diff --git a/docs/sirosid/architecture.md b/docs/sirosid/architecture.md
index b31e29e..0cefddc 100644
--- a/docs/sirosid/architecture.md
+++ b/docs/sirosid/architecture.md
@@ -14,6 +14,14 @@ This page provides a comprehensive view of the SIROS ID platform architecture, s
*Click the diagram to open full-size in a new tab.*
+## Wallet Layers
+
+The wallet is built in two ways on top of the same native capability modules. Native wallet apps (such as the SDK sample apps) use the SDK orchestration layer, which runs the issuance and presentation flows and talks to the engine. The Android and iOS wrapper apps instead host the wallet-frontend web wallet, which runs the flows itself; the wrapper exposes native capabilities to the page through a JavaScript bridge, backed by the SDK where it is used.
+
+
+
+
## Component Summary
### User Domain
diff --git a/static/img/architecture-overview.svg b/static/img/architecture-overview.svg
index fb185b8..70b5a5e 100644
--- a/static/img/architecture-overview.svg
+++ b/static/img/architecture-overview.svg
@@ -1,311 +1,161 @@
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- SIROS ID — Platform Architecture
-
-
-
-
- SIROS ID Platform — Hosted at id.siros.org · Self-Hosted on your premises
-
-
-
-
-
- USER DOMAIN
-
- wallet-frontend
- React PWA (SPA)
-
- wallet-
- companion
- Extension
-
- Passkey (WSCD)
- WebAuthn · FIDO2
-
- siros-sdk-kotlin
- siros-sdk-swift
-
- Browser · iOS · Android
- Zero-knowledge · E2E encrypted
-
- All credential logic runs on user device
-
-
-
-
-
-
- WALLET BACKEND
-
- go-wallet-backend
- Go · Gin · REST · WebSocket
-
- Admin API
- Port 8081 · Internal
-
- MongoDB
-
- Redis
-
- Nginx
- Static files · TLS
-
- Multi-tenant · JWT · DPoP · AES-GCM encryption
-
-
-
-
-
-
- CREDENTIAL REGISTRY
-
- registry.siros.org
- JSON API · Static catalogue
-
- registry-cli
-
- VCTM
- Templates
-
-
-
-
-
-
- CREDENTIAL ISSUER
-
- vc-issuer
- OID4VCI
-
- Signing Keys
- PKCS#11 / HSM
-
- Token Status Lists
-
- SD-JWT VC · mDL · ES256 · EdDSA
-
-
-
-
-
-
- TRUST SERVICES
-
- go-trust
- AuthZEN PDP · Fail-closed
-
- ETSI
- LoTE
- OIDF
- DID
-
- TS 119 612 · TS 119 602 · OpenID Federation · did:web/webvh
-
-
-
-
-
-
- CREDENTIAL VERIFIER
-
- vc-verifier
- OID4VP · OIDC
-
- Digital Cred.
- API
- W3C browser
-
- Presentation Exchange · Selective Disclosure
-
- Same-device · Cross-device · QR · Deep link
-
-
-
-
-
-
- IDENTITY & DATA
-
- IdP
- SAML · OIDC
-
- Data Sources
- Claims
-
-
-
-
-
-
- YOUR APPLICATIONS
-
- Application (RP)
- Your service
-
- CI / CD
- Automation
-
-
-
-
-
- Protocols
-
- OID4VCI / OID4VP
- AuthZEN trust eval
- Registry metadata
-
- SD-JWT
- mDL
- JWT VC
-
-
-
-
-
-
- REST
- WMP
-
-
- OID4VCI
-
-
- AuthZEN
-
-
- OID4VP
-
-
- AuthZEN
-
-
- AuthZEN
-
-
- Credential metadata
-
-
- Authenticate
-
-
- OIDC login
-
-
-
-
- Deployment: Docker Compose · Kubernetes · Hosted at id.siros.org · Self-hosted on your premises
- OCI images: vc/issuer · vc/verifier · go-trust · go-wallet-backend · wallet-frontend · Native SDKs: Kotlin · Swift
-
-
-
-
-
-
-
-
-
-
- Keycloak · Azure AD · ADFS · Shibboleth
- Standard OIDC tokens · Claims mapping
-
\ No newline at end of file
+SIROS ID: Platform Architecture Architecture of the SIROS ID platform. On the user device: the wallet-frontend web wallet with the wallet-companion browser extension, the Android and iOS wrapper apps that host it, the native SDKs and secure key storage. The device talks REST and WMP to go-wallet-backend, which runs OID4VCI and OID4VP through the credential issuer and verifier (SUNET/vc) and asks the go-trust AuthZEN trust service for trust decisions. The credential registry provides credential type metadata. Identity providers authenticate issuance; relying party applications log in through the verifier over OIDC. SIROS ID — Platform Architecture
+SIROS ID Platform · Hosted at id.siros.org · Self-hosted on your premises
+
+
+USER DEVICE
+Web wallet
+wallet-frontend
+React PWA
+wallet-companion
+Browser extension
+Native apps (WebView hosts)
+wallet-android-wrapper
+Android
+wallet-ios-wrapper
+iOS
+Native libraries
+siros-sdk-kotlin · siros-sdk-swift
+SDKs for native wallet apps
+Secure keys
+Passkeys (PRF) · OS key stores
+siros-wscd-manager
+
+
+WALLET BACKEND
+go-wallet-backend
+Go · REST · WebSocket (WMP)
+Engine
+OID4VCI · OID4VP
+Storage
+MongoDB · SQLite
+Admin API
+
+
+CREDENTIAL REGISTRY
+registry.siros.org
+Static catalogue · TS11 JSON API
