Custodial Transfer Protocol¶
Protocol — instantiates Persistent Identifier Stewardship
The governed handoff that moves update authority for a set of identifiers from one steward to the next — without ever orphaning the tokens.
Custodial Transfer Protocol is the governed procedure for the moment a persistent identifier changes hands: when the institution, registry, or person responsible for keeping a set of tokens resolvable passes that responsibility to a successor. Its defining commitment is that what transfers is update authority and the obligation that goes with it — not merely a copy of the data. An identifier is orphaned not when its data is lost but when nobody is left who is entitled and equipped to correct its mapping; this protocol exists to make sure the incoming steward accepts that duty, the authority record is reassigned, and the tokens keep resolving throughout. It does not mint new identifiers and does not resolve them — it moves the stewardship of ones that already exist.
Example¶
A university herbarium closes, and its pressed-plant specimens — each carrying a persistent specimen identifier used in decades of published occurrence records — are acquired by a larger natural-history museum. The physical sheets can be shipped, but that is the easy part; the fragile thing is continuity of the identifiers. The custodial transfer protocol runs the handoff: the outgoing herbarium inventories the identifier set together with its current resolver mappings and provenance, the incoming museum formally accepts the obligation to keep those identifiers resolvable, and the resolver's stewardship authority for that namespace is reassigned from the closing herbarium to the museum.
A handoff record is written — which identifiers, from whom, to whom, on what date, under what agreement — and resolution is re-verified before the old institution's servers go dark. Done well, a botanist following a 1990s citation still lands on the specimen's live record, now maintained by the museum. Done poorly — data copied but authority never reassigned — the specimens survive on a shelf while their identifiers slowly rot, with nobody empowered to fix a single broken mapping.
How it works¶
The protocol is a staged handoff with a point of no return:
- Inventory and integrity-check. The outgoing steward assembles the full identifier set, its current mappings, and provenance, and confirms they resolve before transfer.
- Accept the obligation. The incoming steward explicitly agrees to the ongoing update duty — not just receipt of data — ideally under a written stewardship agreement.
- Reassign authority. Update authority for the namespace is moved from outgoing to incoming steward in the resolver and its governance records.
- Record and verify. A custodial handoff record captures who transferred what to whom and when; resolution is re-checked post-cutover before the old custodian stands down.
Tuning parameters¶
- Transfer granularity — hand off a whole namespace or a defined subset. Whole-namespace transfers are clean but coarse; subsets allow partial succession at the cost of split authority.
- Overlap window — an instant cutover versus a dual-authority period where both stewards can act. Overlap de-risks the switch but must resolve who is canonical.
- Obligation bindingness — an informal handshake versus a contractual stewardship agreement. Stronger commitments survive turnover; weaker ones move faster.
- Verification depth — a spot-check versus a full re-resolution audit before sign-off. Deeper checks catch silent breakage but cost time.
- Provenance detail — how much of the handoff's who/when/why the record captures, trading auditability against overhead.
When it helps, and when it misleads¶
Its strength is that it addresses custodial orphaning head-on — one of the archetype's signature failure modes — by making continuity an explicit, accepted obligation exactly when institutions are most likely to drop it: closures, mergers, vendor exits, archival transfers. It turns an implicit "someone will keep this working" into a named party who has agreed to. It is, in effect, a chain of custody[n1] for the right to update a mapping.
Its failure mode is the handoff that is complete on paper but hollow in practice: authority reassigned to an incoming steward who lacks the tooling, funding, or knowledge to actually maintain the mappings, producing slow-motion orphaning that looks governed. A related failure is transferring the data while forgetting to transfer the authority, so future breakage has no one entitled to repair it. The classic misuse is treating custody transfer as a one-time data migration and declaring victory at copy-complete. The discipline is to transfer authority and obligation together, verify live resolution after cutover, and confirm the successor's actual capacity — not just its consent.
How it implements the components¶
Custodial Transfer Protocol realizes the stewardship-continuity slice of the archetype — the parts that keep an identifier owned:
resolver_stewardship_authority— reassigning this authority from the outgoing to the incoming steward is the protocol's central act, the thing that actually moves.custodial_handoff_record— it produces this record: who transferred stewardship of which identifiers to whom, when, and under what agreement, so the succession is auditable.
It does NOT create new identifiers — that is the Identifier Minting Workflow, which introduces tokens rather than moving stewardship of existing ones — nor serve resolution or hold the mapping (resolver_mapping_record — Persistent Identifier Resolver Service), nor set redirect and tombstone states (alias_redirect_and_tombstone_map — Redirect and Tombstone Policy).
Related¶
- Instantiates: Persistent Identifier Stewardship — the protocol preserves stewardship continuity across custodians.
- Sibling mechanisms: Persistent Identifier Resolver Service · Resolver Landing Page · Identifier Version Resolution Rule · Redirect and Tombstone Policy · Resolution Link Checker · Identifier Registry · Identifier Minting Workflow
Editorial Notes¶
Form Classification¶
Form family: Protocol, Workflow & Routine
Rationale: Custodial Transfer Protocol operates as a repeatable ordered procedure or handoff sequence that coordinates action because it the governed handoff that moves update authority for a set of identifiers from one steward to the next — without ever orphaning the tokens.
Independent corroboration: The frozen evidence defines Custodial Transfer Protocol as 'The governed handoff that moves update authority for a set of identifiers from one steward to the next — without ever orphaning the tokens', so its operative form is Protocol, Workflow & Routine.
Review outcome: Independent reviewer agreement; high confidence.
Origin Attribution¶
Primary origin: Library & Information Science
Origin pattern: Cross-disciplinary synthesis
Present-day reach: Specialized
Rationale: Persistent-identifier stewardship is primary because the protocol transfers update authority while preserving the identifier, referent, metadata, and resolution continuity. Legal succession and museum custody procedures materially shape the formal acceptance, inventory, and verification steps.
Related originating lineages:
- Law & Governance — Succession and custody law supply explicit acceptance of authority, obligations, and an auditable handoff record.
- Material Culture & Museum Studies — Collections stewardship supplies inventory reconciliation, documented custody transfer, and continuity-of-care practice.
Review resolution: Persistent-identifier stewardship is primary because the protocol transfers update authority while preserving the identifier, referent, metadata, and resolution continuity. Legal succession and museum custody procedures materially shape the formal acceptance, inventory, and verification steps.
Encyclopedia synthesis: The exact catalogued form synthesizes established practice rather than reproducing a single standard historical label.
Review outcome: Researched adjudication after independent review; high confidence.
Sources consulted:
- DOI Foundation: DOI Handbook, transferring DOI names
- Crossref: Transferring responsibility for titles and DOIs
Notes¶
The distinction from minting is the crux: an Identifier Minting Workflow brings a new token into being under a fresh scope and authority; this protocol moves an existing token's stewardship intact. A program that can mint well but cannot hand off cleanly will still lose its identifiers — not at birth, but at every institutional transition thereafter.
[n1] Chain of custody — the documented, unbroken sequence of who held and controlled an item at each step, borrowed from evidence handling, where a single unexplained gap can void the item's standing. Applied to identifiers, it is the record of who held update authority across each handoff, and the reason an orphaned identifier is a custody gap rather than merely a lost file. ↩