From 4dbeb846ba73353bae73bfa56995c0f555e73d5b Mon Sep 17 00:00:00 2001 From: M Zidan Fatonie Date: Sun, 2 Aug 2026 00:10:27 +0700 Subject: [PATCH 1/2] feat(approach): fill Private Supply Chain section 5, add geospatial pattern use-cases/private-supply-chain.md section 5 read 'Approach TBD'. This replaces it with three named architectures and a full approach card. Adds pattern-private-geospatial-attestation covering proof that a plot polygon does not intersect a committed deforestation layer without revealing coordinates, which is what EUDR Article 9 geolocation makes necessary from 30 December 2026. The pattern is maturity: concept, and states the reference-layer commitment as the load-bearing assumption rather than burying it: whoever publishes the layer defines ground truth, and a stale layer yields proofs that verify correctly and mean nothing. It also records that re-identification, not cryptography, is the practical limit for small producer populations. Also adds EUDR to the use case's regulatory drivers, which previously listed only pharma serialization (FMD, DSCSA). Note: depends on jurisdictions/eu-EUDR.md, so merge after that card. --- CHANGELOG.md | 3 + approaches/approach-private-supply-chain.md | 167 ++++++++++++++++++ .../pattern-private-geospatial-attestation.md | 107 +++++++++++ use-cases/private-supply-chain.md | 12 +- 4 files changed, 283 insertions(+), 6 deletions(-) create mode 100644 approaches/approach-private-supply-chain.md create mode 100644 patterns/pattern-private-geospatial-attestation.md diff --git a/CHANGELOG.md b/CHANGELOG.md index 3f29a37..803f333 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,9 @@ All notable changes to the EthSystems Map are documented here. ## [Unreleased] +- feat(pattern): [Private Geospatial Attestation](patterns/pattern-private-geospatial-attestation.md) -- prove a plot polygon does not intersect a committed deforestation layer without revealing coordinates, with the reference-layer commitment named as the load-bearing assumption +- feat(approach|use-case): [Approach: Private Supply Chain](approaches/approach-private-supply-chain.md), replacing the "Approach TBD" stub in section 5 of [Private Supply Chain](use-cases/private-supply-chain.md) and adding EUDR to its regulatory drivers + ## [0.4.0] - 2026-07-02 23 commits, 166 files changed since [v0.3.0](https://github.com/ethsystems/map/releases/tag/v0.3.0) (Apr 2026). Major additions: resilience use cases (civic participation, disbursement rails, identity continuity), I2U protection patterns, pattern/approach schema v2 (strict flip) with CROPS and post-quantum analysis, domain reframing beyond FIs, and a Q2 2026 content QA audit. diff --git a/approaches/approach-private-supply-chain.md b/approaches/approach-private-supply-chain.md new file mode 100644 index 0000000..c964ccf --- /dev/null +++ b/approaches/approach-private-supply-chain.md @@ -0,0 +1,167 @@ +--- +title: "Approach: Private Supply Chain" +status: ready +last_reviewed: 2026-08-02 + +use_case: private-supply-chain +related_use_cases: [private-registry, private-identity] + +primary_patterns: + - pattern-verifiable-attestation + - pattern-private-geospatial-attestation + - pattern-l2-encrypted-offchain-audit +supporting_patterns: + - pattern-commit-and-prove + - pattern-regulatory-disclosure-keys-proofs + - pattern-zk-wrappers + +open_source_implementations: + - url: https://github.com/ethereum-attestation-service/eas-contracts + description: "Ethereum Attestation Service contracts (production)" + language: Solidity +--- + +# Approach: Private Supply Chain + +## Problem framing + +### Scenario + +A commodity moves from producer to EU importer through a cooperative, an exporter, a shipper, and a customs broker. Each handoff produces a compliance-relevant fact. The importer must show a regulator that the goods are authentic, legally produced, and not linked to deforested land. None of the parties will publish supplier identities, volumes, or routing, because that data reconstructs sourcing strategy and margin structure for any competitor watching the chain. + +From 30 December 2026 the EU Deforestation Regulation adds a sharper requirement: plot-level geolocation at six decimal digits, as polygons above four hectares, tied to specific products. Pharmaceutical serialization under FMD and DSCSA already imposes unit-level tracking on a different set of goods. Both regimes demand granular data that is commercially sensitive, and in the smallholder case personal. + +### Requirements + +- Prove product authenticity and regulatory compliance to a verifier who sees no upstream detail. +- Keep