> For the complete documentation index, see [llms.txt](https://experience-digital-transform.gitbook.io/experience-digital-transformation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://experience-digital-transform.gitbook.io/experience-digital-transformation/ai-wallet-use-case/annex.md). # Annex These annexes collect the normative reference materials behind the knowledge product. Where the prototype's wallet provider already publishes canonical material, the annexes refer to docs.igrant.io rather than restating it; only normative external standards from recognised standards bodies (W3C, IETF, OpenID Foundation, ISO, 1EdTech, GovStack) are referenced externally. The authoritative machine-readable artefacts (OpenAPI specifications, schemas, and rulebooks) live in the published skill bundles on the Giga Skills Marketplace and in the project repository; the versions excerpted here are those the prototype was validated against. ## Annex A: Standards Traceability Table The table maps each requirement of the RFQ terms of reference to the standard that satisfies it, the chapter section where the mechanism is described, and the artefact that evidences it. | Requirement (RFQ) | Standard applied | Where described | Evidencing artefact | | --------------------------------------------------------------- | --------------------------------------------------------- | -------------------------------- | ------------------------------------------------------------ | | Unique learner identification and standardised learner profiles | JSON Schema 2020-12 learner profile; national ULID scheme | Chapters 2 (2.7.4) and 4 (4.1.1) | learner-profile.schema.json | | Credentials as W3C-compliant Verifiable Credentials | W3C VC Data Model 2.0; SD-JWT VC (IETF) | Chapter 2 (2.1) | Credential schemas (Annex B); issued sandbox credentials | | Education credential semantics | W3C CCG vc-ed; Open Badges 3.0 (1EdTech) | Chapters 1 (1.2) and 4 (4.2.2) | Diploma, transcript, and micro-credential schemas | | Wallet-based storage, presentation, and sharing | OpenID4VCI 1.0; OpenID4VP 1.0 with DCQL | Chapters 2 (2.1) and 4 (4.3) | Issuer and verifier OpenAPI specs; demonstration website | | Modular, interoperable, aligned with DPI building blocks | GovStack Wallet BB; building-block composition | Chapter 2 (2.3, 2.7) | Validation chain and boundary tables; mock service contracts | | Explicit, revocable consent management | ISO/IEC 27560; iGrant.io Consent BB | Chapters 2 (2.3) and 4 (4.4.2) | consent.yaml; consent-record.schema.json; consent rulebook | | Digitally signed certificates and diplomas | GovStack e-signature and trust services; TSP signing | Chapters 2 (2.3) and 4 (4.4.3) | Dual-signature rule (R3) in the qualification rulebook | | Open standards and open APIs | OpenAPI 3.1 for every inter-component contract | Chapter 2 (2.4) | openapi/ directories of the published skill bundles | | Role-based workflows for institutions and MoE | Application workflow specifications | Chapter 4 (4.1.2, 4.1.3) | Workflow definitions; audit and evidence model | | Full auditability and traceability | Audit and evidence model; marketplace assurance trail | Chapters 3 (3.3) and 4 (4.1.4) | Audit log; public review trails | | Multi-channel access | Responsive web portals; Data Wallet mobile application | Chapter 4 (4.5) | Demonstration website | | Local hosting, sovereign cloud, or hybrid deployment | Containerisation; Helm on any conformant Kubernetes | Chapter 5 (5.1) | Helm chart; deployment README (Annex D) | | Proprietary components identified with exit options | Vendor-neutral boundary conditions | Chapters 2 (2.7.6) and 6 (6.2) | Licensing table; boundary-condition standards table | ## Annex B: Education Credential Schemas Three education credential types plus the learner profile are defined as JSON Schema (2020-12), with JSON-LD and Open Badges 3.0 mappings, following the W3C CCG vc-ed models. The authoritative files ship in the issuer skill bundle (schemas/ directory) and derive from the credential schema library at docs.igrant.io.
SchemaFilePurpose
Diplomadiploma.schema.jsonQualification award: learner, awarding institution, qualification code, grade, award date.
Transcripttranscript.schema.jsonDetailed academic record: courses, grades, credits, and periods.
Micro-credentialmicro-credential schema (Open Badges 3.0 achievement typing)Bounded achievement or short course completion.
Learner profilelearner-profile.schema.jsonThe NLR record every credential references: ULID, core attributes, institutional link, lifecycle events.
