A reader must see who declared the data, not just who sealed it

[LKSNDRTMLKV]

The problem

A seal proves a document came from whoever holds the certificate. It carries no statement about scope — nothing distinguishes "we vouch for this content" from "we transmitted this intact". It looks identical either way.

So if a passport prominently shows a seal from the node operator, and the party that actually declared the data is only discoverable by digging, a reader will reasonably conclude the node vouches for the content. Regardless of what the regulation says about where the obligation sits, and regardless of what we intend.

Meaning that does not travel with the document does not exist.

What already exists

ResponsibleOperator, operator_identifier, the manufacturer block, the facility snapshot, and the transfer-of-responsibility machinery. The pieces are there.

What is missing

Evidence that a reader — human or machine — can answer "who declared this?" as easily as "who sealed this?". Right now nobody has checked, and it is the difference between a design intention and a property of the artefact.

Scope

• Establish whether the declaring party is unambiguous in each served view: public, restricted, conformity, individual.
• Where it is not, make it so. The public view is the one that matters most and is the most likely to be missing it.
• A test that fails if a passport can be served with a seal but no legible declarer.

Why it matters more than it looks

This is what makes "we carry the data, we do not author it" a fact about the passport rather than a position held internally. If a partner or an authority cannot tell the two roles apart, the distinction is not real no matter how the contracts read.

[LKSNDRTMLKV]

The check this issue asks for has now been done. It changes what the issue is about.

What each view actually carries

View	Seal present?	Declaring party
Public (HTML, JSON-LD, AAS)	No — stripped for every audience	manufacturer.name only
Restricted / conformity / individual	No — same stripping	manufacturer.name only
The seal resource	Yes	None at all
Evidence dossier	Yes	Yes — carries the transfer chain

So the premise in the problem statement — "if a passport prominently shows a seal from the node operator, and the party that actually declared the data is only discoverable by digging" — does not describe the public view. A seal is never served to any audience. It is stripped everywhere and reachable only on its own authenticated resource and inside a dossier, because it covers the full-payload signature and would verify against no redaction.

The premise holds in exactly one place: the seal resource serves a seal and names no declaring party whatsoever. Its readers are authenticated and technical, so that is the least consequential of the four.

The gap that is real, and is not the one described

Passport carries manufacturer. It has no responsible-operator field. ResponsibleOperator — whose own documentation says the responsible economic operator "can be the original manufacturer, an importer, a distributor, or a remanufacturer" — lives only in the transfer chain, which is separate from the passport document.

Transferring responsibility writes the chain and does not touch the passport. manufacturer is frozen at publish, as content should be.

The consequence: after a transfer, every public view still names the original manufacturer, and the party actually responsible for the content is reachable only through an evidence dossier. A reader asking "who is responsible for this?" is given an answer that is confidently wrong rather than merely incomplete.

That is worse than the seal ambiguity this issue was opened about, and it is not a rendering fix.

What is in place now

A test asserting the property rather than the mechanism: no audience may be served a seal without a legible declaring party. It passes today because the seal is stripped, and it will keep meaning something if that ever changes.

What needs a decision

Naming the current responsible operator in a public view means putting it in the payload the public signature covers, and that runs into retention lock — a published passport's signed content does not change. Three shapes, none obviously right:

1. Carry the responsible operator on the passport, updated at transfer, listed among the retention guard's mutable keys. Changes what the public signature covers and raises whether a transfer should re-seal.
2. Serve it beside the signed payload, clearly outside the proof. Honest and immediately doable, but a reader has no way to verify it, and unverifiable provenance next to a verifiable document is its own trap.
3. State the limit in the view: label manufacturer as the manufacturer, and say plainly that responsibility may sit elsewhere and where to ask. Cheapest, and the only one that adds no unverifiable claim.

The third is the smallest honest step and does not foreclose the others. The first is the only one that makes the answer verifiable, and it is a retention and re-sealing question before it is a field.