OMATrust

OMATrust can be integrated as a reputation and attestation overlay for service-oriented Universal Manifest subjects.

OMATrust Integration

Terminology note: use OMATrust for product/lane semantics and OMA3 for consortium/standards-body references.

Why this lane exists

OMATrust models trust signals for services (APIs, apps, contracts, organizations), which maps well to UM manifests that carry service identity, claims, and policy decisions in a portable envelope.

Integration model

Use UM core fields for portability, then add OMATrust signals through lane-specific claims, pointers, and shards:

Claims for attestation outcomes, proof modes, and trust mode.
Pointers to attestation lookup and verification resources.
Shards for lifecycle and policy metadata.

Suggested claim keys

omatrust.policy.trustMode
omatrust.proof.type
omatrust.attestation.linkedIdentifier
omatrust.attestation.keyBinding
omatrust.attestation.userReview
omatrust.attestation.endorsement
omatrust.attestation.certification
omatrust.attestation.securityAssessment.status

Suggested pointer keys

omatrust.reputation.attestation
omatrust.reputation.verify
omatrust.trustedAttester.directory
omatrust.lifecycle.revocationLog

Fixture and proof coverage in this repo

Implementation checks

Keep parser behavior stable for unknown OMATrust extension keys.
Enforce explicit trust-mode handling (proof-based vs trusted-attester).
Respect lifecycle transitions (active, revoked, superseded).
Prevent stale-trust projections by checking freshness windows.