Offline First model.

Offline First means Gankpo prioritises local execution when the operation and trust model allow it. It does not mean “never connected”.

Local

store a .gkp file;
read supported structure and metadata;
check integrity and signature with available elements;
prepare or read a .gksend envelope.

Conditional local or hybrid

opening a protected payload requires the correct secret or key;
assessing a trust chain requires sufficient anchors;
fresh revocation status may require synchronisation.

Connected

obtain a new timestamp from a TSA;
transport a request through the HTTPS relay;
remotely issue or present a credential according to the Issuer, Connect, OID4VCI or OID4VP journey.

Relay principle

The relay is a blind transport mailbox: it transports without becoming the source of truth. A file envelope may provide manual fallback where supported.

→ See the complete public matrix

Network dependency matrix

Operation	Mode	Condition
Store a .gkp file	Local	No network is required merely to store the file on chosen media.
Read structure and metadata	Local	When the application supports the relevant format version.
Check integrity and the primary signature	Local	From the available bytes, fingerprint and public key.
Open a protected payload	Local, conditional	Requires the right secret or access key; support varies by application.
Assess a trust chain	Hybrid	Local when useful anchors and evidence are available; otherwise an update may be required.
Establish a fresh revocation status	Hybrid	Cached or embedded evidence may be checked locally; freshness may require synchronisation.
Obtain a trusted timestamp	Connected	An existing token may be validated locally; obtaining it relies on a TSA.
Prepare or read a .gksend envelope	Local	Transport through a relay, messaging or another channel remains separate.
Issue or present a remote credential	Generally connected	Issuer, Connect, OID4VCI and OID4VP exchanges depend on the journey and remote service.