PrimaryColumn()
+ ename!: string;
+
+ @Column()
+ manager!: string;
+
+ @Column()
+ profileEnvelopeId!: string;
+
+ @Column({ type: "varchar", length: 64 })
+ revokedTokenFingerprint!: string;
+
+ @CreateDateColumn({ type: "timestamptz" })
+ createdAt!: Date;
+
+ @UpdateDateColumn({ type: "timestamptz" })
+ updatedAt!: Date;
+}

platforms/registry/api/src/index.ts

@@ -7,6 +7,7 @@ import { generateEntropy, generatePlatformToken, generateKeyBindingCertificate,
 import { UriResolutionService } from "./services/UriResolutionService";
 import { VaultService } from "./services/VaultService";
 import { SoftwareVersionService, SoftwareVersionConflictError, softwareVersionEName } from "./services/SoftwareVersionService";
+import { PlatformManagementService, PlatformManagementConflictError } from "./services/PlatformManagementService";
 
 import fs from "node:fs";
 
@@ -56,6 +57,7 @@ const initializeDatabase = async () => {
 // Initialize VaultService
 const vaultService = new VaultService(AppDataSource.getRepository("Vault"));
 const softwareVersionService = new SoftwareVersionService(AppDataSource.getRepository("SoftwareVersion"));
+const platformManagementService = new PlatformManagementService(AppDataSource.getRepository("PlatformManagement"));
 
 // Initialize UriResolutionService (simplified for multi-tenant architecture)
 const uriResolutionService = new UriResolutionService();
@@ -188,6 +190,61 @@ server.post("/platforms/certification", async (request, reply) => {
  }
 });
 
+server.post(
+ "/platforms/migrations/inspect-token",
+ { preHandler: checkSharedSecret },
+ async (request, reply) => {
+ try {
+ const { token } = request.body as { token?: string };
+ if (!token) return reply.status(400).send({ error: "token is required" });
+ return await platformManagementService.inspectLegacyToken(token);
+ } catch (error) {
+ return reply.status(401).send({ error: error instanceof Error ? error.message : "Invalid platform token" });
+ }
+ },
+);
+
+server.post(
+ "/platforms/migrations/activate",
+ { preHandler: checkSharedSecret },
+ async (request, reply) => {
+ try {
+ const input = request.body as { ename?: string; manager?: string; profileEnvelopeId?: string; legacyToken?: string };
+ if (!input.ename || !input.manager || !input.profileEnvelopeId || !input.legacyToken) {
+ return reply.status(400).send({ error: "ename, manager, profileEnvelopeId, and legacyToken are required" });
+ }
+ return await platformManagementService.transfer(input as Required<typeof input>);
+ } catch (error) {
+ if (error instanceof PlatformManagementConflictError) return reply.status(409).send({ error: error.message });
+ return reply.status(401).send({ error: error instanceof Error ? error.message : "Migration activation failed" });
+ }
+ },
+);
+
+server.post(
+ "/platforms/management/token",
+ { preHandler: checkSharedSecret },
+ async (request, reply) => {
+ try {
+ const { ename, manager } = request.body as { ename?: string; manager?: string };
+ if (!ename || !manager) return reply.status(400).send({ error: "ename and manager are required" });
+ return { token: await platformManagementService.managerToken(ename, manager) };
+ } catch (error) {
+ return reply.status(403).send({ error: error instanceof Error ? error.message : "Manager token denied" });
+ }
+ },
+);
+
+server.post(
+ "/platforms/management/authorize-profile-write",
+ { preHandler: checkSharedSecret },
+ async (request, reply) => {
+ const input = request.body as { ename?: string; ontology?: string; envelopeId?: string; token?: string };
+ if (!input.ename || !input.ontology) return reply.status(400).send({ error: "ename and ontology are required" });
+ return platformManagementService.authorizeProfileWrite(input as Required<Pick<typeof input, "ename" | "ontology">> & typeof input);
+ },
+);
+
 // Generate key binding certificate (JWT binding ename and publicKey)
 server.post(
  "/key-binding-certificate",

platforms/registry/api/src/jwt.ts

@@ -66,20 +66,50 @@ export async function generatePlatformToken(platform: string): Promise<string> {
  return token;
 }
 
-export async function verifyPlatformToken(token: string): Promise<string | null> {
+export async function generateManagedPlatformToken(ename: string, manager: string): Promise<string> {
+ await initializeKeys();
+ return new SignJWT({
+ platform: manager,
+ kind: "platform-manager",
+ managedEname: ename,
+ manager,
+ })
+ .setProtectedHeader({ alg: "ES256", kid: "entropy-key-1" })
+ .setJti(globalThis.crypto.randomUUID())
+ .setIssuedAt()
+ .setExpirationTime("1h")
+ .sign(privateKey);
+}
+
+export type PlatformTokenClaims = {
+ platform: string;
+ kind?: string;
+ managedEname?: string;
+ manager?: string;
+};
+
+export async function verifyPlatformTokenClaims(token: string): Promise<PlatformTokenClaims | null> {
  await initializeKeys();
  try {
  const { payload } = await import("jose").then(({ jwtVerify }) =>
  jwtVerify(token, publicKey, { algorithms: ["ES256"] })
  );
- return typeof payload.platform === "string" && payload.platform.trim()
- ? payload.platform
- : null;
+ if (typeof payload.platform !== "string" || !payload.platform.trim()) return null;
+ return {
+ platform: payload.platform,
+ ...(typeof payload.kind === "string" && { kind: payload.kind }),
+ ...(typeof payload.managedEname === "string" && { managedEname: payload.managedEname }),
+ ...(typeof payload.manager === "string" && { manager: payload.manager }),
+ };
  } catch {
  return null;
  }
 }
 
+export async function verifyPlatformToken(token: string): Promise<string | null> {
+ return (await verifyPlatformTokenClaims(token))?.platform ?? null;
+}
+
 // Generate and sign a JWT binding ename and publicKey together
 export async function generateKeyBindingCertificate(
  ename: string,

platforms/registry/api/src/migrations/1788090000000-platform-management.ts

@@ -0,0 +1,21 @@
+import type { MigrationInterface, QueryRunner } from "typeorm";
+
+export class PlatformManagement1788090000000 implements MigrationInterface {
+ name = "PlatformManagement1788090000000";
+
+ async up(queryRunner: QueryRunner): Promise<void> {
+ await queryRunner.query(`CREATE TABLE "platform_management" (
+ "ename" character varying NOT NULL,
+ "manager" character varying NOT NULL,
+ "profileEnvelopeId" character varying NOT NULL,
+ "revokedTokenFingerprint" character varying(64) NOT NULL,
+ "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(),
+ "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(),
+ CONSTRAINT "PK_platform_management_ename" PRIMARY KEY ("ename")
+ )`);
+ }
+
+ async down(queryRunner: QueryRunner): Promise<void> {
+ await queryRunner.query(`DROP TABLE "platform_management"`);
+ }
+}

infrastructure/evault-core/README.md

@@ -59,6 +59,11 @@ sudo nomad agent -dev -network-interface=eth0 -log-level=DEBUG -bind=0.0.0.0
 