Representative excerpt from the diploma schema. Fields marked x-selectiveDisclosure are individually disclosable in the SD-JWT VC encoding, so a learner can prove an award without revealing, for example, date of birth or grade: `{` `"$id": "https://schemas.igrant.io/education/diploma.schema.json",` `"title": "DiplomaCredential",` `"type": "object",` `"required": ["credentialSubject"],` `"properties": {` `"credentialSubject": {` `"type": "object",` `"required": ["ulid", "name", "achievement"],` `"properties": {` `"ulid": { "type": "string" },` `"name": { "type": "string" },` `"dateOfBirth": { "type": "string", "format": "date",` `"x-selectiveDisclosure": true },` `"achievement": {` `"type": "object",` `"required": ["name", "awardingInstitution", "qualificationCode"],` `"properties": {` `"name": { "type": "string" },` `"awardingInstitution": { "type": "string" },` `"qualificationCode": { "type": "string" },` `"grade": { "type": "string",` `"x-selectiveDisclosure": true },` `"awardedOn": { "type": "string", "format": "date" }` `}` `}` `}` `}` `}` `}` The credential schemas are validated at three points: by the marketplace's automated check gate at submission, by the agent when it validates an issuance request during a build, and by the issuer API at the point a credential offer is created. ## Annex C: OpenAPI Specifications All inter-component contracts are OpenAPI 3.1 documents, aligned with the prototype provider's developer APIs (published at docs.igrant.io/docs/developer-apis) and grouped as described in Chapter 2 (Section 2.4.1); another provider's package would present the same groups against its own API. The authoritative specifications ship in the openapi/ directories of the published skill bundles; the education-profile issuer, verifier, and consent specifications used by the prototype are summarised here.
SpecificationBundleCovers
issuer.yamligrantio-education-issuerCredential offers, issuance status, revocation, and webhook registration over OpenID4VCI.
verifier.yamligrantio-education-verifierPresentation requests with DCQL, response verification, and revocation checking over OpenID4VP.
consent.yamligrantio-consent-bbData agreements, consent grant and withdrawal, receipts, and audit endpoints per ISO/IEC 27560.
holder (Data Wallet) APIsdocs.igrant.ioWallet binding, credential receipt, storage, and presentation; consumed by reference rather than restated.
Representative operations from the education-profile issuer specification:
OperationMethod and pathPurpose
createCredentialOfferPOST /issuer/credential-offerCreate an OpenID4VCI offer for a learner: ULID, credential type (Diploma, Transcript, or MicroCredential), and claims. Returns the offer URI, QR payload, and expiry.
getCredentialStatusGET /issuer/credentials/{credentialId}Issuance status (offered, issued, revoked, expired) and the National Certificate Registry reference.
revokeCredentialPOST /issuer/credentials/{credentialId}/revokeRevoke an issued credential; updates the status list checked by verifiers.
registerWebhookPOST /issuer/webhooksRegister the HMAC-verified callback endpoint for issuance lifecycle events.
All endpoints are protected by API-key authentication against the provider sandbox (base URL during the project term). Claims are validated against the Annex B schemas before an offer is created; requests that fail schema validation are rejected with a structured error. ## Annex D: Deployment Configurations The deployment artefacts of Chapter 5 ship in the project repository. This annex indexes them; the deployment README in the repository is the operative runbook.
ArtefactLocationPurpose
Dockerfilesweb/Dockerfile; services/marketplace/Build the giga-web and giga-marketplace container images.
Docker Compose stackdocker-compose.yml with a Makefile wrapperFull local stack: PostgreSQL, marketplace API (port 4830), web application (port 4820).
Helm chartdeploy/helm/giga/Kubernetes deployment: web and marketplace Deployments with autoscaling, PostgreSQL 16 with a PersistentVolumeClaim, ingress-nginx with cert-manager TLS, and secret templates.
Secrets templatevalues-secret.yaml (local, gitignored)Internal service token and database password, supplied at deploy time and never committed.
CI/CD workflow.github/workflows/deploy.ymlBuilds both images and runs the Helm upgrade on every push to main, authenticating with Workload Identity Federation.
Wallet deployment baselinedocs.igrant.ioPublished Helm charts for self-hosting the Organisation Wallet Suite where a country requires it.