+registry-cli
+builds catalogue
+VCTM
+type metadata
+
+
+CREDENTIAL ISSUER
+vc-issuer
+OID4VCI
+Signing keys
+PKCS#11
+apigw
+SAML · OIDC
+Status lists
+revocation
+
+
+TRUST SERVICES
+go-trust
+AuthZEN PDP
+TSL
+LoTE
+OIDF
+DID
+
+
+CREDENTIAL VERIFIER
+vc-verifier
+OID4VP · DCQL · OIDC OP
+Digital Credentials API
+REST
+WMP
+Credential
+metadata
+OID4VCI
+AuthZEN
+OID4VP
+AuthZEN
+AuthZEN
+
+
+IDENTITY & DATA
+IdP
+SAML · OIDC
+Data sources
+claims
+
+
+YOUR APPLICATIONS
+Your service
+OIDC client
+Keycloak
+or any OIDC RP
+Authenticate
+OIDC login
+Arrows
+Credential protocols
+AuthZEN trust evaluation
+Credential type metadata
+Authentication / login
+Deployment: Docker Compose · Kubernetes · Hosted at id.siros.org · Self-hosted on your premises
+Container images: SUNET/vc (issuer, verifier, registry, apigw) · go-trust · go-wallet-backend · wallet-frontend
+SIROS Wallet Layers Layering of the SIROS wallet on a user device, in two paths. Path A: native wallet apps built on the SDK sample apps use the SDK orchestration layer fully, which runs OID4VCI and OID4VP flows and talks to the go-wallet-backend engine over WMP. Path B: the Android and iOS wrapper apps host the wallet-frontend web wallet, which runs the flows and talks to the engine itself; the wrapper exposes native capabilities to the page through a JavaScript bridge, backed by the SDK for ISO 18013-5 proximity on Android, plus wrapper-own code that does not use the SDK. Both paths sit on shared SDK capability modules, Rust and UniFFI libraries and the platform layer. SIROS Wallet — How the Layers Fit Together
+
+
+ENGINE (OFF-DEVICE): go-wallet-backend
+Flow engine
+OID4VCI · OID4VP over WebSocket / WMP
+REST services
+passkey login · encrypted container storage
+Trust + attestation
+AuthZEN proxy to go-trust · wallet attestation
+PATH A · Native wallet: the SDK runs the flows
+PATH B · Web wallet in a native shell: the SDK is a capability bridge
+
+
+WRAPPER APPS (WEBVIEW HOST)
+wallet-android-wrapper
+Android
+wallet-ios-wrapper
+iOS
+wallet-frontend (TypeScript web wallet)
+Runs the flows itself: OID4VCI / OID4VP, UI and consent
+Talks to the engine itself · in-page WSCD host (WASM)
+JS bridge (nativeWrapper)
+@JavascriptInterface · WKScriptMessageHandler
+SDK-backed capability bridge
+ISO 18013-5 proximity
+(BLE, NFC) through the SDK
+keystore and credentials
+modules
+Wrapper-own code (no SDK)
+Passkeys, WebAuthn, YubiKit
+FaceTec ID capture
+DC API registry, eID
+BLE, Secure Enclave
+
+
+SDK SAMPLE APPS
+Kotlin sample-app
+Swift SampleApp
+
+
+SDK ORCHESTRATION LAYER
+SirosWallet facade
+accept issuance / presentation
+Flow state machine
+OID4VCI + OID4VP (flow)
+WMP client
+WebSocket · HTTP + SSE (transport)
+Login + container sync
+passkey login, refresh, lock
+WalletState
+drives UI and consent
+Wallet attestation
+Play Integrity · App Attest
+WMP over WebSocket
+Engine protocol + REST
+
+
+NATIVE SDK CAPABILITY MODULES
+ISO 18013-5 proximity
+mdoc over BLE · NFC
+Keys + WSCD plugins
+JWE keystore · software, FIDO2, R2PS
+ZK proving
+ZK mdoc presentation · circuit catalog
+Passkeys + security keys
+WebAuthn PRF · CTAP2 over USB / NFC
+Credentials
+DCQL matching · mdoc / SD-JWT · metadata
+DC API support
+response encryption · matcher bindings
+
+
+RUST / UNIFFI NATIVE LIBRARIES
+siros-wscd-manager
+software, FIDO2 / CTAP2, R2PS
+zk-cred-longfellow
+Longfellow ZK proofs
+zk-cred-vega
+Vega ZK proofs
+siros-dc-matcher
+DCQL + DC API matcher
+
+
+PLATFORM (OS) AND HARDWARE
+Secure keys
+Android Keystore ·
+iOS Secure Enclave
+Passkeys + PRF
+Credential Manager ·
+ASAuthorization
+Radios
+BLE · NFC · USB
+(security keys)
+Attestation
+Play Integrity ·
+App Attest
+DC API registry
+Digital Credentials
+On the user device · Android and iOS
+Arrows
+Full SDK use (sample apps)
+Web wallet talks to the engine itself
+SDK-backed capability bridge
+Wrapper-own code, bypasses the SDK
+
+
+
## Component Summary
### User Domain
diff --git a/static/img/architecture-overview.svg b/static/img/architecture-overview.svg
index fb185b8..70b5a5e 100644
--- a/static/img/architecture-overview.svg
+++ b/static/img/architecture-overview.svg
@@ -1,311 +1,161 @@
-
\ No newline at end of file
+
\ No newline at end of file
diff --git a/static/img/wallet-layers.svg b/static/img/wallet-layers.svg
new file mode 100644
index 0000000..0890353
--- /dev/null
+++ b/static/img/wallet-layers.svg
@@ -0,0 +1,173 @@
+
\ No newline at end of file