 ## Project Setup
 
+Managed PlatformProfile enforcement requires `PUBLIC_REGISTRY_URL` (or `REGISTRY_URL`) and the same
+`REGISTRY_SHARED_SECRET` configured on Registry. eVault asks Registry to authorize writes only for the
+PlatformProfile ontology. Once an eName is managed, Registry outages fail those profile writes closed;
+other ontologies keep their existing behavior.
+
 1. Install dependencies:
 
 ```bash

infrastructure/evault-core/src/core/protocol/vault-access-guard.spec.ts

@@ -53,6 +53,56 @@ describe("VaultAccessGuard", () => {
  keys: [{ ...testJWK, d: undefined }], // Public key only
  },
  });
+ mockedAxios.post.mockResolvedValue({ data: { managed: false, allowed: true } });
+ process.env.REGISTRY_SHARED_SECRET = "registry-secret";
+ });
+
+ describe("managed PlatformProfile writes", () => {
+ const profileInput = {
+ ontology: "550e8400-e29b-41d4-a716-446655440000",
+ payload: { platformName: "example" },
+ acl: ["*"],
+ };
+
+ it("rejects a revoked legacy token before the resolver runs", async () => {
+ mockedAxios.post.mockResolvedValue({
+ data: { managed: true, allowed: false, reason: "The legacy platform token was revoked during migration" },
+ });
+ const resolver = vi.fn(async () => ({ id: "profile" }));
+ const wrapped = guard.middleware(resolver);
+ const context = createMockContext({
+ eName: "@platform",
+ request: { headers: new Headers({ authorization: "Bearer legacy-token" }) } as any,
+ });
+
+ await expect(wrapped(null, { id: "profile-1", input: profileInput }, context)).rejects.toThrow("revoked during migration");
+ expect(resolver).not.toHaveBeenCalled();
+ });
+
+ it("allows the active manager token at the original envelope", async () => {
+ mockedAxios.post.mockResolvedValue({ data: { managed: true, allowed: true } });
+ const resolver = vi.fn(async () => ({ id: "profile" }));
+ const wrapped = guard.middleware(resolver);
+ const managerToken = await createValidToken({
+ platform: "manager-a",
+ kind: "platform-manager",
+ managedEname: "@platform",
+ manager: "manager-a",
+ });
+ const context = createMockContext({
+ eName: "@platform",
+ request: { headers: new Headers({ authorization: `Bearer ${managerToken}` }) } as any,
+ });
+ mockedAxios.get.mockResolvedValue({ data: { keys: [{ ...testJWK, d: undefined }] } });
+
+ await wrapped(null, { id: "profile-1", input: profileInput }, context);
+ expect(mockedAxios.post).toHaveBeenCalledWith(
+ "http://localhost:4322/platforms/management/authorize-profile-write",
+ expect.objectContaining({ ename: "@platform", envelopeId: "profile-1", token: managerToken }),
+ expect.anything(),
+ );
+ expect(resolver).toHaveBeenCalledOnce();
+ });
  });
 
  const createMockContext = (overrides: Partial<VaultContext> = {}): VaultContext => {
@@ -887,4 +937,3 @@ describe("VaultAccessGuard", () => {
  });
  });
 });
-

infrastructure/evault-core/src/core/protocol/vault-access-guard.ts

@@ -18,10 +18,69 @@ type CachedJWKS = {
 const jwksCache = new Map<string, CachedJWKS>();
 const JWKS_TTL_MS = 24 * 60 * 60 * 1000;
 const JWKS_FETCH_TIMEOUT_MS = 5000;
+const PLATFORM_PROFILE_ONTOLOGY = "550e8400-e29b-41d4-a716-446655440000";
 
 export class VaultAccessGuard {
  constructor(private db: DbService) {}
 
+ private bearerToken(context: VaultContext): string | undefined {
+ const authHeader =
+ context.request?.headers?.get("authorization") ??
+ context.request?.headers?.get("Authorization");
+ return authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : undefined;
+ }
+
+ /**
+ * Migrated PlatformProfiles have one Registry-recorded manager. This check
+ * is intentionally scoped to that ontology so PPA decisions and every
+ * unrelated eVault document keep their existing authorization behavior.
+ */
+ private async validateManagedProfileWrite(
+ context: VaultContext,
+ input: { ontology?: unknown } | undefined,
+ envelopeId?: string,
+ ): Promise<void> {
+ if (input?.ontology !== PLATFORM_PROFILE_ONTOLOGY) return;
+ if (!context.eName) throw new Error("X-ENAME header is required for a platform profile write");
+ const registryUrl = process.env.PUBLIC_REGISTRY_URL || process.env.REGISTRY_URL;
+ const sharedSecret = process.env.REGISTRY_SHARED_SECRET;
+ if (!registryUrl || !sharedSecret) {
+ throw new Error("Managed platform profile authorization is unavailable");
+ }
+ try {
+ const response = await axios.post(
+ new URL("/platforms/management/authorize-profile-write", registryUrl).toString(),
+ {
+ ename: context.eName,
+ ontology: input.ontology,
+ ...(envelopeId && { envelopeId }),
+ ...(this.bearerToken(context) && { token: this.bearerToken(context) }),
+ },
+ {
+ timeout: JWKS_FETCH_TIMEOUT_MS,
+ headers: { Authorization: `Bearer ${sharedSecret}` },
+ },
+ );
+ if (response.data?.managed && !response.data?.allowed) {
+ throw new Error(response.data?.reason || "The platform profile is managed by another publisher");
+ }
+ } catch (error) {
+ if (error instanceof Error && (
+ error.message === "The platform profile is managed by another publisher" ||
+ error.message === "The legacy platform token was revoked during migration" ||
+ error.message === "The token is not the active platform manager" ||
+ error.message === "A platform manager token is required" ||
+ error.message === "The managed platform profile has a different envelope ID"
+ )) {
+ throw error;
+ }
+ const reason = axios.isAxiosError(error) && typeof error.response?.data?.error === "string"
+ ? error.response.data.error
+ : "Registry management verification failed";
+ throw new Error(reason);
+ }
+ }
+
  /**
  * Validates JWT token from Authorization header
  * @param authHeader - The Authorization header value
@@ -256,6 +315,10 @@ export class VaultAccessGuard {
  "acl" in args.input &&
  !args.id; // storeMetaEnvelope doesn't have id, updateMetaEnvelopeById does
 
+ await timed("guard.validateManagedProfileWrite", () =>
+ this.validateManagedProfileWrite(context, args.input, args.id),
+ );
+
  // CRITICAL: Validate authentication BEFORE executing any resolver
  await timed("guard.validateAuthentication", () =>
  this.validateAuthentication(context, isStoreOperation),

platforms/registry/api/REGISTRY_PROTOCOL.md

@@ -219,6 +219,27 @@ Authorization: Bearer <shared-secret>
 }
 ```
 
