credentials.education (domain)
                           │
     ┌─────────────────────┼─────────────────────┐
     │                     │                     │
     ▼                     ▼                     ▼
Accreditor-US        Accreditor-EU         Accreditor-APAC
(SACSCOC, etc.)     (ENQA, etc.)         (regional orgs)
     │                     │                     │
     │ trust edges to     │ trust edges to      │ trust edges to
     │ accredited         │ accredited          │ accredited
     │ universities        │ universities         │ universities
     ▼                     ▼                     ▼
 Universities        Universities          Universities
     │                     │                     │
     │ issue credentials   │                     │
     ▼                     ▼                     ▼
 Students              Students              Students
  (credential holders' quids)

credentials.education
├── credentials.education.undergraduate
├── credentials.education.graduate
├── credentials.education.certifications

credentials.licensing.medicine.texas
credentials.licensing.medicine.california
credentials.licensing.bar.ny

credentials.certifications.aws
credentials.certifications.cncf
credentials.certifications.iso

{
  "type":"TITLE",
  "assetId":"degree-uoftexas-austin-alice-2023-cs-bs",
  "domain":"credentials.education.undergraduate",
  "titleType":"academic-degree",
  "owners":[{"ownerId":"student-alice-chen","percentage":100.0}],
  "attributes":{
    "issuer":"university-of-texas-austin",
    "degreeType":"Bachelor of Science",
    "field":"Computer Science",
    "specialization":"Cybersecurity",
    "gpa":"3.84",
    "graduationDate":"2023-05-15",
    "classRank":"summa-cum-laude",
    "transcriptHash":"<sha256 of full transcript>",
    "registrarSignature":"<separate sig by registrar quid>"
  },
  "signatures":{
    "university-of-texas-austin":"<sig>",
    "registrar-ut-austin":"<sig>"
  }
}

{
  "type":"TITLE",
  "assetId":"license-medical-texas-dr-jones-12345",
  "domain":"credentials.licensing.medicine.texas",
  "titleType":"medical-license",
  "owners":[{"ownerId":"dr-jones-cardiology","percentage":100.0}],
  "attributes":{
    "issuer":"texas-medical-board",
    "licenseNumber":"12345",
    "issuedDate":"2015-08-20",
    "renewalDate":"2024-08-20",
    "specialty":"Cardiology",
    "boardCertifications":["ABIM"],
    "status":"active"
  },
  "signatures":{"texas-medical-board":"<sig>"}
}

eventType: "credential.verified"
subjectId: "degree-uoftexas-austin-alice-2023-cs-bs"
payload:
  verifier: "employer-acme-corp"
  verifiedAt: 1713400000
  verificationPurpose: "pre-employment background check"
signer: employer-acme-corp

eventType: "credential.revoked"
subjectId: "license-medical-texas-dr-smith-99999"
payload:
  revoker: "texas-medical-board"
  reason: "malpractice-ruling"
  effectiveAt: 1713400000
  caseReference: "TMB-2026-0123"
signer: texas-medical-board

func (employer *Employer) VerifyCredential(ctx context.Context, candidateID string, credentialID string) (*VerifyResult, error) {
    // Get the credential title
    title, err := employer.client.GetTitle(ctx, credentialID)
    if err != nil { return nil, err }

    // Check if holder matches
    if !hasOwner(title, candidateID) {
        return &VerifyResult{Valid: false, Reason: "Credential not issued to this candidate"}, nil
    }

    // Check issuer's trust
    issuer := title.Attributes["issuer"].(string)
    domain := title.Domain
    issuerTrust, _ := employer.client.GetTrust(ctx, employer.quid, issuer, domain, &GetTrustOptions{MaxDepth: 3})

    if issuerTrust.TrustLevel < 0.5 {
        return &VerifyResult{
            Valid:  false,
            Reason: fmt.Sprintf("Issuer trust too low: %.2f (need 0.5+)", issuerTrust.TrustLevel),
            TrustPath: issuerTrust.TrustPath,
        }, nil
    }