supplier identities, prices, volumes, and routing confidential between adjacent parties. +- Give regulators a path to full provenance for investigations and recalls. +- Verify at point of use, including customs checkpoints with poor connectivity. +- Interoperate with existing ERP and serialization systems. + +### Constraints + +- Parties span jurisdictions with conflicting disclosure and data protection rules. +- Customs clearance needs near real-time verification. +- Volume reaches millions of units per manufacturer per year. +- Smallholders lack infrastructure to run proving or key management themselves. + +## Approaches + +### Attestation Chain With Selective Disclosure + +```yaml +maturity: documented +context: i2i +crops: { cr: medium, o: yes, p: partial, s: high } +uses_patterns: [pattern-verifiable-attestation, pattern-regulatory-disclosure-keys-proofs] +``` + +**Summary:** Each party signs an attestation for its own step. Downstream parties verify the chain's shape and endpoints without reading intermediate content. + +**How it works:** Every handoff produces a signed attestation referencing the previous one by hash. Content is encrypted to the parties entitled to read it, with a viewing key escrowed for regulators. A verifier checks signatures and linkage to confirm an unbroken chain from a recognised origin. + +**Trust assumptions:** Issuers sign honestly. Revocation registries stay queryable. The escrow holder does not leak viewing keys. + +**Threat model:** A colluding pair can forge a link for goods that never moved. The chain proves attestation continuity, not physical custody. + +**Works best when:** Parties are regulated entities with legal recourse against each other. + +**Avoid when:** Participants include producers who cannot manage signing keys. + +### Zero-Knowledge Geospatial And Compliance Proofs + +```yaml +maturity: concept +context: both +crops: { cr: medium, o: partial, p: partial, s: medium } +uses_patterns: [pattern-private-geospatial-attestation, pattern-commit-and-prove] +``` + +**Summary:** Prove the regulatory predicate rather than disclosing the data behind it. A plot polygon is proven not to intersect a committed deforestation layer, and the coordinates never leave the operator. + +**How it works:** Producers commit to plot geometry once. A published reference layer is committed and versioned against a baseline date. A circuit proves non-intersection, and the proof is bound to a due diligence statement reference through an attestation wrapper. + +**Trust assumptions:** The published reference layer is accurate for the stated baseline. The prover runs the circuit faithfully. + +**Threat model:** Whoever publishes the layer defines ground truth, so a stale or manipulated layer produces sound proofs of false facts. Small producer populations remain re-identifiable from predicate results plus shipment metadata. + +**Works best when:** A regulator has named the geographic test and a public layer already encodes it. + +**Avoid when:** The reference layer is disputed, or the verifier needs coordinates for physical inspection. + +### Encrypted Off-Chain Audit With On-Chain Anchoring + +```yaml +maturity: prototyped +context: i2i +crops: { cr: medium, o: partial, p: full, s: medium } +uses_patterns: [pattern-l2-encrypted-offchain-audit, pattern-commit-and-prove] +``` + +**Summary:** Keep batch and logistics records off-chain and encrypted, anchoring commitments on-chain so that later disclosure is provably untampered. + +**How it works:** Operators write serialization and handling records to an encrypted store, publishing periodic commitments. Authorised parties receive decryption capabilities scoped to a batch or time window. Any disclosed record is checked against its anchor. + +**Trust assumptions:** The storage operator preserves availability. Key distribution reaches the right parties. + +**Threat model:** An operator who withholds data blocks audit without breaking any commitment. Anchoring proves integrity, not availability. + +**Works best when:** Volume is high and most records are never read. + +**Avoid when:** Verifiers need to check records without a prior relationship to the operator. + +## Comparison + +| | Attestation Chain | ZK Geospatial Proofs | Encrypted Audit + Anchoring | +| --- | --- | --- | --- | +| **Maturity** | documented | concept | prototyped | +| **Context** | i2i | both | i2i | +| **CROPS** | cr medium, o yes, p partial, s high | cr medium, o partial, p partial, s medium | cr medium, o partial, p full, s medium | +| **Trust model** | Trusted issuers, escrowed viewing keys | Trusted layer publisher, trustless verification | Trusted storage operator | +| **Privacy scope** | Hides step content, reveals chain shape | Hides source data, reveals predicate result | Hides records fully until disclosure | +| **Performance** | Signature checks, fast | Proving cost scales with polygon vertices | Write-heavy, cheap verification | +| **Operator req.