+### 5.1 Managed PlatformProfile Migration
+
+The management API is service-to-service only and requires
+`Authorization: Bearer <REGISTRY_SHARED_SECRET>`. It does not expose the submitted legacy token in
+responses or logs.
+
+- `POST /platforms/migrations/inspect-token` verifies a legacy platform JWT and returns its SHA-256
+ fingerprint.
+- `POST /platforms/migrations/activate` atomically binds an eName and its original PlatformProfile
+ envelope ID to one manager, records the supplied legacy-token fingerprint as revoked, and returns a
+ short-lived manager-scoped token. Repeating the identical transfer is idempotent; a competing
+ transfer returns `409`.
+- `POST /platforms/management/token` issues a new short-lived token only to the recorded manager.
+- `POST /platforms/management/authorize-profile-write` is called by eVault before a PlatformProfile
+ write. Unmanaged eNames retain legacy behavior. Managed profiles accept only their active manager
+ token and original envelope ID.
+
+The write restriction is scoped to User-profile ontology
+`550e8400-e29b-41d4-a716-446655440000`. PPA accreditation envelopes and unrelated eVault records are
+not management writes and retain their existing authorization paths.
+
 ### 6. Platform Discovery Protocol
 
 **Method**: `GET /platforms`

platforms/registry/api/src/config/database.ts

@@ -1,6 +1,7 @@
 import { DataSource } from "typeorm"
 import { Vault } from "../entities/Vault"
 import { SoftwareVersion } from "../entities/SoftwareVersion"
+import { PlatformManagement } from "../entities/PlatformManagement"
 // Import Verification entity from evault-core if available (shared database)
 import * as dotenv from "dotenv"
 import { join } from "path"
@@ -13,7 +14,7 @@ export const AppDataSource = new DataSource({
  url: process.env.REGISTRY_DATABASE_URL || "postgresql://postgres:postgres@localhost:5432/registry",
  synchronize: false,
  logging: process.env.DB_LOGGING === "true",
- entities: [Vault, SoftwareVersion],
+ entities: [Vault, SoftwareVersion, PlatformManagement],
  // Verification entity will be handled by evault-core provisioning service
  migrations: [join(__dirname, "../migrations/*.{ts,js}")],
  migrationsTableName: "migrations",

platforms/registry/api/src/entities/PlatformManagement.ts

@@ -0,0 +1,22 @@
+import { Column, CreateDateColumn, Entity, PrimaryColumn, UpdateDateColumn } from "typeorm";
+
+@Entity()
+export class PlatformManagement {
+ @PrimaryColumn()
+ ename!: string;
+
+ @Column()
+ manager!: string;
+
+ @Column()
+ profileEnvelopeId!: string;
+
+ @Column({ type: "varchar", length: 64 })
+ revokedTokenFingerprint!: string;
+
+ @CreateDateColumn({ type: "timestamptz" })
+ createdAt!: Date;
+
+ @UpdateDateColumn({ type: "timestamptz" })
+ updatedAt!: Date;
+}

platforms/registry/api/src/index.ts

@@ -7,6 +7,7 @@ import { generateEntropy, generatePlatformToken, generateKeyBindingCertificate,
 import { UriResolutionService } from "./services/UriResolutionService";
 import { VaultService } from "./services/VaultService";
 import { SoftwareVersionService, SoftwareVersionConflictError, softwareVersionEName } from "./services/SoftwareVersionService";
+import { PlatformManagementService, PlatformManagementConflictError } from "./services/PlatformManagementService";
 
 import fs from "node:fs";
 
@@ -56,6 +57,7 @@ const initializeDatabase = async () => {
 // Initialize VaultService
 const vaultService = new VaultService(AppDataSource.getRepository("Vault"));
 const softwareVersionService = new SoftwareVersionService(AppDataSource.getRepository("SoftwareVersion"));
+const platformManagementService = new PlatformManagementService(AppDataSource.getRepository("PlatformManagement"));
 
 // Initialize UriResolutionService (simplified for multi-tenant architecture)
 const uriResolutionService = new UriResolutionService();
@@ -188,6 +190,61 @@ server.post("/platforms/certification", async (request, reply) => {
  }
 });
 
+server.post(
+ "/platforms/migrations/inspect-token",
+ { preHandler: checkSharedSecret },
+ async (request, reply) => {
+ try {
+ const { token } = request.body as { token?: string };
+ if (!token) return reply.status(400).send({ error: "token is required" });
+ return await platformManagementService.inspectLegacyToken(token);
+ } catch (error) {
+ return reply.status(401).send({ error: error instanceof Error ? error.message : "Invalid platform token" });
+ }
+ },
+);
+
+server.post(
+ "/platforms/migrations/activate",
+ { preHandler: checkSharedSecret },
+ async (request, reply) => {
+ try {
+ const input = request.body as { ename?: string; manager?: string; profileEnvelopeId?: string; legacyToken?: string };
+ if (!input.ename || !input.manager || !input.profileEnvelopeId || !input.legacyToken) {
+ return reply.status(400).send({ error: "ename, manager, profileEnvelopeId, and legacyToken are required" });
+ }
+ return await platformManagementService.transfer(input as Required<typeof input>);
+ } catch (error) {
+ if (error instanceof PlatformManagementConflictError) return reply.status(409).send({ error: error.message });
+ return reply.status(401).send({ error: error instanceof Error ? error.message : "Migration activation failed" });
+ }
+ },
+);
+
+server.post(
+ "/platforms/management/token",
+ { preHandler: checkSharedSecret },
+ async (request, reply) => {
+ try {
+ const { ename, manager } = request.body as { ename?: string; manager?: string };
+ if (!ename || !manager) return reply.status(400).send({ error: "ename and manager are required" });
+ return { token: await platformManagementService.managerToken(ename, manager) };
+ } catch (error) {
+ return reply.status(403).send({ error: error instanceof Error ? error.message : "Manager token denied" });
+ }
+ },
+);
+
+server.post(
+ "/platforms/management/authorize-profile-write",
+ { preHandler: checkSharedSecret },
+ async (request, reply) => {
+ const input = request.body as { ename?: string; ontology?: string; envelopeId?: string; token?: string };
+ if (!input.ename || !input.ontology) return reply.status(400).send({ error: "ename and ontology are required" });
+ return platformManagementService.authorizeProfileWrite(input as Required<Pick<typeof input, "ename" | "ontology">> & typeof input);
+ },
+);
+
 // Generate key binding certificate (JWT binding ename and publicKey)
 server.post(
  "/key-binding-certificate",

platforms/registry/api/src/jwt.ts

@@ -66,20 +66,50 @@ export async function generatePlatformToken(platform: string): Promise<string> {
  return token;
 }
 
