Attestor Transparency UI/API Handoff

Scope

Console and downstream API clients must present local and external transparency receipts as separate trust signals.

API Fields

• localTransparencyReceipt: Stella local transparency receipt. This is the sealed-site primary receipt and remains sufficient for local signing, anchoring, and replay.
• externalMirrorReceipts[]: zero-or-more additive receipts from configured external Rekor-compatible mirror targets. These can be produced by a connected sync window or by manual schedule/import-file exchange.
• mirror: legacy single-replica compatibility field. Do not use it for the new external mirror receipt table.
• uuid, index, rekorEntryId, and rekorLogIndex: keep these bound to the local primary receipt unless the caller is explicitly handling a legacy direct Rekor-primary deployment.

Console Copy

Use these labels:

• Local transparency receipt
• External mirror receipt
• External mirror pending
• External mirror failed

Do not label an external mirror receipt as the primary Rekor receipt. Do not show a failed external mirror as a local transparency failure.

Behavior

• When externalMirrorReceipts[] is empty, show the local receipt as the available evidence and omit external mirror details.
• When a mirror receipt has status=mirrored, show the target name, external UUID/index, log URL, receipt digest, and mirrored timestamp.
• When a mirror receipt has mirror_pending or mirror_failed, show the target name, status, attempts, and last error. Keep the local receipt positive if its own status is included/verified.
• External mirror outages do not block local signing, local anchoring, or sealed-site replay. They only affect additive external-publication evidence.

Local Log State

GET /api/evidence/v1/transparency/local (attestor:read) is the owner read of the local log’s state. The field contract is in transparency.md. A client that presents the local log’s health keeps three states distinct:

• 200 with enabled=true: the local log is configured.
• 200 with enabled=false: the local log is not configured.
• Any failure (503 with code local_transparency_unavailable, another HTTP error, an authorization refusal or a timeout): the state is unavailable. Never show it as “not configured” or as healthy.

Read the local state from the local fields only. The externalSync block (enabled, enabledTargetCount) is additive context; a missing or failed external mirror does not change the local state. Do not use GET /api/evidence/v1/transparency/targets for the local state: its unconfigured=true means only that no external mirror target exists.