** | Key management per party | Proving service, layer distribution | Storage and key distribution | +| **Cost class** | Low | High per proof | Low per record, moderate anchoring | +| **Regulatory fit** | Strong for serialization mandates | Strong for EUDR geolocation | Strong for recall and audit trails | +| **Failure modes** | Colluding forgery, key loss | Stale layer, re-identification | Operator withholding, key distribution gaps | + +## Persona perspectives + +### Business perspective + +The commercial risk in supply chain transparency is not regulatory exposure but competitive exposure. A published provenance trail lets a competitor reconstruct supplier dependencies, seasonal volumes, and margin structure from public data, which is a permanent disadvantage traded for a one-off compliance win. That calculus explains why operators have preferred closed platforms even where shared infrastructure would cost less. The attestation chain preserves existing commercial relationships and needs the least change to how parties already work, which makes it the realistic entry point. Zero-knowledge geospatial proving carries real cost per shipment and buys something specific in return, which is the ability to satisfy EUDR without handing plot coordinates to every downstream buyer. Where a business already holds the coordinates and treats them as a sourcing asset, that trade is straightforward. Where it does not, the proving obligation lands on cooperatives least able to absorb it. + +### Technical perspective + +The binding problem dominates. Every architecture here proves something about records, and none proves that records correspond to physical goods. Attestation chains prove continuity of signatures. Geospatial circuits prove a polygon satisfies a predicate. Anchoring proves a disclosed record matches what was committed. The gap between those proofs and reality is closed by attestation from a party with physical presence, which means issuer selection remains the security-critical decision regardless of the cryptography layered above it. Two implementation details cause most failures in practice. Hash function mismatch between on-chain digests and in-circuit field-friendly hashes breaks commitment parity in ways that surface late. Reference layer versioning creates a re-proving obligation across every affected plot each time the layer updates, which needs planning before the volume arrives rather than after. + +### Legal & risk perspective + +Several questions here are unresolved rather than merely difficult. Plot polygons for smallholders function as personal data under GDPR while also being commercial data belonging to a buyer, and it is unsettled whether a commitment to a polygon constitutes pseudonymised or anonymised processing under the EDPB's current guidelines. That classification determines whether erasure rights attach to an on-chain anchor. Regulators have not stated whether a zero-knowledge predicate proof discharges an Article 9 information requirement that is written in terms of collecting and holding coordinates, and the plain reading suggests collection remains mandatory even where onward disclosure is minimised. Cross-border disclosure adds another layer, because a viewing key held in one jurisdiction may be reachable by process in another. Jurisdictional coverage in this map that bears on these questions sits in the EUDR and EU data protection cards. + +## Recommendation + +### Default + +Start with the attestation chain, because it composes with existing serialization systems and needs no new cryptographic infrastructure. Layer geospatial proving on top where a geographic mandate applies, rather than treating it as an alternative. The two solve different problems, and the second depends on the first to bind proofs to real parties. + +### Decision factors + +- If the driver is EUDR, geospatial proving is on the critical path and the reference layer question needs answering before anything is built. +- If the driver is pharmaceutical serialization, the attestation chain plus anchoring covers the mandate, and geospatial proving is out of scope. +- If producers cannot hold keys, plan for a cooperative or buyer to act as prover, and record that this reintroduces the intermediary the design was meant to remove. +- If