Skip to content

⏱ TIME MACHINE

UCCA / UCCO Build Session Handover

18 March 2026 — Session 16 (The Wallet Session)

"UCCA credentials are now in Apple Wallet."

Paste this document as your first message in the next Claude session.

1. Session 16 Summary

Session 16 was the wallet session. Three briefs closed. UCCA is now a live Apple Wallet pass issuer.

The session opened with the Session 15 Time Machine loaded. The primary objective was unblocking Brief #22 — the .pkpass endpoint — which was blocked on Pass Type ID registration. That registration required Tim in the Apple Developer portal (Account Holder only). It was completed during the session. Alex then closed Briefs #22 and #23 in sequence. Brief #24 was written but not yet sent to Alex.

The session closed with an architectural discussion about RTOpacks PassKit — each RTO needs their own branding on passes, which creates a multi-tenant signing architecture question. Decision reached: Option A (one UCCA Pass Type ID, RTO details in pass fields) ships now. Option D (UCCA as cryptographic signer, RTO as named issuer in W3C VC) is the upgrade path post-revenue.

2. What Was Delivered This Session

Deliverable Status Notes
Pass Type ID registration DONE ✓ pass.online.ucca.credential registered in Apple Developer portal
Brief #22 — PassKit signing infrastructure CLOSED ✓ Cert valid to 2027-04-16. Endpoint live at /v1/passes/:envelope_id.pkpass
Brief #23 — Verify page CLOSED ✓ keys.ucca.online/verify/<hash> returns HTML for browsers, JSON for API. Three states: VALID/REVOKED/NOT FOUND. Apple Wallet + Google Wallet (placeholder) + Download buttons
Brief #24 — Ops console VC Output + PassKit cards WRITTEN Not sent to Alex yet. Ready to drop. Level 1 placement confirmed.
RTOpacks PassKit architecture DECIDED Option A now, Option D later. See Section 4.

3. Infrastructure — New This Session

Item Detail
Pass Type ID pass.online.ucca.credential
Team ID B29TSCBPHD
Cert expires 2027-04-16
Signing PKCS#7 · SHA-256 · WWDR G4
Secrets (ucca-keys) PASS_SIGNING_CERT_PEM, PASS_SIGNING_PRIVATE_KEY
Vars (wrangler.toml) PASS_TYPE_ID, TEAM_ID
Verify page keys.ucca.online/verify/<hash> — live
.pkpass endpoint keys.ucca.online/v1/passes/:envelope_id.pkpass — live
Commits 963fa4d — fix webServiceURL, QR points to verify page

Also noted this session: The Distribution certificate in Apple Developer portal shows "United Community Colleges of America Inc" (dead entity name) and expired 2026-03-17. Non-urgent but needs cleanup.

4. The RTOpacks PassKit Architecture Decision

The problem: RTOpacks sells to RTOs. Each RTO issues statements of attainment to learners. The .pkpass needs to carry the RTO's identity (name, code), not UCCA's.

Options considered:

  • Option A — One UCCA Pass Type ID, RTO details in pass data fields only. Ships fast. UCCA is cryptographic signer, RTO name appears in credential data. ← DO THIS NOW
  • Option B — Per-RTO Pass Type IDs under UCCA Apple Developer account. Questionable value, more work.
  • Option C — Each RTO registers their own Apple Developer account. Too much friction.
  • Option D — UCCA as cryptographic signer, RTO as named issuer in W3C VC (issuer: did:web:rto45678.ucca.online). Clean legal separation. ← UPGRADE PATH POST-REVENUE

Level 4 RTO management surface (future brief, not yet written): - RTO self-serve: upload logo, set pass branding, view issued passes, revoke passes - This is a meaningful RTOpacks product feature - Architecture needs to account for it before the PassKit brief for RTOpacks drops

