Control loop
Image → recognize → decide → execute → confirm. The device transports/holds paper; Mobile-ID recognizes and decides; Trusted Records reconciles. Early images, deadlines, ACKs and buffers are requirements pending vendor validation.
Trusted Records · Platform
Architecture and responsibility boundaries
Eight reference layers connect experience, devices, business services and evidence repositories. Verify deployment configurations per project.
Six steps of paper–digital operation
- 01Load dossiers
- 02Flow R captures images
- 03Mobile-ID recognizes
- 04Send decision
- 05Flow R executes
- 06Reconcile paper–digital
Governance loop
QC → acceptance → registration → access → discovery → preservation → delivery/disposition. Born-digital records use package validation and bypass Flow R. Uncertain AI results require configured holding/buffering/stopping rather than assuming a reviewer can respond during an unverified transport window.
Sheet ↔ image ↔ dossier ↔ decision ↔ location ↔ reconciliation. Capture order is not authoritative order; reconstruction requires mappings and evidence.
API, identity and events
WSO2 API Manager provides gateway/control-plane roles for contracts, policies and API quotas. Keycloak-based GoPaperless SSO supports configured identity/federation. Kafka carries domain events; it does not replace deadline/ACK-based device control.
Authoritative and derived data
The content store holds files; the metadata repository holds descriptions/relations; the search index is derived. Preservation repositories manage AIPs/representations. Evidence stores retain manifests, hashes, approvals and lineage; operational logs aid diagnosis but do not replace evidence records.
Identifier chain
Source → Handover → BoxID → DossierID → SheetID → ScanJob/Image → AIResult → QC → Declaration → RecordID. Tenant/project contexts follow objects; changes link back to sources and earlier versions.
Cross-cutting controls
Security/Zero Trust, privacy, records governance, custody, evidence, preservation/migration/AI governance and observability apply across layers. HSM/KMS/TSA, adapters and HA/DR configurations are reference components requiring verification, not default commitments.
Eight reference layers
Users & Experience
Four role-based portals; tasks, reviews, approvals and traceability.
Device & Edge Control
Scanners/SheetID, Document Intelligence, Edge/sorter/ACK and born-digital ingest.
API, Identity & Security
WSO2 API Manager; GoPaperless SSO/Keycloak; scopes and policies.
Core Business Services
Digitization, records, search, preservation, migration, governance and platform.
AI & Records Intelligence
Image quality, OCR, classification, metadata and human review.
Integration & Event
Kafka domain events; business-system adapters; retry and replay.
Data, Records & Evidence
Business DBs, content, metadata, indexes, preservation and evidence stores.
Infrastructure & Platform
Configured runtime, data/messaging, security, observability, DevSecOps and DR.
Responsibility matrix
| Party | Scope to agree |
|---|---|
| Record owner | File plans, grounds, retention/holds, permissions, acceptance. |
| Mobile-ID | Platform/profiles/adapters and agreed SOW scope; test evidence. |
| Operator | Material condition, preparation/scanning/QC, custody and recovery. |
| Device supplier | Datasheets, firmware/mechanics, compatibility/maintenance as agreed. |
| Integrated system | Authoritative data, schemas, credentials, errors and reconciliation. |
NFR: measures, dependencies and evidence
| Topic | Measure | Dependencies / evidence |
|---|---|---|
| Availability | Measure uptime under agreed SLO windows; fault injection/failover. | Topology, replicas, operations; incident/test reports. |
| Latency / throughput | API/job P95/P99; representative record loads and backlog. | Sizes, OCR, stations, network; load-test report. |
| RTO / RPO | Restore drills and data-loss-window reconciliation. | Backups/replication, keys, DR; drill evidence. |
| Routing / recovery | Command–ACK, timeout and SheetID reconciliation. | Firmware/adapters/deadlines; fault/reconnect tests. |
| Integrity / readability | Fixity, format validation and DIP delivery tests. | Profiles, formats, repositories; validation reports. |
Commitments follow assessment/tests; no default SLA/RTO/RPO values are supplied.
Source diagram
Explore by flow
Flow R control and timing boundaries
The requirements diagram separates receipt, execution and observed paper position; it is not an accepted firmware contract.
Read detailsPayment and invoice boundaries
Records establishes eligible volume; providers confirm funds; Trusted Billing orchestrates invoices under contract.
Read detailsRecords and data flow
BoxID/DossierID retain physical provenance; ImageID identifies images; RecordID identifies governed records. Manifests link content/metadata; indexes support discovery under the same access policy.
Read detailsIdentity and access
The IdP authenticates subjects; Trusted Records authorizes organization/project, role, purpose and action. Configuration, processing and acceptance authority must follow separate responsibilities; revocation must affect active sessions/access.
Read detailsEvidence and preservation
Manifests identify contents; hashes test bytes; provenance establishes origin; QC assesses criteria; approvals record decisions; signatures/timestamps apply under agreed services. Preservation packages retain required components and version histories.
Read detailsDeployment and cross-cutting controls
Select on-premise, Mobile-ID operated or hybrid models within confirmed scope. Agree data boundaries, logs, keys, backups, DR and support access; measure NFRs through pilots rather than treating architecture as SLA evidence.
Read detailsContinue the workflow
Two journeys, one records lifecycle
Connect paper and born-digital records through persistent identifiers, policies and evidence.
Read detailsIntegration quickstart
Exercise ingest → job tracking → registration → verification with synthetic data.
Read detailsIntegrity, provenance and evidence
Each evidence type answers a different question; hashes, timestamps and approvals are not interchangeable.
Read detailsStart with a verifiable scope.
Agree record classes, quality criteria, permissions and evidence before scaling.
Plan assessment