verification happens offline at customs, distribution of layer commitments becomes an operational requirement rather than a detail. + +### Hybrid + +The realistic production shape combines all three. Attestations bind parties and steps. Geospatial proofs discharge the geographic predicate without disclosure. Encrypted audit with anchoring holds the volume of routine records that no one reads until a recall or investigation makes them matter. + +## Open questions + +1. Does a zero-knowledge predicate proof satisfy an information requirement drafted in terms of collecting coordinates, or does collection remain mandatory with only onward disclosure minimised? +2. Who publishes and commits the reference deforestation layer, and what recourse exists when that layer is wrong? +3. Is a commitment to a plot polygon pseudonymised or anonymised processing under GDPR, and do erasure rights attach to the anchor? +4. What is the minimum viable attestation schema that customs authorities in different jurisdictions would each accept without bilateral negotiation? +5. How should re-proving obligations be handled when a reference layer updates across millions of anchored plots? +6. Can verification at low-connectivity checkpoints rely on cached layer commitments without opening a staleness attack? diff --git a/patterns/pattern-private-geospatial-attestation.md b/patterns/pattern-private-geospatial-attestation.md new file mode 100644 index 0000000..f1759fd --- /dev/null +++ b/patterns/pattern-private-geospatial-attestation.md @@ -0,0 +1,107 @@ +--- +title: "Pattern: Private Geospatial Attestation" +status: ready +maturity: concept +type: standard +layer: hybrid +last_reviewed: 2026-08-02 + +works-best-when: + - A regulator needs a geographic predicate proven, not the underlying coordinates. + - Plot boundaries reveal sourcing relationships that competitors would exploit. + - A public, versioned reference layer already defines the thing being tested against. +avoid-when: + - The reference layer is disputed or unpublished, leaving nothing sound to commit to. + - Coordinates are already public, where a plain attestation is cheaper. + - The verifier needs the coordinates themselves, such as for physical inspection. + +context: both +context_differentiation: + i2i: "Operator to competent authority, where both sides are regulated entities with legal recourse. The confidentiality at stake is commercial, because plot polygons expose sourcing networks and volumes to competitors. Either side can escalate through established administrative channels, so the privacy requirement is about trade secrecy rather than protection from the counterparty." + i2u: "Smallholder to buyer or authority, where the producer's plot polygon is simultaneously their livelihood and their personal data, and they cannot refuse to disclose it and still reach the market. The producer has no negotiating power over how the coordinates are stored or reused once handed over. CROPS must protect the producer here, which means disclosure has to be predicate-shaped by default rather than by the buyer's goodwill." + +crops_profile: + cr: medium + o: partial + p: partial + s: medium + +crops_context: + cr: "A producer who cannot obtain a proof cannot sell into the regulated market, so the prover and the layer publisher are both chokepoints. CR improves where multiple provers can serve the same committed layer, and degrades sharply where one platform holds both the layer and the proving service." + o: "Reference layers such as the JRC global forest cover maps are published openly, and GeoJSON is an open format. The proving circuits for polygon geometry are not yet standardised or widely implemented, which is what holds this at `partial`." + p: "Hides the polygon and its coordinates while revealing the predicate result and which layer version it was tested against. The plot's existence, its approximate commodity, and the fact that it passed remain visible. For a producer whose farm is one of a handful in a region, the predicate plus commodity can still narrow identity considerably." + s: "Rests on the correctness of the geometric circuit and on the integrity of the committed layer. A stale or manipulated layer produces proofs that are cryptographically sound and factually wrong." + +post_quantum: + risk: medium + vector: "Proofs are ephemeral compliance artefacts rather than long-lived secrets, so harvest-now-decrypt-later pressure is low. A CRQC breaking the proof system would allow forged non-intersection proofs for plots that were in fact deforested." + mitigation: "Hash-based commitments for the layer and the