Freeze source
The source retains record ID, revision, MIME and attachment inventory; frozen bytes must not change under the same reference.
MOBILE-ID · TRUSTED LTANS
Archive Service
Bring finalized records from source systems into preservation with an acknowledgement and tracking reference.
Outcome and scope
Seal the exact record revision before evidence generation and reconcile intake without treating acceptance as preservation completion.
Documentation scope Workflow design and integration contract; operational configuration is confirmed per environment.
| Prepare | Receive |
|---|---|
| Contracts and attachments from signing platforms, closed DMS files and sealed data batches. | Depositors can distinguish received records, work in progress and evidence readiness. |
Participants: Source applications, record owners and intake operators.
Workflow and decision points
Check custody
PROVIDER_MANAGED uses uploadId; CUSTOMER_MANAGED uses dataReference; HASH_ONLY uses externalObjectId. File transfer is outside the 26 REST operations.
Reconcile intake
Check tenant authority, digest and permitted profile/policy. Bind idempotency to request content to detect a reused key with changed data.
Track evidence
Retain archiveId/jobId from the acknowledgement. Track the original job and evidence state; a disconnected HTTP call is not a reason to create a new command.
States, guards and authority
| Current | Guard | Actor | Next | Artifact / recovery |
|---|---|---|---|---|
| RECEIVED / VALIDATING | Authorize tenant, profile and input digest | Archive Service | ACCEPTED / REJECTED | Receipt binds archiveId/jobId; rejection retains a reason without evidence. |
| ACCEPTED | Commit evidence request with outbox | Archive → Evidence | EVIDENCE_PENDING | Reconcile outbox after disconnect; retain original command. |
| EVIDENCE_PENDING | Revision stored and binding checked | Evidence → Archive | EVIDENCE_READY / EVIDENCE_FAILED | Ready requires a result; failure retains identifiers and cause. |
Exceptions and controls
| Situation | Action | Boundary |
|---|---|---|
| Same key and body | Reconcile the accepted result. | No second effect within the agreed window. |
| Digest differs from source bytes | Reject or quarantine at the detection stage. | No completed-evidence claim. |
| TSA fails after intake | Keep the record ID and reconcile its job. | Recover under policy without duplicate intake. |
Authorization, approval and recovery
Authenticate the principal; check tenant, archives:write, format and permitted profile. Bind idempotency to tenant, method, path and request-body hash.
Reject an invalid profile before registration. TSA failure leaves EVIDENCE_PENDING or EVIDENCE_FAILED; resume the same job without creating a duplicate object.
Reconciliation artifacts and acceptance
Retain source IDs, request digest, intake configuration and per-item results; reconcile acknowledgements with archiveId/jobId.
- Changing one byte must fail the digest check; an acknowledgement must not become EVIDENCE_READY without completed evidence.
- Two identical keyed requests retain the same transaction context; changed content is detected as a conflict.
Integration and data contract
| API | Application scope | Documentation |
|---|---|---|
| POST /v1/archives | archives:write | Archive API |
| GET /v1/archives | archives:read | Archive API |
GET /v1/archives/{archiveId} | archives:read | Archive API |
GET /v1/archives/{archiveId}/status | archives:read | Archive API |
Technical input and references
| Element | Definition |
|---|---|
| Input | ArchiveRequest carries MIME type, metadata, profileId, policyId, archival period, group and data reference. |
| Output | Deposit acknowledgement contains archiveId, jobId, policy version and request time; it does not mean evidence generation has completed. |
Four distinct time concepts
| Time | Interpretation |
|---|---|
| Business date | Source-declared issue/transaction date; retain provenance and authority. |
| Receipt time | Service records receipt; evidence generation may still be pending. |
| genTime | Time in a verified TSA token; check digest binding and source. |
| evaluatedAt | Report evaluation time; read with policy, evidenceVersion and trust context. |
An old source date does not create historical evidence. Retain the source date/provenance; receipt or a new token cannot establish historical attestation.
Execute and reconcile a scenario
| Element | Action |
|---|---|
| Synthetic ID | LTANS-SYN-001/r1 |
| Task | Source finalizes primary-record.txt, digest and clientReference; submit once with a stable key. |
| Acceptance case | Reconcile archiveId/jobId; repeat identical key and test changed bytes under the same key. |
These are business test criteria; synthetic packages alone do not establish backend execution or valid ERS.