    // Check for revocation events
    events, _ := employer.client.GetSubjectEvents(ctx, credentialID, "TITLE")
    for _, ev := range events {
        if ev.EventType == "credential.revoked" {
            revoker := ev.Payload["revoker"].(string)
            // Only the original issuer (or their current authorized
            // successor) can revoke
            if revoker == issuer || canRevoke(revoker, issuer) {
                return &VerifyResult{
                    Valid:  false,
                    Reason: fmt.Sprintf("Credential revoked by %s: %s",
                        revoker, ev.Payload["reason"]),
                }, nil
            }
        }
    }

    // Check expiration
    if renewalDate, ok := title.Attributes["renewalDate"]; ok {
        if parseDate(renewalDate.(string)).Before(time.Now()) {
            return &VerifyResult{Valid: false, Reason: "Credential expired"}, nil
        }
    }

    // Log verification
    employer.LogVerification(ctx, credentialID)

    return &VerifyResult{
        Valid:       true,
        IssuerTrust: issuerTrust.TrustLevel,
        TrustPath:   issuerTrust.TrustPath,
    }, nil
}

type CredentialVerifier struct {
    quid   string
    client QuidnugClient
}

func (v *CredentialVerifier) Verify(ctx context.Context, credentialID string, expectedHolder string) (*VerificationResult, error) {
    title, err := v.client.GetTitle(ctx, credentialID)
    if err != nil {
        return nil, err
    }

    // Check holder matches
    hasHolder := false
    for _, owner := range title.Owners {
        if owner.OwnerID == expectedHolder {
            hasHolder = true
            break
        }
    }
    if !hasHolder {
        return &VerificationResult{Valid: false, Reason: "Credential not issued to this holder"}, nil
    }

    // Check issuer trust
    issuer := title.Attributes["issuer"].(string)
    issuerTrust, err := v.client.GetTrust(ctx, v.quid, issuer,
        title.Domain, &GetTrustOptions{MaxDepth: 3})
    if err != nil || issuerTrust.TrustLevel < 0.5 {
        return &VerificationResult{
            Valid:  false,
            Reason: fmt.Sprintf("Issuer trust %.2f below threshold", issuerTrust.TrustLevel),
        }, nil
    }

    // Check for revocation
    events, _ := v.client.GetSubjectEvents(ctx, credentialID, "TITLE")
    for _, ev := range events {
        if ev.EventType == "credential.revoked" {
            revoker := ev.Payload["revoker"].(string)
            if revoker == issuer {
                return &VerificationResult{
                    Valid:  false,
                    Reason: fmt.Sprintf("Revoked by %s: %s",
                        revoker, ev.Payload["reason"]),
                }, nil
            }
        }
    }

    // Check renewal date
    if renewal, ok := title.Attributes["renewalDate"]; ok {
        if parseDate(renewal.(string)).Before(time.Now()) {
            return &VerificationResult{Valid: false, Reason: "Expired"}, nil
        }
    }

    // Log verification
    v.emitVerificationEvent(ctx, credentialID)

    return &VerificationResult{
        Valid:       true,
        IssuerTrust: issuerTrust.TrustLevel,
        TrustPath:   issuerTrust.TrustPath,
    }, nil
}

func TestCredential_BasicVerification(t *testing.T) {
    // Accreditor → University → Student chain
    // Verify returns valid with trust path
}

func TestCredential_RevocationPropagates(t *testing.T) {
    // License issued
    // Revocation event
    // Subsequent verification returns invalid
}

func TestCredential_CrossJurisdictionReciprocity(t *testing.T) {
    // TX board recognizes CA board
    // TX hospital verifies CA-licensed doctor
    // Trust path: TX employer → TX board → CA board → doctor
    // Verification succeeds above threshold
}

func TestCredential_IssuerKeyRotation(t *testing.T) {
    // University rotates key via guardian recovery
    // Historical degrees still verify (old epoch preserved)
    // New degrees signed with new epoch key
}