Input Output
ARC · Architecture · Discussion draft

Architecture context

Where the 25 runtime components live, who they talk to, and what shape Passport's identity surface takes across the stack. Click any component for its canvas (its design record); click an actor for its role in the system. Use the category pills to focus one slice of the stack.

Click a pill to highlight that category · open-decision workstreams carry a dashed outline and a ? badge
External actors →
User device Trust zone · client-side
Wallet runtime TS / JS
Prover Browser WASM (in-tab); Rust sidecar self-host
Wallet local storage TEE-wrapped
On-chain — Midnight Trust zone · Compact contracts
Off-chain — Passport-adjacent services Substitutable per P8
Upstream Midnight ecosystem External · cross-chain
External identity ecosystem External · DID / VC

Legend

Cn Component — click for canvas
Cn ? Workstream — open architectural decision
Cn Category accent — pills above filter the diagram
Name role External actor — click for role

Notes for reviewers

  • This is a context + container view. It shows where components live and who they talk to, not the data flow for any specific operation. The How it works page walks the account lifecycle end to end.
  • How authority flows. A device signs a call-bound challenge; the account circuit verifies it against enrolled authority (C1, C5, C9). Main supports JubJub and k256; open #175 adds profiled passkey P-256. Local proving keeps witnesses on-device; delegated proving exposes the required witnesses and one-call signature, never the device signing key (C6, C7). Recovery uses the merged two-phase signature gate and an epoch bump (C14, C15). See the 1 October development status for evidence and integration boundaries.
  • Workstreams are explicitly unresolved. C3 (DID surface), C22 (intent surface), C24 (fee model — mechanism confirmed, sponsor operator open), and C25 (cross-chain interface) are dashed because a live decision remains. C4 (asset custody) has resolved to stateless contract custody, normative in MIP-0012. Placement may shift once a workstream resolves.
  • C3 sits inside the on-chain zone as the primary architectural element, but the workstream's resolution runs through engagement with the external midnight-did repository — drawn alongside in the external identity ecosystem.
  • C8 (domain separation) is cross-cutting and shown as an annotation rather than placed in any single zone — every persistentHash use site needs a registered prefix.
  • C6 / C7 / C20 are placed in the proof server sub-zone for clarity; in practice their orchestration code lives in the wallet runtime. The trust property is what matters: witnesses must not leave the user device.
  • C26 (AI agent skills) is omitted — it is a meta-deliverable about documentation and tooling, not a runtime element.
  • The MVP vs. v1.0 split is not represented here; this view holds for both readings. Standards and Demo document where they diverge.