[SCITT] Re: async completion 2.1.4 question

[Jon Geater <[e-mail]>]

Yes that was discussed at length in the ‘adjacent services’ debate as well. It makes sense for the use cases you're focusing on, but not all use cases for a SCITT VDS/TS.

The *mandatory minimal interoperable* functionality of the VDS and proofs is _only_ the receipt, as in the discussion here.

However it can be useful (subject to confidentiality and access controls) to additionally construct the whole Transparent Statement, and some more feature full trust services incorporating a SCITT Transparency Service may even go as far as storing and returning a payload that was the preimage source to a Signed Statement input.

It’s very useful functionality, it’s what DataTrails chose to do, but it’s on different (optional) endpoints to enable the simple stuff to be simple and separate, and to allow the use case to determine the most appropriate place for the preimages to be stored.

Jon

________________________________
From: Dick Brooks <[e-mail]>
Sent: Saturday, January 10, 2026 2:54:08 PM
To: Jon Geater <[e-mail]>; 'Andrew R. Reiter' <[e-mail]>; [e-mail] <[e-mail]>; 'Amaury Chamayou' <[e-mail]>; 'Henk Birkholz' <[e-mail]>
Subject: RE: [SCITT] Re: async completion 2.1.4 question


Jon,



We should also ensure that SCRAPI enables the public to “retrieve the payload of the Transparent Statement” so that a Trust Registry can also serve as a repository for the Signed Statement “payload” materials that others can retrieve, i.e. an SBOM or a URL to an SBOM.



Thanks,



Dick Brooks

[cid:[e-mail]4AC140]  [cid:[e-mail]4AC140]  [cid:[e-mail]4AC140]

Active Member of the CISA Critical Manufacturing Sector,

Sector Coordinating Council – A Public-Private Partnership

Lifetime IEEE Member

Never trust software, always verify and report!<https://reliableenergyanalytics.com/products> ™

Risk always exists, but trust must be earned and awarded.™

https://businesscyberguardian.com/

Email: [e-mail]

Tel: [phone]





From: Jon Geater <jon.geater=[e-mail]>
Sent: Saturday, January 10, 2026 8:01 AM
To: Andrew R. Reiter <[e-mail]>; [e-mail]; Amaury Chamayou <[e-mail]>; Henk Birkholz <[e-mail]>
Subject: [SCITT] Re: async completion 2.1.4 question



<chair hat off, document editor hat on>



Ah yes, we had a big sweep on this a while ago to sort out the several inconsistencies we had on Receipt vs Transparent Statement (and where exactly they should be formed) and this must have slipped through.



My belief (based on  having actually written one and thinking about separation of concerns between ‘core SCITT’ and ‘adjacent services')  is that indeed the endpoint should only return the Receipt. If the TS actually has a copy of the Statement stashed as well (which the DataTrails implementation does, but I think maybe the Microsoft one doesn’t?) then great, another endpoint could conveniently glue them together for you. But it shouldn’t be forced to.



I think @Amaury Chamayou<mailto:[e-mail]> / @Henk Birkholz<mailto:[e-mail]> this probably qualifies for an Issue and the example should be changed. Agree?



Jon



On 09/01/2026, 20:11, "Andrew R. Reiter" <[e-mail]<mailto:[e-mail]>> wrote:



Hello,

Apologies if this email contains question that is an obvious mistake by
me:


I am implementing SCRAPI 06 and noticed a possible ambiguity in section
2.1.4.2. The normative text says the 200 response to GET /entries/{id}
"contains the  Receipt", and the example body is a receipt COSE_Sign1
signed by the TS. However, the illustrative
async flow immediately below says the final 200 response is a "Transparent
Statement". These are different artifacts: a receipt is TS signed proof
only, while a transparent statement is the issuer signed statement with
receipts attached.

I think the intended response is a receipt, given the 2.1.4.2 text and the
receipt-shaped example body, but I would appreciate clarification. If it
is a receipt, updating the flow line to "200 (Receipt)" would make it
consistent. If it is a transparent statement, the 2.1.4.2 text and example
body should be updated accordingly, and it would help to explain where the
receipt is retrieved.

Again... apologies if I am being obtuse :)

Best,
Andrew Reiter

--
[e-mail]<mailto:[e-mail]>                           Victoria concordia crescit

--
SCITT mailing list -- [e-mail]<mailto:[e-mail]>
To unsubscribe send an email to [e-mail]<mailto:[e-mail]>