Trust Boundaries

%% Trust boundaries — least-trusted (internet/edge) to most-trusted (core) graph TB subgraph internet["Internet — untrusted"] rp["Relying parties"] user["End-users"] idp["Upstream IdPs"] end subgraph edge["Edge (Vör) — least-trusted internal: public material + caches only"] vor["Verification nodes"] end subgraph region["Regional admission (Modgud) — stateful front-channel"] mod["Login · OAuth · session · SAML"] end subgraph core["Core — most-trusted"] wcore["Wyrd identity core"] forseti["Forseti relation store<br/>(second consistency domain, own fence)"] keys["KeyCustody (HSM / KMS)"] pub["Projection publisher<br/>(distribution-key-signed)"] audit["Audit / event log"] end admin["Admin plane<br/>(authorized by Forseti)"] user --> mod rp --> vor idp --> mod mod --> wcore mod --> keys mod -->|authz at issuance| forseti wcore --> audit keys -->|public key material| pub wcore -->|revocation set| pub pub -->|signed JWKS / status list| vor admin --> wcore