-export async function verifyPlatformToken(token: string): Promise<string | null> {
+export async function generateManagedPlatformToken(ename: string, manager: string): Promise<string> {
+ await initializeKeys();
+ return new SignJWT({
+ platform: manager,
+ kind: "platform-manager",
+ managedEname: ename,
+ manager,
+ })
+ .setProtectedHeader({ alg: "ES256", kid: "entropy-key-1" })
+ .setJti(globalThis.crypto.randomUUID())
+ .setIssuedAt()
+ .setExpirationTime("1h")
+ .sign(privateKey);
+}
+
+export type PlatformTokenClaims = {
+ platform: string;
+ kind?: string;
+ managedEname?: string;
+ manager?: string;
+};
+
+export async function verifyPlatformTokenClaims(token: string): Promise<PlatformTokenClaims | null> {
  await initializeKeys();
  try {
  const { payload } = await import("jose").then(({ jwtVerify }) =>
  jwtVerify(token, publicKey, { algorithms: ["ES256"] })
  );
- return typeof payload.platform === "string" && payload.platform.trim()
- ? payload.platform
- : null;
+ if (typeof payload.platform !== "string" || !payload.platform.trim()) return null;
+ return {
+ platform: payload.platform,
+ ...(typeof payload.kind === "string" && { kind: payload.kind }),
+ ...(typeof payload.managedEname === "string" && { managedEname: payload.managedEname }),
+ ...(typeof payload.manager === "string" && { manager: payload.manager }),
+ };
  } catch {
  return null;
  }
 }
 
+export async function verifyPlatformToken(token: string): Promise<string | null> {
+ return (await verifyPlatformTokenClaims(token))?.platform ?? null;
+}
+
 // Generate and sign a JWT binding ename and publicKey together
 export async function generateKeyBindingCertificate(
  ename: string,

platforms/registry/api/src/migrations/1788090000000-platform-management.ts

@@ -0,0 +1,21 @@
+import type { MigrationInterface, QueryRunner } from "typeorm";
+
+export class PlatformManagement1788090000000 implements MigrationInterface {
+ name = "PlatformManagement1788090000000";
+
+ async up(queryRunner: QueryRunner): Promise<void> {
+ await queryRunner.query(`CREATE TABLE "platform_management" (
+ "ename" character varying NOT NULL,
+ "manager" character varying NOT NULL,
+ "profileEnvelopeId" character varying NOT NULL,
+ "revokedTokenFingerprint" character varying(64) NOT NULL,
+ "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(),
+ "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(),
+ CONSTRAINT "PK_platform_management_ename" PRIMARY KEY ("ename")
+ )`);
+ }
+
+ async down(queryRunner: QueryRunner): Promise<void> {
+ await queryRunner.query(`DROP TABLE "platform_management"`);
+ }
+}

infrastructure/evault-core/README.md

@@ -59,6 +59,11 @@ sudo nomad agent -dev -network-interface=eth0 -log-level=DEBUG -bind=0.0.0.0
 
 ## Project Setup
 
+Managed PlatformProfile enforcement requires `PUBLIC_REGISTRY_URL` (or `REGISTRY_URL`) and the same
+`REGISTRY_SHARED_SECRET` configured on Registry. eVault asks Registry to authorize writes only for the
+PlatformProfile ontology. Once an eName is managed, Registry outages fail those profile writes closed;
+other ontologies keep their existing behavior.
+
 1. Install dependencies:
 
 ```bash

infrastructure/evault-core/src/core/protocol/vault-access-guard.spec.ts

@@ -53,6 +53,56 @@ describe("VaultAccessGuard", () => {
  keys: [{ ...testJWK, d: undefined }], // Public key only
  },
  });
+ mockedAxios.post.mockResolvedValue({ data: { managed: false, allowed: true } });
+ process.env.REGISTRY_SHARED_SECRET = "registry-secret";
+ });
+
+ describe("managed PlatformProfile writes", () => {
+ const profileInput = {
+ ontology: "550e8400-e29b-41d4-a716-446655440000",
+ payload: { platformName: "example" },
+ acl: ["*"],
+ };
+
+ it("rejects a revoked legacy token before the resolver runs", async () => {
+ mockedAxios.post.mockResolvedValue({
+ data: { managed: true, allowed: false, reason: "The legacy platform token was revoked during migration" },
+ });
+ const resolver = vi.fn(async () => ({ id: "profile" }));
+ const wrapped = guard.middleware(resolver);
+ const context = createMockContext({
+ eName: "@platform",
+ request: { headers: new Headers({ authorization: "Bearer legacy-token" }) } as any,
+ });
+
+ await expect(wrapped(null, { id: "profile-1", input: profileInput }, context)).rejects.toThrow("revoked during migration");
+ expect(resolver).not.toHaveBeenCalled();
+ });
+
+ it("allows the active manager token at the original envelope", async () => {
+ mockedAxios.post.mockResolvedValue({ data: { managed: true, allowed: true } });
+ const resolver = vi.fn(async () => ({ id: "profile" }));
+ const wrapped = guard.middleware(resolver);
+ const managerToken = await createValidToken({
+ platform: "manager-a",
+ kind: "platform-manager",
+ managedEname: "@platform",
+ manager: "manager-a",
+ });
+ const context = createMockContext({
+ eName: "@platform",
+ request: { headers: new Headers({ authorization: `Bearer ${managerToken}` }) } as any,
+ });
+ mockedAxios.get.mockResolvedValue({ data: { keys: [{ ...testJWK, d: undefined }] } });
+
+ await wrapped(null, { id: "profile-1", input: profileInput }, context);
+ expect(mockedAxios.post).toHaveBeenCalledWith(
+ "http://localhost:4322/platforms/management/authorize-profile-write",
+ expect.objectContaining({ ename: "@platform", envelopeId: "profile-1", token: managerToken }),
+ expect.anything(),
+ );
+ expect(resolver).toHaveBeenCalledOnce();
+ });
  });
 
  const createMockContext = (overrides: Partial<VaultContext> = {}): VaultContext => {
@@ -887,4 +937,3 @@ describe("VaultAccessGuard", () => {
  });
  });
 });
-

infrastructure/evault-core/src/core/protocol/vault-access-guard.ts

@@ -18,10 +18,69 @@ type CachedJWKS = {
 const jwksCache = new Map<string, CachedJWKS>();
 const JWKS_TTL_MS = 24 * 60 * 60 * 1000;
 const JWKS_FETCH_TIMEOUT_MS = 5000;
+const PLATFORM_PROFILE_ONTOLOGY = "550e8400-e29b-41d4-a716-446655440000";
 
 export class VaultAccessGuard {
  constructor(private db: DbService) {}
 
+ private bearerToken(context: VaultContext): string | undefined {
+ const authHeader =
+ context.request?.headers?.get("authorization") ??
+ context.request?.headers?.get("Authorization");
+ return authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : undefined;
+ }
+
+ /**
+ * Migrated PlatformProfiles have one Registry-recorded manager. This check
+ * is intentionally scoped to that ontology so PPA decisions and every
+ * unrelated eVault document keep their existing authorization behavior.
+ */
+ private async validateManagedProfileWrite(
+ context: VaultContext,
+ input: { ontology?: unknown } | undefined,
+ envelopeId?: string,
+ ): Promise<void> {
+ if (input?.ontology !== PLATFORM_PROFILE_ONTOLOGY) return;
+ if (!context.eName) throw new Error("X-ENAME header is required for a platform profile write");
+ const registryUrl = process.env.PUBLIC_REGISTRY_URL || process.env.REGISTRY_URL;
+ const sharedSecret = process.env.REGISTRY_SHARED_SECRET;
+ if (!registryUrl || !sharedSecret) {
+ throw new Error("Managed platform profile authorization is unavailable");
+ }
+ try {
+ const response = await axios.post(
+ new URL("/platforms/management/authorize-profile-write", registryUrl).toString(),
+ {
+ ename: context.eName,
+ ontology: input.ontology,
+ ...(envelopeId && { envelopeId }),
+ ...(this.bearerToken(context) && { token: this.bearerToken(context) }),
+ },
+ {
+ timeout: JWKS_FETCH_TIMEOUT_MS,
+ headers: { Authorization: `Bearer ${sharedSecret}` },
+ },
+ );
+ if (response.data?.managed && !response.data?.allowed) {
+ throw new Error(response.data?.reason || "The platform profile is managed by another publisher");
+ }
+ } catch (error) {
+ if (error instanceof Error && (
+ error.message === "The platform profile is managed by another publisher" ||
+ error.message === "The legacy platform token was revoked during migration" ||
+ error.message === "The token is not the active platform manager" ||
+ error.message === "A platform manager token is required" ||
+ error.message === "The managed platform profile has a different envelope ID"
+ )) {
+ throw error;
+ }
+ const reason = axios.isAxiosError(error) && typeof error.response?.data?.error === "string"
+ ? error.response.data.error
+ : "Registry management verification failed";
+ throw new Error(reason);
+ }
+ }
+
  /**
  * Validates JWT token from Authorization header
  * @param authHeader - The Authorization header value
@@ -256,6 +315,10 @@ export class VaultAccessGuard {
  "acl" in args.input &&
  !args.id; // storeMetaEnvelope doesn't have id, updateMetaEnvelopeById does
 
+ await timed("guard.validateManagedProfileWrite", () =>
+ this.validateManagedProfileWrite(context, args.input, args.id),
+ );
+
  // CRITICAL: Validate authentication BEFORE executing any resolver
  await timed("guard.validateAuthentication", () =>
  this.validateAuthentication(context, isStoreOperation),

platforms/registry/api/REGISTRY_PROTOCOL.md

@@ -219,6 +219,27 @@ Authorization: Bearer <shared-secret>
 }
 ```
 