plot, with a hash-based proof system for the geometry. See [Post-Quantum Threats](../domains/post-quantum.md)." + +visibility: + counterparty: [predicate result, layer version] + chain: [plot commitment, layer commitment, proof] + regulator: [full coordinates under viewing key or legal process] + public: [that some committed plot passed against a named layer version] + +standards: [RFC-7946, EAS] + +related_patterns: + composes_with: [pattern-verifiable-attestation, pattern-commit-and-prove] + see_also: [pattern-regulatory-disclosure-keys-proofs, pattern-l2-encrypted-offchain-audit] + +open_source_implementations: [] +--- + +## Intent + +Prove that a plot of land satisfies a geographic condition, such as not intersecting a deforested region, without revealing where the plot is. + +## Components + +- Plot geometry: a polygon at regulatory precision, held by the producer or operator and never published. +- Plot commitment: a binding commitment to that geometry, anchored on-chain so the same plot can be re-proved later without re-disclosure. +- Committed reference layer: a published deforestation or land-cover layer, reduced to a commitment and versioned against a stated baseline date. This is the load-bearing component. +- Geometric circuit: proves the polygon lies wholly outside the layer's flagged cells. +- Attestation wrapper: binds the proof to an issuer and to a compliance record such as a due diligence statement reference. +- Disclosure path: a viewing key or legal process that opens the coordinates to an authority during an investigation. + +## Protocol + +1. [issuer] Publish a versioned commitment to the reference layer for a stated baseline date. +2. [operator] Collect plot geometry from the producer at the precision the regime requires. +3. [operator] Commit to the polygon and anchor the commitment, keeping coordinates off-chain. +4. [prover] Generate a proof that the committed polygon does not intersect the flagged region of the committed layer version. +5. [contract] Verify the proof against the layer commitment and the plot commitment, and record the outcome. +6. [auditor] Verify independently by re-running the circuit against the same published layer version. +7. [regulator] Obtain coordinates through the disclosure path when an investigation requires them. + +## Guarantees & threat model + +- Hides plot coordinates and boundary shape from buyers, competitors, and downstream verifiers. +- Proves one geometric predicate against one named layer version. It does not prove legality in general. +- Threat model: whoever publishes the reference layer defines ground truth. A stale, coarse, or manipulated layer yields proofs that verify correctly and mean nothing. Committing to the layer makes that dependency auditable rather than removing it. +- Re-identification is the practical limit rather than the cryptography. Where a region holds few producers of a commodity, the predicate result plus shipment metadata narrows the set quickly. +- Nothing here proves the producer actually harvested from the plot they committed to. That binding is an attestation problem, which is why this pattern composes with attestation rather than replacing it. +- Out of scope: proving volumes, proving chain of custody, and proving the plot is the true origin of the goods. + +## Trade-offs + +- Polygon containment circuits are costly, and proving time scales with vertex count and layer resolution. +- Raster layers need discretisation, which creates ambiguous cases along cell boundaries that the circuit must resolve conservatively. +- Every layer update creates a re-proving obligation across every affected plot. +- Offline verification requires the verifier to hold the layer commitment locally, which suits customs checkpoints but needs distribution. +- Smallholders rarely run proving infrastructure, so the prover is usually a cooperative or buyer, which reintroduces a trusted intermediary at the point the pattern was meant to remove one. + +## Example + +- A coffee cooperative holds polygons for 400 member farms and treats the membership list as commercially sensitive. +- The cooperative commits to each polygon and anchors the commitments once. +- For a shipment, it proves that every contributing plot lies outside the flagged region of the published forest layer at the stated baseline. +- The importer and the customs authority verify the proof and learn that all plots passed against layer version `v3`. Neither learns a coordinate, a farm count per shipment, or which members supplied this lot. +- During a later investigation, the authority opens the coordinates for two named plots