6. Extension compatibility¶

The Gaia-X 3.0 stack reflects the architectural separation of technical compatibility from compliance and supports an extension mechanism for implementing ecosystem-specific governance or compliance rules. This allows ecosystems to introduce additional rules and validation mechanisms while preserving interoperability with the common technical compatibility baseline.

An ecosystem (or data space) governance authority or custodian applying the Trust Protocol can: - define common rule sets for the ecosystem; - define the methods to validate those rules; - describe the methods to issue and verify digital attestations of conformance; and - make these accessible to other ecosystems and their participants in a standardized, interoperable way.

To support cross-ecosystem discovery and trust decisions, the Trust Protocol uses ecosystem trust profiles. An ecosystem trust profile consists of trust propositions, each expressed as a triple comprising a trust scope, credential type and trust service provider.

An extension is technically compatible when it is discoverable through the Gaia-X Meta-Registry, reachable at a declared endpoint, and behaves as a credential-processing service: it consumes a Verifiable Presentation and produces a Verifiable Credential.

The criteria below are derived from the following Gaia-X source documents, where an applicable requirement exists:

1. Architecture Document 3.1
2. ICAM Document 25.11
3. Data Exchange Document 25.07

Where a criterion is marked Specification design decision, no direct requirement covering it exists in these source documents; the “Related” reference identifies the closest relevant section for context.

The verification method for every criterion in this chapter is Automated: conformity can be established entirely by a conformant software agent (validator, compliance engine or test suite), based on the artefact under assessment (here: the deployed extension, the verifiable presentations accepted as input, and the verifiable credentials issued as output) and the resources to which it resolves.

6.1 EXT-1 Meta-Registry trust profile record¶

The Gaia-X Meta-Registry is the cross-ecosystem registry that collects and publishes the ecosystem trust profiles of participating ecosystems. Each ecosystem trust profile consists of a set of trust propositions.

In the current implementation of the Gaia-X Meta-Registry (GXMR), the Gaia-X Association is publishing and maintaining the GXMR at a publicly accessible network location either directly owned by the Gaia-X Association or controlled by it. We are cognizant of the need of a further, more elaborate proof of authenticity of a GXMR record for its users. This may be developed in a co-innovation/co-development model together with ecosystems and data spaces who actually use or plan to use the GXMR.

6.1.1 EXT-1.1 Presence of a trust profile record¶

A trust profile record applicable to the extension shall be present in, and published through, the Gaia-X Meta-Registry, so that other ecosystems and their participants can identify areas of mutually shared trust.

6.1.2 EXT-1.2 Trust proposition triples¶

The trust profile record shall express its trust propositions as triples of trust scope, credential type and trust service provider according to the class gx:EcoTrustScope of the Gaia-X Ontology.

As of the time of releasing this specification, the latest Gaia-X Ontology version is 2.5.0.

6.1.3 EXT-1.3 Declared baseline and non-redefinition¶

The trust profile record shall express its rules in an open and machine-readable form, and shall not redefine mandatory baseline standards incompatibly.

6.2 EXT-2 Check the endpoint of the extension¶

6.2.1 EXT-2.1 Resolvable endpoint¶

The extension shall expose an endpoint that is resolvable over HTTPS and reachable by any ecosystem participant without intermediation or translation.

6.2.2 EXT-2.2 Endpoint addressing form¶

The extension shall be addressed either through a path variable or through a query parameter. The addressing form used shall be declared in the trust profile record applicable to the extension, so that a caller can construct a valid request from the record alone.

6.3 EXT-3 Check the input of the endpoint of the extension¶

6.3.1 EXT-3.1 POST method¶

The extension endpoint shall accept the HTTP POST method for the submission of credential material.

6.3.2 EXT-3.2 Verifiable Presentation in JWT format as HTTP POST request body¶

The request body of the HTTP POST (see EXT-3.1) shall be a Verifiable Presentation in JWT format. The submitted presentation shall satisfy all applicable criteria of the Verifiable Presentation compatibility chapter.

6.4 EXT-4 Check the output of the extension API response¶

6.4.1 EXT-4.1 Verifiable Credential as response¶

A successful response of the extension endpoint shall be a Verifiable Credential.

6.4.2 EXT-4.2 Compatibility of the returned credential¶

The returned Verifiable Credential shall satisfy all applicable criteria of the Verifiable Credential compatibility chapter, namely VC-1.1 to VC-6.3.

6.5 EXT-5 Technical compatibility attestation¶

6.5.1 EXT-5.1 Common technical compatibility layer as a precondition for cross-ecosystem trust¶

A common technical compatibility layer is a precondition for establishing cross-ecosystem trust. Without such a layer, transport and syntactical interoperability of trust propositions between ecosystems shall not be assumed. For the purposes of this specification, the extension shall evidence conformity with that layer through a technical compatibility credential — the Proof of Compatibility described in Proof of compatibility.

The Gaia-X Meta-Registry trust profile record applicable to the extension shall reference a technical compatibility credential that:

• resolves, and satisfies all applicable criteria of the Verifiable Credential compatibility chapter, namely VC-1.1 to VC-6.3;
• is within its cap:valid_from_datetime / cap:valid_until_datetime period at the time of assessment;
• names that trust profile record as its cap:object.

6.6 Summary of criteria¶

An extension that satisfies all applicable criteria in this chapter is eligible for a Proof of Compatibility issued under the conformity assessment scheme Gaia-X Extension Compatibility, as described in Proof of compatibility.