+### 5.1 Managed PlatformProfile Migration
+
+The management API is service-to-service only and requires
+`Authorization: Bearer <REGISTRY_SHARED_SECRET>`. It does not expose the submitted legacy token in
+responses or logs.
+
+- `POST /platforms/migrations/inspect-token` verifies a legacy platform JWT and returns its SHA-256
+ fingerprint.
+- `POST /platforms/migrations/activate` atomically binds an eName and its original PlatformProfile
+ envelope ID to one manager, records the supplied legacy-token fingerprint as revoked, and returns a
+ short-lived manager-scoped token. Repeating the identical transfer is idempotent; a competing
+ transfer returns `409`.
+- `POST /platforms/management/token` issues a new short-lived token only to the recorded manager.
+- `POST /platforms/management/authorize-profile-write` is called by eVault before a PlatformProfile
+ write. Unmanaged eNames retain legacy behavior. Managed profiles accept only their active manager
+ token and original envelope ID.
+
+The write restriction is scoped to User-profile ontology
+`550e8400-e29b-41d4-a716-446655440000`. PPA accreditation envelopes and unrelated eVault records are
+not management writes and retain their existing authorization paths.
+
 ### 6. Platform Discovery Protocol
 
 **Method**: `GET /platforms`

platforms/registry/api/src/config/database.ts

@@ -1,6 +1,7 @@
 import { DataSource } from "typeorm"
 import { Vault } from "../entities/Vault"
 import { SoftwareVersion } from "../entities/SoftwareVersion"
+import { PlatformManagement } from "../entities/PlatformManagement"
 // Import Verification entity from evault-core if available (shared database)
 import * as dotenv from "dotenv"
 import { join } from "path"
@@ -13,7 +14,7 @@ export const AppDataSource = new DataSource({
  url: process.env.REGISTRY_DATABASE_URL || "postgresql://postgres:postgres@localhost:5432/registry",
  synchronize: false,
  logging: process.env.DB_LOGGING === "true",
- entities: [Vault, SoftwareVersion],
+ entities: [Vault, SoftwareVersion, PlatformManagement],
  // Verification entity will be handled by evault-core provisioning service
  migrations: [join(__dirname, "../migrations/*.{ts,js}")],
  migrationsTableName: "migrations",

platforms/registry/api/src/entities/PlatformManagement.ts

@@ -0,0 +1,22 @@
+import { Column, CreateDateColumn, Entity, PrimaryColumn, UpdateDateColumn } from "typeorm";
+
+@Entity()
+export class PlatformManagement {
+ @PrimaryColumn()
+ ename!: string;
+
+ @Column()
+ manager!: string;
+
+ @Column()
+ profileEnvelopeId!: string;
+
+ @Column({ type: "varchar", length: 64 })
+ revokedTokenFingerprint!: string;
+
+ @CreateDateColumn({ type: "timestamptz" })
+ createdAt!: Date;
+
+ @UpdateDateColumn({ type: "timestamptz" })
+ updatedAt!: Date;
+}

platforms/registry/api/src/index.ts

@@ -7,6 +7,7 @@ import { generateEntropy, generatePlatformToken, generateKeyBindingCertificate,
 import { UriResolutionService } from "./services/UriResolutionService";
 import { VaultService } from "./services/VaultService";
 import { SoftwareVersionService, SoftwareVersionConflictError, softwareVersionEName } from "./services/SoftwareVersionService";
+import { PlatformManagementService, PlatformManagementConflictError } from "./services/PlatformManagementService";
 
 import fs from "node:fs";
 
@@ -56,6 +57,7 @@ const initializeDatabase = async () => {
 // Initialize VaultService
 const vaultService = new VaultService(AppDataSource.getRepository("Vault"));
 const softwareVersionService = new SoftwareVersionService(AppDataSource.getRepository("SoftwareVersion"));
+const platformManagementService = new PlatformManagementService(AppDataSource.getRepository("PlatformManagement"));
 
 // Initialize UriResolutionService (simplified for multi-tenant architecture)
 const uriResolutionService = new UriResolutionService();
@@ -188,6 +190,61 @@ server.post("/platforms/certification", async (request, reply) => {
  }
 });
 
