Matter data model hierarchy

Node (physical device, one IPv6 address)
└── Endpoint 0 (Root Node — always present)
│   └── BasicInformation cluster (vendor, model, serial, firmware)
│   └── GeneralCommissioning cluster
│   └── OperationalCredentials cluster (fabric membership, NOC)
└── Endpoint 1 (primary device function)
│   └── OnOff cluster (0x0006)
│       Attribute: OnOff (bool) — current on/off state
│       Command:   On (0x01), Off (0x00), Toggle (0x02)
│   └── LevelControl cluster (0x0008)
│       Attribute: CurrentLevel (uint8, 0–254) — brightness
│       Command:   MoveToLevel, Move, Step, MoveToLevelWithOnOff
└── Endpoint 2 (secondary function, e.g. colour)
    └── ColorControl cluster (0x0300)
        Attribute: CurrentHue, CurrentSaturation, ColorTemperatureMireds
        Command:   MoveToHue, MoveToSaturation, MoveToColorTemperature

Matter commissioning sequence

Step 1 — Discovery
  Commissioner (phone app) scans QR code or taps NFC tag on device
  QR code encodes: discriminator (12-bit), setup PIN (27-bit), vendor ID,
  product ID, device type, commissioning flow flags

Step 2 — BLE connection (for most devices)
  Commissioner connects to device via BLE
  Alternative: devices already on IP network use DNS-SD discovery

Step 3 — PASE session
  Commissioner and device establish PASE using the setup PIN from QR code
  PASE uses SPAKE2+ protocol (SRP variant) — PIN never transmitted
  Encrypted channel established over BLE (or UDP for IP-only devices)

Step 4 — Device Attestation verification
  Commissioner requests Attestation Information from device:
  - Device Attestation Certificate (DAC) — device-unique leaf cert
  - Product Attestation Intermediate (PAI) — manufacturer intermediate CA
  - Certified Declaration (CD) — CSA certification assertion
  Commissioner validates: DAC → PAI → PAA (Product Attestation Authority)
  PAA root certs are distributed with commissioner firmware
  If DAC chain invalid: commissioning REJECTED

Step 5 — Network provisioning (Thread devices)
  Commissioner sends Thread Operational Dataset (OTDS) to device
  OTDS contains: network name, channel, PAN ID, master key, extended PAN ID
  Device joins Thread mesh using OTDS

Step 6 — Node Operational Certificate (NOC) issuance
  Commissioner's fabric CA issues NOC to device (unique per fabric)
  NOC encodes: Node ID (64-bit), Fabric ID (64-bit), device public key
  Device stores NOC in secure storage (hardware-protected if available)
  CASE sessions use NOC for mutual authentication going forward

Step 7 — Device added to fabric
  Commissioner stores ACL (Access Control List) on device
  ACL defines which fabric members can read/write which clusters
  Device appears in commissioner app with correct device type UI

DAC trust chain

PAA (Product Attestation Authority)
  Root CA operated by CSA or major ecosystems (Apple, Google)
  PAA certs embedded in commissioner firmware
  CSA maintains PAA registry (publicly accessible)

PAI (Product Attestation Intermediate)
  Issued by PAA to manufacturer
  One PAI per product family or manufacturing batch
  Stored on device, sent to commissioner during attestation

DAC (Device Attestation Certificate)
  Issued by manufacturer's PAI CA to individual device at factory
  Contains: device public key (unique key pair per device)
  Contains: Vendor ID (VID) + Product ID (PID) matching the device
  Private key stored in secure storage on device — never exported
  DAC serial number provides revocation capability (future CRL)

Certified Declaration (CD)
  Signed by CSA, attests product passed Matter certification testing
  Contains: VID, PID list, device type IDs, certification ID
  Embedded in device firmware as a CBOR-encoded blob