through the disclosure path, without touching the other 398. + +## See also + +- [RFC 7946: The GeoJSON Format](https://datatracker.ietf.org/doc/html/rfc7946) +- [EU Forest Observatory global forest cover maps (JRC)](https://forest-observatory.ec.europa.eu/) +- [Jurisdiction: EU / EUDR](../jurisdictions/eu-EUDR.md) diff --git a/use-cases/private-supply-chain.md b/use-cases/private-supply-chain.md index 8815cbc..203d642 100644 --- a/use-cases/private-supply-chain.md +++ b/use-cases/private-supply-chain.md @@ -67,11 +67,11 @@ Counterfeit goods (particularly pharmaceuticals) are a safety and economic risk. ## 5) Recommended Approaches -Approach TBD. Key architectural considerations: +See [Approach: Private Supply Chain](../approaches/approach-private-supply-chain.md) for the full comparison and trade-off analysis. Three architectures cover the problems above: -- Attestation chains with selective disclosure: each party attests to their step; downstream parties verify without seeing upstream details -- Commitment schemes for batch-level data: commit to logistics data on-chain, reveal only to authorized parties -- ZK proofs for compliance: prove regulatory compliance (origin, handling, temperature) without revealing logistics specifics +- **Attestation chains with selective disclosure**: each party attests to its own step, and downstream parties verify the chain without seeing upstream details. Addresses Problems 1 and 2. +- **Zero-knowledge geospatial and compliance proofs**: prove origin, handling, and regulatory predicates without revealing coordinates or logistics specifics. Addresses Problems 1 and 3, and covers the plot-level geolocation that the EU Deforestation Regulation requires from 30 December 2026. +- **Encrypted off-chain audit with on-chain anchoring**: commit to batch and logistics data on-chain, and disclose to authorised parties on demand. Addresses Problem 3 at serialization scale. ## 6) Open Questions @@ -83,6 +83,6 @@ Approach TBD. Key architectural considerations: ## 7) Notes And Links -- Related patterns: [Verifiable Attestation](../patterns/pattern-verifiable-attestation.md), [L2 Encrypted Offchain Audit](../patterns/pattern-l2-encrypted-offchain-audit.md), [Commit and Prove](../patterns/pattern-commit-and-prove.md) -- Regulatory drivers: EU Falsified Medicines Directive (FMD), US Drug Supply Chain Security Act (DSCSA) +- Related patterns: [Verifiable Attestation](../patterns/pattern-verifiable-attestation.md), [L2 Encrypted Offchain Audit](../patterns/pattern-l2-encrypted-offchain-audit.md), [Commit and Prove](../patterns/pattern-commit-and-prove.md), [Private Geospatial Attestation](../patterns/pattern-private-geospatial-attestation.md) +- Regulatory drivers: EU Falsified Medicines Directive (FMD), US Drug Supply Chain Security Act (DSCSA), [EU Deforestation Regulation (EUDR)](../jurisdictions/eu-EUDR.md) - See also: [EPIC map](https://epic-webapp.vercel.app/) (GovTech & EPIC team): pharmaceuticals, food aid, supply integrity, customs From b75e32acace7449bb4510fde6cbcbc409015394b Mon Sep 17 00:00:00 2001 From: M Zidan Fatonie Date: Sun, 2 Aug 2026 09:36:24 +0700 Subject: [PATCH 2/2] docs: reference PR number in CHANGELOG entry --- CHANGELOG.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 803f333..727d03a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,8 +4,8 @@ All notable changes to the EthSystems Map are documented here. ## [Unreleased] -- feat(pattern): [Private Geospatial Attestation](patterns/pattern-private-geospatial-attestation.md) -- prove a plot polygon does not intersect a committed deforestation layer without revealing coordinates, with the reference-layer commitment named as the load-bearing assumption -- feat(approach|use-case): [Approach: Private Supply Chain](approaches/approach-private-supply-chain.md), replacing the "Approach TBD" stub in section 5 of [Private Supply Chain](use-cases/private-supply-chain.md) and adding EUDR to its regulatory drivers +- feat(pattern): [Private Geospatial Attestation](patterns/pattern-private-geospatial-attestation.md) -- prove a plot polygon does not intersect a committed deforestation layer without revealing coordinates, with the reference-layer commitment named as the load-bearing assumption ([#184](https://github.com/ethsystems/map/pull/184)) +- feat(approach|use-case): [Approach: Private Supply Chain](approaches/approach-private-supply-chain.md), replacing the "Approach TBD" stub in section 5 of [Private Supply Chain](use-cases/private-supply-chain.md) and adding EUDR to its regulatory drivers ([#184](https://github.com/ethsystems/map/pull/184)) ## [0.4.0] - 2026-07-02