Minimal install command against a prepared cluster: `helm upgrade --install giga ./deploy/helm/giga \` `-n giga --create-namespace \` `-f ./deploy/helm/giga/values-secret.yaml \` `--set domain=marketplace.example.org \` `--set image.registry= \` `--set image.tag=` \ For production, the bundled single-node PostgreSQL is disabled in favour of a managed database via a single externalDatabaseUrl value, as described in Chapter 5 (Section 5.1.4). ## Annex E: Sample Credentials and Test Datasets The sandbox seeds everything an evaluator needs to exercise the system without real learner data. All test data is synthetic.
DatasetContentsUsed for
Marketplace demo accountsSuper admin, reviewer, approved provider (iGrant.io), and a provider with a pending organisation, seeded on first run with published credentials for evaluators.Exercising the consoles and the submit-review-publish cycle of Chapter 3.
Seed skill bundlesigrantio-education-issuer, igrantio-education-verifier, igrantio-consent-bb, and national-learner-registry.A populated catalogue with review trails from first boot.
Synthetic learnersTest learner profiles with ULIDs, including a minor with a guardian relationship for the consent rules.Journey 1 registration and approval workflows.
Sample credentialsDiploma, transcript, and micro-credential instances issued as SD-JWT VCs against the Annex B schemas.Journeys 2 to 4: issuance, wallet storage, selective disclosure, and verification, including a revoked credential for negative testing.
Worked API examplesexamples/issue-diploma.http and request/response samples in each bundle.Reproducing calls by hand or from an agent.
Sandbox rulebookqualification-rules.md (rules R1 to R7): issuer authorisation, qualification codes, dual signature, guardian consent, revocation, payment gate, and audit evidence.The policy the validation unit and issuance flow enforce in the sandbox.
\ The demonstration website (Chapter 5, Section 5.2.2) walks these datasets through the four journeys end to end; evaluator access details are handed over with the sandbox. ## Annex F: Glossary and Acronyms
TermMeaning
Agent (AI coding agent)A tool such as Claude Code, opencode, Codex CLI, or Pi that reads skill files and generates and runs integration code under human review.
Consent BBConsent management building block implementing ISO/IEC 27560 consent records; iGrant.io's implementation in the prototype.
DCQLDigital Credentials Query Language; expresses exactly which credentials and claims a verifier requests under OpenID4VP.
DPIDigital Public Infrastructure: shared, reusable, interoperable components (identity, payments, registries, consent, wallets) composed by many services.
EUDI ARFEuropean Digital Identity Wallet Architecture and Reference Framework, sharing the protocol stack used here.
GovStack Wallet BBThe GovStack Wallet Building Block specification; the vendor-neutral interface every wallet provider is validated against.
HolderThe party that stores and presents credentials; the learner using the Data Wallet.
IssuerThe party that issues credentials; the Ministry of Education running the Organisation Wallet Suite.
MoEMinistry of Education.
NLRNational Learner Registry: the system of record for learner profiles and ULIDs.
OpenID4VCI / OpenID4VPOpenID protocols for verifiable credential issuance and verifiable presentations respectively.
OWSiGrant.io Organisation Wallet Suite: the issuer and verifier product.
RulebookMachine- and human-readable policy rules an integration must honour; the localisable national-policy artefact.
SD-JWT VCIETF selective-disclosure JWT verifiable credential format; lets the holder reveal only requested fields.
Skill (skill file, skill bundle)A provider-published capability package (SKILL.md plus OpenAPI specs, schemas, rulebooks, and examples) that teaches any agent to integrate the provider's product.
Skills marketplaceThe distribution and governance layer where skills and use cases are published, vetted, versioned, and installed.
SSEServer-Sent Events; streams wallet events from the backend to the browser.
TSPTrust Service Provider: supplies legally valid signing keys, seals, and certificate validation.
ULIDUnique Learner Identifier minted by the NLR at enrolment.
Use case (marketplace object)A journey-tagged prompt chain composing skills into an end-to-end build.
VC / VPVerifiable Credential / Verifiable Presentation per the W3C data model.
vc-edW3C CCG Verifiable Credentials for Education task force models; the education credential reference.
VerifierThe relying party that requests and checks presentations; employers and universities in the use case.
Wallet BBDigital wallet building block: credential storage, presentation, and verification for the learner.

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://experience-digital-transform.gitbook.io/experience-digital-transformation/ai-wallet-use-case/annex.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.