+server.post(
+ "/platforms/migrations/inspect-token",
+ { preHandler: checkSharedSecret },
+ async (request, reply) => {
+ try {
+ const { token } = request.body as { token?: string };
+ if (!token) return reply.status(400).send({ error: "token is required" });
+ return await platformManagementService.inspectLegacyToken(token);
+ } catch (error) {
+ return reply.status(401).send({ error: error instanceof Error ? error.message : "Invalid platform token" });
+ }
+ },
+);
+
+server.post(
+ "/platforms/migrations/activate",
+ { preHandler: checkSharedSecret },
+ async (request, reply) => {
+ try {
+ const input = request.body as { ename?: string; manager?: string; profileEnvelopeId?: string; legacyToken?: string };
+ if (!input.ename || !input.manager || !input.profileEnvelopeId || !input.legacyToken) {
+ return reply.status(400).send({ error: "ename, manager, profileEnvelopeId, and legacyToken are required" });
+ }
+ return await platformManagementService.transfer(input as Required<typeof input>);
+ } catch (error) {
+ if (error instanceof PlatformManagementConflictError) return reply.status(409).send({ error: error.message });
+ return reply.status(401).send({ error: error instanceof Error ? error.message : "Migration activation failed" });
+ }
+ },
+);
+
+server.post(
+ "/platforms/management/token",
+ { preHandler: checkSharedSecret },
+ async (request, reply) => {
+ try {
+ const { ename, manager } = request.body as { ename?: string; manager?: string };
+ if (!ename || !manager) return reply.status(400).send({ error: "ename and manager are required" });
+ return { token: await platformManagementService.managerToken(ename, manager) };
+ } catch (error) {
+ return reply.status(403).send({ error: error instanceof Error ? error.message : "Manager token denied" });
+ }
+ },
+);
+
+server.post(
+ "/platforms/management/authorize-profile-write",
+ { preHandler: checkSharedSecret },
+ async (request, reply) => {
+ const input = request.body as { ename?: string; ontology?: string; envelopeId?: string; token?: string };
+ if (!input.ename || !input.ontology) return reply.status(400).send({ error: "ename and ontology are required" });
+ return platformManagementService.authorizeProfileWrite(input as Required<Pick<typeof input, "ename" | "ontology">> & typeof input);
+ },
+);
+
 // Generate key binding certificate (JWT binding ename and publicKey)
 server.post(
  "/key-binding-certificate",

platforms/registry/api/src/jwt.ts

@@ -66,20 +66,50 @@ export async function generatePlatformToken(platform: string): Promise<string> {
  return token;
 }
 
-export async function verifyPlatformToken(token: string): Promise<string | null> {
+export async function generateManagedPlatformToken(ename: string, manager: string): Promise<string> {
+ await initializeKeys();
+ return new SignJWT({
+ platform: manager,
+ kind: "platform-manager",
+ managedEname: ename,
+ manager,
+ })
+ .setProtectedHeader({ alg: "ES256", kid: "entropy-key-1" })
+ .setJti(globalThis.crypto.randomUUID())
+ .setIssuedAt()
+ .setExpirationTime("1h")
+ .sign(privateKey);
+}
+
+export type PlatformTokenClaims = {
+ platform: string;
+ kind?: string;
+ managedEname?: string;
+ manager?: string;
+};
+
+export async function verifyPlatformTokenClaims(token: string): Promise<PlatformTokenClaims | null> {
  await initializeKeys();
  try {
  const { payload } = await import("jose").then(({ jwtVerify }) =>
  jwtVerify(token, publicKey, { algorithms: ["ES256"] })
  );
- return typeof payload.platform === "string" && payload.platform.trim()
- ? payload.platform
- : null;
+ if (typeof payload.platform !== "string" || !payload.platform.trim()) return null;
+ return {
+ platform: payload.platform,
+ ...(typeof payload.kind === "string" && { kind: payload.kind }),
+ ...(typeof payload.managedEname === "string" && { managedEname: payload.managedEname }),
+ ...(typeof payload.manager === "string" && { manager: payload.manager }),
+ };
  } catch {
  return null;
  }
 }
 
+export async function verifyPlatformToken(token: string): Promise<string | null> {
+ return (await verifyPlatformTokenClaims(token))?.platform ?? null;
+}
+
 // Generate and sign a JWT binding ename and publicKey together
 export async function generateKeyBindingCertificate(
  ename: string,

platforms/registry/api/src/migrations/1788090000000-platform-management.ts

@@ -0,0 +1,21 @@
+import type { MigrationInterface, QueryRunner } from "typeorm";
+
+export class PlatformManagement1788090000000 implements MigrationInterface {
+ name = "PlatformManagement1788090000000";
+
+ async up(queryRunner: QueryRunner): Promise<void> {
+ await queryRunner.query(`CREATE TABLE "platform_management" (
+ "ename" character varying NOT NULL,
+ "manager" character varying NOT NULL,
+ "profileEnvelopeId" character varying NOT NULL,
+ "revokedTokenFingerprint" character varying(64) NOT NULL,
+ "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(),
+ "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(),
+ CONSTRAINT "PK_platform_management_ename" PRIMARY KEY ("ename")
+ )`);
+ }
+
+ async down(queryRunner: QueryRunner): Promise<void> {
+ await queryRunner.query(`DROP TABLE "platform_management"`);
+ }
+}

infrastructure/evault-core/README.md

@@ -59,6 +59,11 @@ sudo nomad agent -dev -network-interface=eth0 -log-level=DEBUG -bind=0.0.0.0
 
