feat(approach): fill Private Supply Chain section 5, add geospatial pattern

[mzf11125]

What are you adding?

• Vendor/Protocol
• Enterprise Use Case
• Update to existing content
• Pattern

Description

Section 5 of use-cases/private-supply-chain.md currently reads "Approach TBD". This fills it, and adds the pattern that makes it answerable.

Depends on #181. The geospatial pattern and the use case both link to jurisdictions/eu-EUDR.md, so this needs that card merged first. On its own branch the validator emits two broken-link warnings for exactly that reason. I verified that merging both together drops them to zero.

Three files

patterns/pattern-private-geospatial-attestation.md covers proving that a plot polygon does not intersect a committed deforestation layer without revealing coordinates. That is what EUDR Article 9 makes necessary from 30 December 2026: latitude and longitude to six decimal digits, polygons above four hectares.

use-cases/private-supply-chain.md gets section 5 replaced with three named architectures pointing at the new approach card, and EUDR added to the section 7 regulatory drivers, which previously listed only pharma serialization (FMD, DSCSA).

approaches/approach-private-supply-chain.md compares the three architectures in full. This also answers the open question in section 6 asking what a minimum viable cross-jurisdictional attestation standard looks like, though it answers it partly by showing which parts are genuinely unresolved.

Two things stated plainly rather than buried

The pattern is maturity: concept, not testnet. It is architecture, and there is no implementation behind it.

The reference layer commitment is named as the load-bearing assumption in both ## Components and ## Guarantees & threat model. Whoever publishes the deforestation layer defines ground truth, and a stale or manipulated layer yields proofs that verify correctly and mean nothing. Committing to the layer makes that dependency auditable, it does not remove it.

The card also records that re-identification rather than cryptography is the practical limit. Where a region holds few producers of a commodity, the predicate result plus shipment metadata narrows the set quickly. And nothing here proves a producer actually harvested from the plot they committed to, which is why the pattern composes with attestation instead of replacing it.

On context

context: both, with context_differentiation filled in, because the two cases differ in a way that matters. Operator to competent authority is symmetric, and the confidentiality at stake is trade secrecy. Smallholder to buyer is not: the producer plot polygon is simultaneously their livelihood and their personal data, they cannot refuse to disclose it and still reach the market, and they have no say over how the coordinates are reused afterwards.

The approach card carries that through. Smallholders rarely run proving infrastructure, so the prover ends up being a cooperative or buyer, which reintroduces the intermediary the design was meant to remove. That is recorded as a decision factor rather than glossed.

Legal framing

The legal and risk perspective is written as observations and open questions, per the template. The unresolved items are real: whether a zero-knowledge predicate proof discharges an Article 9 requirement drafted in terms of collecting coordinates, and whether a commitment to a plot polygon is pseudonymised or anonymised processing under the EDPB guidelines, which determines whether erasure rights attach to an on-chain anchor.

Checks

• CI_MODE=strict npm run validate passes, zero warnings against these files when feat(jurisdiction): add EU / EUDR deforestation regulation card #181 is present
• Pattern 640 body words, approach 1670, both inside thresholds
• check-terms clean
• Vale clean on both new cards

The one remaining Vale warning on private-supply-chain.md is pre-existing, on the untouched Actors line. This change removes one of the two that were there.

CHANGELOG entries added under [Unreleased], referencing this PR.

Checklist

• I've checked this doesn't duplicate existing content
• All links work (the two eu-EUDR.md links resolve once feat(jurisdiction): add EU / EUDR deforestation regulation card #181 merges, verified on an integration branch)
• Info is accurate