Last1 ID Architecture¶

Canonical reference for domain, product model, and integration assumptions. Do not drift from this.

For schema, endpoints, DID/VC design, and implementation details, see ARCHITECTURE_BIBLE.md.

What Last1 ID Is¶

Last1 ID is the independent identity authority for the Last1 ecosystem. It provides:

User-controlled identity, credentials, consent, and trust history
Portable credentials issued by apps, organizations, or the system
OAuth and trust-event integration for connected apps

Domain and Deployment¶

Canonical production URL: https://last1.id
Do not use id.last1.app — that is not the architecture.
Last1 ID is not a subdomain of last1.app. It is its own product and domain.

Product Model¶

Last1 ID = Identity Authority¶

Last1 ID is the integration point across the ecosystem. Apps connect to it; they do not contain it.

Integrated Apps (Clients)¶

These are separate products that integrate with Last1 ID:

last1.app — separate product; will integrate with Last1 ID
RadioCheck
MATR iOS
MATR Biz
RealOutcomes

Consumer MVP: Users Create Identities, Not Apps¶

In the consumer MVP, users create and own:

Their identity
Their credentials
Their consent settings
Their connected apps/services
Their portable trust history

Later Platform Capability¶

Apps/services connecting as app clients, credential issuers, trust event publishers, or verifiers — including last1.app, RadioCheck, MATR, RealOutcomes, and future partner apps — are a later platform capability.

Portable Credibility¶

Last1 ID uses verifiable trust signals, not a single trust score.

Principles¶

Rule	Implementation
App-agnostic	No app-specific logic in core identity; trust_events use generic `event_type`
Portable	Credentials stored with `issuer_id`; export includes credentials
Proof-based	Signals derived from credentials and trust_events, not scores
No single universal score	Multi-dimensional trust summaries (reliability, participation, etc.) with per-dimension public opt-in; no one manipulable number
Trusted issuers only	Credential issuance requires valid `credential_issuers` row
Trust events append-only	No update/delete on trust_events; insert only

Credential Issuance Rules¶

App must have credentials:issue or credentials:write scope
Identity must have granted consent to the app
App must be allowed to issue the credential_type (via allowed_credential_types)
Credential must reference a registered issuer (issuer_id from credential_issuers)

Summary¶

Assumption	Correct
Last1 ID domain	`https://last1.id`
Last1 ID relationship to last1.app	Independent; last1.app is a client
Users create in MVP	Identities, credentials, consent — not apps
Integration point	Last1 ID is the identity authority for the ecosystem