 ## Project Setup
 
+Managed PlatformProfile enforcement requires `PUBLIC_REGISTRY_URL` (or `REGISTRY_URL`) and the same
+`REGISTRY_SHARED_SECRET` configured on Registry. eVault asks Registry to authorize writes only for the
+PlatformProfile ontology. Once an eName is managed, Registry outages fail those profile writes closed;
+other ontologies keep their existing behavior.
+
 1. Install dependencies:
 
 ```bash

infrastructure/evault-core/src/core/protocol/vault-access-guard.spec.ts

@@ -53,6 +53,56 @@ describe("VaultAccessGuard", () => {
  keys: [{ ...testJWK, d: undefined }], // Public key only
  },
  });
+ mockedAxios.post.mockResolvedValue({ data: { managed: false, allowed: true } });
+ process.env.REGISTRY_SHARED_SECRET = "registry-secret";
+ });
+
+ describe("managed PlatformProfile writes", () => {
+ const profileInput = {
+ ontology: "550e8400-e29b-41d4-a716-446655440000",
+ payload: { platformName: "example" },
+ acl: ["*"],
+ };
+
+ it("rejects a revoked legacy token before the resolver runs", async () => {
+ mockedAxios.post.mockResolvedValue({
+ data: { managed: true, allowed: false, reason: "The legacy platform token was revoked during migration" },
+ });
+ const resolver = vi.fn(async () => ({ id: "profile" }));
+ const wrapped = guard.middleware(resolver);
+ const context = createMockContext({
+ eName: "@platform",
+ request: { headers: new Headers({ authorization: "Bearer legacy-token" }) } as any,
+ });
+
+ await expect(wrapped(null, { id: "profile-1", input: profileInput }, context)).rejects.toThrow("revoked during migration");
+ expect(resolver).not.toHaveBeenCalled();
+ });
+
+ it("allows the active manager token at the original envelope", async () => {
+ mockedAxios.post.mockResolvedValue({ data: { managed: true, allowed: true } });
+ const resolver = vi.fn(async () => ({ id: "profile" }));
+ const wrapped = guard.middleware(resolver);
+ const managerToken = await createValidToken({
+ platform: "manager-a",
+ kind: "platform-manager",
+ managedEname: "@platform",
+ manager: "manager-a",
+ });
+ const context = createMockContext({
+ eName: "@platform",
+ request: { headers: new Headers({ authorization: `Bearer ${managerToken}` }) } as any,
+ });
+ mockedAxios.get.mockResolvedValue({ data: { keys: [{ ...testJWK, d: undefined }] } });
+
+ await wrapped(null, { id: "profile-1", input: profileInput }, context);
+ expect(mockedAxios.post).toHaveBeenCalledWith(
+ "http://localhost:4322/platforms/management/authorize-profile-write",
+ expect.objectContaining({ ename: "@platform", envelopeId: "profile-1", token: managerToken }),
+ expect.anything(),
+ );
+ expect(resolver).toHaveBeenCalledOnce();
+ });
  });
 
  const createMockContext = (overrides: Partial<VaultContext> = {}): VaultContext => {
@@ -887,4 +937,3 @@ describe("VaultAccessGuard", () => {
  });
  });
 });
-

infrastructure/evault-core/src/core/protocol/vault-access-guard.ts

@@ -18,10 +18,69 @@ type CachedJWKS = {
 const jwksCache = new Map<string, CachedJWKS>();
 const JWKS_TTL_MS = 24 * 60 * 60 * 1000;
 const JWKS_FETCH_TIMEOUT_MS = 5000;
+const PLATFORM_PROFILE_ONTOLOGY = "550e8400-e29b-41d4-a716-446655440000";
 
 export class VaultAccessGuard {
  constructor(private db: DbService) {}
 
+ private bearerToken(context: VaultContext): string | undefined {
+ const authHeader =
+ context.request?.headers?.get("authorization") ??
+ context.request?.headers?.get("Authorization");
+ return authHeader?.startsWith("Bearer ") ? authHeader.slice(7) : undefined;
+ }
+
+ /**
+ * Migrated PlatformProfiles have one Registry-recorded manager. This check
+ * is intentionally scoped to that ontology so PPA decisions and every
+ * unrelated eVault document keep their existing authorization behavior.
+ */
+ private async validateManagedProfileWrite(
+ context: VaultContext,
+ input: { ontology?: unknown } | undefined,
+ envelopeId?: string,
+ ): Promise<void> {
+ if (input?.ontology !== PLATFORM_PROFILE_ONTOLOGY) return;
+ if (!context.eName) throw new Error("X-ENAME header is required for a platform profile write");
+ const registryUrl = process.env.PUBLIC_REGISTRY_URL || process.env.REGISTRY_URL;
+ const sharedSecret = process.env.REGISTRY_SHARED_SECRET;
+ if (!registryUrl || !sharedSecret) {
+ throw new Error("Managed platform profile authorization is unavailable");
+ }
+ try {
+ const response = await axios.post(
+ new URL("/platforms/management/authorize-profile-write", registryUrl).toString(),
+ {
+ ename: context.eName,
+ ontology: input.ontology,
+ ...(envelopeId && { envelopeId }),
+ ...(this.bearerToken(context) && { token: this.bearerToken(context) }),
+ },
+ {
+ timeout: JWKS_FETCH_TIMEOUT_MS,
+ headers: { Authorization: `Bearer ${sharedSecret}` },
+ },
+ );
+ if (response.data?.managed && !response.data?.allowed) {
+ throw new Error(response.data?.reason || "The platform profile is managed by another publisher");
+ }
+ } catch (error) {
+ if (error instanceof Error && (
+ error.message === "The platform profile is managed by another publisher" ||
+ error.message === "The legacy platform token was revoked during migration" ||
+ error.message === "The token is not the active platform manager" ||
+ error.message === "A platform manager token is required" ||
+ error.message === "The managed platform profile has a different envelope ID"
+ )) {
+ throw error;
+ }
+ const reason = axios.isAxiosError(error) && typeof error.response?.data?.error === "string"
+ ? error.response.data.error
+ : "Registry management verification failed";
+ throw new Error(reason);
+ }
+ }
+
  /**
  * Validates JWT token from Authorization header
  * @param authHeader - The Authorization header value
@@ -256,6 +315,10 @@ export class VaultAccessGuard {
  "acl" in args.input &&
  !args.id; // storeMetaEnvelope doesn't have id, updateMetaEnvelopeById does
 
+ await timed("guard.validateManagedProfileWrite", () =>
+ this.validateManagedProfileWrite(context, args.input, args.id),
+ );
+
  // CRITICAL: Validate authentication BEFORE executing any resolver
  await timed("guard.validateAuthentication", () =>
  this.validateAuthentication(context, isStoreOperation),

platforms/registry/api/REGISTRY_PROTOCOL.md

@@ -219,6 +219,27 @@ Authorization: Bearer <shared-secret>
 }
 ```
 
+### 5.1 Managed PlatformProfile Migration
+
+The management API is service-to-service only and requires
+`Authorization: Bearer <REGISTRY_SHARED_SECRET>`. It does not expose the submitted legacy token in
+responses or logs.
+
+- `POST /platforms/migrations/inspect-token` verifies a legacy platform JWT and returns its SHA-256
+ fingerprint.
+- `POST /platforms/migrations/activate` atomically binds an eName and its original PlatformProfile
+ envelope ID to one manager, records the supplied legacy-token fingerprint as revoked, and returns a
+ short-lived manager-scoped token. Repeating the identical transfer is idempotent; a competing
+ transfer returns `409`.
+- `POST /platforms/management/token` issues a new short-lived token only to the recorded manager.
+- `POST /platforms/management/authorize-profile-write` is called by eVault before a PlatformProfile
+ write. Unmanaged eNames retain legacy behavior. Managed profiles accept only their active manager
+ token and original envelope ID.
+
+The write restriction is scoped to User-profile ontology
+`550e8400-e29b-41d4-a716-446655440000`. PPA accreditation envelopes and unrelated eVault records are
+not management writes and retain their existing authorization paths.
+
 ### 6. Platform Discovery Protocol
 
 **Method**: `GET /platforms`

platforms/registry/api/src/config/database.ts

@@ -1,6 +1,7 @@
 import { DataSource } from "typeorm"
 import { Vault } from "../entities/Vault"
 import { SoftwareVersion } from "../entities/SoftwareVersion"
+import { PlatformManagement } from "../entities/PlatformManagement"
 // Import Verification entity from evault-core if available (shared database)
 import * as dotenv from "dotenv"
 import { join } from "path"
@@ -13,7 +14,7 @@ export const AppDataSource = new DataSource({
  url: process.env.REGISTRY_DATABASE_URL || "postgresql://postgres:postgres@localhost:5432/registry",
  synchronize: false,
  logging: process.env.DB_LOGGING === "true",
- entities: [Vault, SoftwareVersion],
+ entities: [Vault, SoftwareVersion, PlatformManagement],
  // Verification entity will be handled by evault-core provisioning service
  migrations: [join(__dirname, "../migrations/*.{ts,js}")],
  migrationsTableName: "migrations",

