UNTP and EN 18222 interop

No region is the universal envelope. The gateway renders the neutral core in foreign protocol shapes (a protocol is a render profile, not a fork) and imports them back with deterministic identity. Adding a protocol adds a render profile; the core never grows a region’s fields.

The UNTP binding

Render (core → UNTP)

GET /untp/product/{id}?freshness= returns the verifiable-credential triad:

• the DigitalProductPassport VC,
• the DigitalConformityCredentials (profile bindings + inspection stamps),
• a link-resolver entry anchored at the log head,

plus the verdict over the evidence. Recorded against the reference deployment:

$ curl -s -G 'http://127.0.0.1:8395/untp/product/urn%3Aunidpp%3Apassport%3Apilot-e8-j000842' \
    | jq '{source: .rendering.source, outcome: .verdict.outcome,
           signatures_verified: .verdict.coverage.signatures.verified}'
{
  "source": "issuer",
  "outcome": "pass",
  "signatures_verified": 5
}

The five signatures are the passport’s five lifecycle events, verified against the issuer’s published anchors during the render.

Identifier mapping: core cpid: identifiers map to https://unidpp.org/id/ URIs; the GS1 family maps to https://gs1.org/voc/ with (01)/(10)/(21) application identifiers. The render names its profile (urn:unidpp:profile:render:untp).

Ingest (UNTP → core)

POST /untp/ingest accepts a UNTP passport VC (bare or as a triad) and mints a core passport with a deterministic identity, idempotent per subject: submitting the same VC twice yields one core passport, not two. Imported documents carry an empty event log (their events live in the source regime) and a receipt recording the origin. Render and ingest are inverse projections.

The EN 18222 binding

GET /en18222/v1/dppsByProductId/{gtin}?representation=full|compressed — the EN 18222 REST shape, default compressed per the EN. Recorded:

$ curl -s 'http://127.0.0.1:8395/en18222/v1/dppsByProductId/4006381333931?representation=full' \
    | jq '.dppStatus'
"active"

• full: the element tree, string-printed values;
• compressed: collection-keyed, native JSON values.

The wire field set is mirrored from the freeDPP live-endpoint artifacts (the conformance corpus keeps both representations as fixtures); an EN 18222 client sees what it expects, including the frozen-wire rule: no as_of member on the EN 18222 body (the x-as-of header still carries it).

Semantics sources

The renderings are ports, not re-derivations: the UNTP adapter’s semantics come from the Python reference adapters (unidpp-py), and the EN 18222 wire from the freeDPP artifacts. The gateway’s discovery document states both provenances. What that buys an operator: when a question arises (is this field part of the compressed representation? does the triad include the resolver entry?), the answer lives in the reference implementation and the conformance corpus, not in prose.

Degradation and failure behavior

• No upstream, or upstream unreachable → fixtures serve, the render metadata names the source (fixtures).
• Unknown and deliberately unresolvable ids → identical 404 bytes (I12).
• ?freshness= on the UNTP render bounds the evidence freshness window the verdict applies.

Which binding do I expose?

The gateway serves both simultaneously; there is no either/or. A deployment facing EU regulation serves the EN 18222 binding; one facing UNTP counterparts serves the triad; both come from the same core passports, signed by the same keyrings, anchored in the same log. The choice of what to tunnel to the public internet is a per-deployment exposure decision (see security posture).