5. Alex Queue — In Priority Order

  1. Brief #24 — Ops console VC Output + PassKit cards at Level 1 (CREDENTIAL INFRASTRUCTURE section). Brief is written and ready to drop. ← DROP FIRST
  2. RTOpacks DNS cutover + SSL — Moodle on Hostinger (82.112.249.102). Make it reachable.
  3. Merge feature/finance-page-mercury → main (9 commits ahead, production deploying from feature branch)
  4. Mobile breakpoints — ucca.online missing 480px and 360px handling
  5. DMARC hardening — p=none → p=reject across all zones
  6. OIDF conformance suite — requires local Java 17 + Gradle. Deferred from Brief #21.
  7. Mattr wallet manual test — requires phone + app install. Deferred from Brief #21.

6. Tim Queue

  • ⚠️ URGENT — ucca.com.au and ucca.asia expire March 24. Confirm renewed at VentraIP.
  • Think on UCCA code system — the spine of the corpus. Everything hangs off this decision.
  • Contact Mavis — first content production run against Composer pipeline (post DNS cutover)
  • Apple Developer cleanup — "United Community Colleges of America Inc" Distribution cert expired, dead entity name. Low priority.
  • Register merchant.online.ucca Merchant ID in Apple Developer portal when payment brief drops (namespace worth parking)

7. Architecture Backlog (No Briefs — Concepts Only)

  • RTOpacks PassKit — Level 4 RTO management surface (logo, branding, issuance view, revocation). Brief after DNS cutover and first paying customer.
  • Five internal ops worlds — /w/corpus/, /w/roles/, /w/registry/, /w/intelligence/ — all behind Zero Trust. Wireframed Session 15. Build sequence TBD post-revenue.
  • UCCA code system design — replaces TGA BSB/CHC/HLT prefixes. Agent-agnostic. Domain-neutral. Tim thinking on structure.
  • Google Wallet — placeholder button live on verify page. Backend brief when Apple Wallet is proven in market.
  • vcc.ucca.online — still deferred. Stub + password-protected placeholder pending.

8. Operating Rules

All rules from Session 15 unchanged. No new rules added this session.

Full rules for reference:

  • PASSKIT RULE: Apple Wallet uses PassKit (.pkpass), NOT mdoc. Team ID B29TSCBPHD. Pass Type ID must be registered before any brief drops.
  • USI RULE: Never describe UCCA as competing with USI. Complementary layers.
  • JUKEBOX RULE: Off-shelf and compose are the two product tiers. Composition fee charged once per context, then goes on shelf.
  • FIVE WORLDS RULE: Internal ops worlds must be built before any public-facing corpus surface.
  • VERIFY PAGE RULE: keys.ucca.online/verify/<hash> returns human-readable HTML for browsers, JSON for API clients.
  • TWO JUKEBOX RULE: RTOpacks output is VET-native. Engine output is UCCA-native. Never mix.
  • No time alerts for Tim. Never. Go go go.
  • Every 10 messages: check context length. YELLOW = warn. RED = write Time Machine immediately.
  • Every Alex brief: SURFACE declaration + DO NOT TOUCH list + CF account ID.
  • Brief drip rule: one brief at a time. Confirm deployed before next drops.
  • OPS-AS-OS RULE: if it doesn't exist in ops.ucca.online, it doesn't exist.
  • Truth over comfort.
  • Two sections in every Alex brief: → ALEX and → TIM.

9. The Big Picture

Session 16 closed the wallet loop. The verify page exists. The .pkpass endpoint is live. The signing cert is provisioned. A learner can now receive a UCCA credential, scan a QR code, see a clean verification page, and add it to Apple Wallet — end to end, cryptographically signed, auditor-readable.

The corpus is still at zero paying customers. RTOpacks DNS cutover is the first coin in the jukebox. Everything built in Sessions 15 and 16 is infrastructure that becomes valuable the moment that coin drops.

Brief #24 is loaded and ready. Drop it to Alex to start Session 17.

UCCA Inc · Session 16 · 18 March 2026

"UCCA credentials are now in Apple Wallet."

"A schmoke and a pancake?" — Goldmember