<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE rfc SYSTEM "rfc2629.dtd">
<rfc ipr="trust200902" docName="draft-singh-apex-psi-03-01" category="info" submissionType="independent">
  <front>
    <title abbrev="draft-singh-apex-psi-03">PSI-03: VPP Dispatch Conformance Attestation</title>
    <author initials="K" surname="Singh" fullname="Kawaljeet Singh">
      <organization>Apex Intelligence Empire / ROCKYFILMS888 PTY LTD</organization>
      <address>
        <email>kawaljeet.singh3008@gmail.com</email>
      </address>
    </author>
    <date year="2026" month="July" day="19"/>
    <area>General</area>
    <keyword>PSI</keyword>
    <keyword>cryptographic verification</keyword>
    <abstract>
      <t>PSI-03 specifies a portable, Ed25519-signed bond that anchors a registered NDIS practitioner's professional identity to a DID-compatible decentralised identifier without requiring a central registry.  The bond enables cross-provider, cross-border practice verification while preserving privacy and issuer sovereignty.</t>
    </abstract>
  </front>
  <middle>
    <section anchor="s-1" title="Introduction">
      <t>Practitioner identity in the NDIS ecosystem is fragmented.
Each provider maintains its own register.  PSI-03 defines a
sovereign identity bond that lets practitioners carry a single
verifiable credential across all providers without either the
practitioner or the provider depending on a central authority.</t>
    </section>
    <section anchor="s-2" title="Bond Envelope">
      <t>{
&quot;psi&quot;: &quot;03&quot;,
&quot;practitioner_did&quot;: &quot;&lt;did:apex:practitioner:...&gt;&quot;,
&quot;registrar&quot;:   &quot;&lt;issuer /.well-known URI&gt;&quot;,
&quot;bonded_at&quot;:   &quot;&lt;RFC 3339&gt;&quot;,
&quot;expires_at&quot;:  &quot;&lt;RFC 3339&gt;&quot;,
&quot;credentials&quot;: [
{ &quot;type&quot;: &quot;registration&quot;, &quot;body&quot;: &quot;&lt;JWT or VC&gt;&quot; },
{ &quot;type&quot;: &quot;qualification&quot;, &quot;body&quot;: &quot;&lt;verifiable credential&gt;&quot; },
{ &quot;type&quot;: &quot;endorsement&quot;,  &quot;body&quot;: &quot;&lt;verifiable credential&gt;&quot; }
],
&quot;signature&quot;: &quot;&lt;Ed25519 detached signature, base64url&gt;&quot;
}</t>
    </section>
    <section anchor="s-3" title="Verification">
      <t>The verifying party MUST:
1.  Resolve the registrar's Ed25519 public key from /.well-known.
2.  Verify the bond signature.
3.  Verify each presented credential's chain to a trusted root.</t>
    </section>
    <section anchor="s-4" title="Security Considerations">
      <t>A bond is not a proof of current registration.  The verifying
party SHOULD check the registrar's revocation list if real-time
status is required.</t>
    </section>
    <section anchor="s-5" title="IANA Considerations">
      <t>None.</t>
    </section>
    <section anchor="s-6" title="References">
      <t>[RFC2119]  Bradner, S., &quot;Key words for use in RFCs to Indicate
Requirement Levels&quot;, BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997.
[RFC8174]  Leiba, B., &quot;Ambiguity of Uppercase vs Lowercase in
RFC 2119 Key Words&quot;, BCP 14, RFC 8174,
DOI 10.17487/RFC8174, May 2017.
[RFC8785]  Rundgren, A., Jordan, B., and S. Erdtman, &quot;JSON
Canonicalization Scheme (JCS)&quot;, RFC 8785,
DOI 10.17487/RFC8785, June 2020.
Author's Address
Kawaljeet Singh
Apex Intelligence Empire
Balaclava, Victoria, Australia
Email: kawaljeet.singh3008@gmail.com
URI: https://apex-infrastructure.com</t>
    </section>
  </middle>
</rfc>