platforms/registry/api/src/entities/PlatformManagement.ts

@@ -0,0 +1,22 @@
+import { Column, CreateDateColumn, Entity, PrimaryColumn, UpdateDateColumn } from "typeorm";
+
+@Entity()
+export class PlatformManagement {
+ @PrimaryColumn()
+ ename!: string;
+
+ @Column()
+ manager!: string;
+
+ @Column()
+ profileEnvelopeId!: string;
+
+ @Column({ type: "varchar", length: 64 })
+ revokedTokenFingerprint!: string;
+
+ @CreateDateColumn({ type: "timestamptz" })
+ createdAt!: Date;
+
+ @UpdateDateColumn({ type: "timestamptz" })
+ updatedAt!: Date;
+}

platforms/registry/api/src/index.ts

@@ -7,6 +7,7 @@ import { generateEntropy, generatePlatformToken, generateKeyBindingCertificate,
 import { UriResolutionService } from "./services/UriResolutionService";
 import { VaultService } from "./services/VaultService";
 import { SoftwareVersionService, SoftwareVersionConflictError, softwareVersionEName } from "./services/SoftwareVersionService";
+import { PlatformManagementService, PlatformManagementConflictError } from "./services/PlatformManagementService";
 
 import fs from "node:fs";
 
@@ -56,6 +57,7 @@ const initializeDatabase = async () => {
 // Initialize VaultService
 const vaultService = new VaultService(AppDataSource.getRepository("Vault"));
 const softwareVersionService = new SoftwareVersionService(AppDataSource.getRepository("SoftwareVersion"));
+const platformManagementService = new PlatformManagementService(AppDataSource.getRepository("PlatformManagement"));
 
 // Initialize UriResolutionService (simplified for multi-tenant architecture)
 const uriResolutionService = new UriResolutionService();
@@ -188,6 +190,61 @@ server.post("/platforms/certification", async (request, reply) => {
  }
 });
 
+server.post(
+ "/platforms/migrations/inspect-token",
+ { preHandler: checkSharedSecret },
+ async (request, reply) => {
+ try {
+ const { token } = request.body as { token?: string };
+ if (!token) return reply.status(400).send({ error: "token is required" });
+ return await platformManagementService.inspectLegacyToken(token);
+ } catch (error) {
+ return reply.status(401).send({ error: error instanceof Error ? error.message : "Invalid platform token" });
+ }
+ },
+);
+
+server.post(
+ "/platforms/migrations/activate",
+ { preHandler: checkSharedSecret },
+ async (request, reply) => {
+ try {
+ const input = request.body as { ename?: string; manager?: string; profileEnvelopeId?: string; legacyToken?: string };
+ if (!input.ename || !input.manager || !input.profileEnvelopeId || !input.legacyToken) {
+ return reply.status(400).send({ error: "ename, manager, profileEnvelopeId, and legacyToken are required" });
+ }
+ return await platformManagementService.transfer(input as Required<typeof input>);
+ } catch (error) {
+ if (error instanceof PlatformManagementConflictError) return reply.status(409).send({ error: error.message });
+ return reply.status(401).send({ error: error instanceof Error ? error.message : "Migration activation failed" });
+ }
+ },
+);
+
+server.post(
+ "/platforms/management/token",
+ { preHandler: checkSharedSecret },
+ async (request, reply) => {
+ try {
+ const { ename, manager } = request.body as { ename?: string; manager?: string };
+ if (!ename || !manager) return reply.status(400).send({ error: "ename and manager are required" });
+ return { token: await platformManagementService.managerToken(ename, manager) };
+ } catch (error) {
+ return reply.status(403).send({ error: error instanceof Error ? error.message : "Manager token denied" });
+ }
+ },
+);
+
+server.post(
+ "/platforms/management/authorize-profile-write",
+ { preHandler: checkSharedSecret },
+ async (request, reply) => {
+ const input = request.body as { ename?: string; ontology?: string; envelopeId?: string; token?: string };
+ if (!input.ename || !input.ontology) return reply.status(400).send({ error: "ename and ontology are required" });
+ return platformManagementService.authorizeProfileWrite(input as Required<Pick<typeof input, "ename" | "ontology">> & typeof input);
+ },
+);
+
 // Generate key binding certificate (JWT binding ename and publicKey)
 server.post(
  "/key-binding-certificate",

platforms/registry/api/src/jwt.ts

@@ -66,20 +66,50 @@ export async function generatePlatformToken(platform: string): Promise<string> {
  return token;
 }
 
-export async function verifyPlatformToken(token: string): Promise<string | null> {
+export async function generateManagedPlatformToken(ename: string, manager: string): Promise<string> {
+ await initializeKeys();
+ return new SignJWT({
+ platform: manager,
+ kind: "platform-manager",
+ managedEname: ename,
+ manager,
+ })
+ .setProtectedHeader({ alg: "ES256", kid: "entropy-key-1" })
+ .setJti(globalThis.crypto.randomUUID())
+ .setIssuedAt()
+ .setExpirationTime("1h")
+ .sign(privateKey);
+}
+
+export type PlatformTokenClaims = {
+ platform: string;
+ kind?: string;
+ managedEname?: string;
+ manager?: string;
+};
+
+export async function verifyPlatformTokenClaims(token: string): Promise<PlatformTokenClaims | null> {
  await initializeKeys();
  try {
  const { payload } = await import("jose").then(({ jwtVerify }) =>
  jwtVerify(token, publicKey, { algorithms: ["ES256"] })
  );
- return typeof payload.platform === "string" && payload.platform.trim()
- ? payload.platform
- : null;
+ if (typeof payload.platform !== "string" || !payload.platform.trim()) return null;
+ return {
+ platform: payload.platform,
+ ...(typeof payload.kind === "string" && { kind: payload.kind }),
+ ...(typeof payload.managedEname === "string" && { managedEname: payload.managedEname }),
+ ...(typeof payload.manager === "string" && { manager: payload.manager }),
+ };
  } catch {
  return null;
  }
 }
 
+export async function verifyPlatformToken(token: string): Promise<string | null> {
+ return (await verifyPlatformTokenClaims(token))?.platform ?? null;
+}
+
 // Generate and sign a JWT binding ename and publicKey together
 export async function generateKeyBindingCertificate(
  ename: string,

platforms/registry/api/src/migrations/1788090000000-platform-management.ts

@@ -0,0 +1,21 @@
+import type { MigrationInterface, QueryRunner } from "typeorm";
+
+export class PlatformManagement1788090000000 implements MigrationInterface {
+ name = "PlatformManagement1788090000000";
+
+ async up(queryRunner: QueryRunner): Promise<void> {
+ await queryRunner.query(`CREATE TABLE "platform_management" (
+ "ename" character varying NOT NULL,
+ "manager" character varying NOT NULL,
+ "profileEnvelopeId" character varying NOT NULL,
+ "revokedTokenFingerprint" character varying(64) NOT NULL,
+ "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(),
+ "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(),
+ CONSTRAINT "PK_platform_management_ename" PRIMARY KEY ("ename")
+ )`);
+ }
+
+ async down(queryRunner: QueryRunner): Promise<void> {
+ await queryRunner.query(`DROP TABLE "platform_management"`);
+ }
+}