ak.schema.account_operations.v1

Arkret Account Operation DTOs

ak.schema.account_operations.v1 · file: schemas/account-operations.schema.json

Closed request and response DTOs for account self-service operations and Account Authority issuer-ledger account-status publication and resolution.

* $ · anyOf[20]

Closed request and response DTOs for account self-service operations and Account Authority issuer-ledger account-status publication and resolution.

anyOf · anyOf[0] · object · $ref #/$defs/account_view

* principal_id · string · $ref ./common-ids.schema.json#/$defs/did_core_id

Canonical stable DID-derived identity core. The lowercase DID method name follows ak:did_core:, and the remaining method-adapter-defined core is opaque to generic consumers. The did:web v1 adapter uses the complete canonical method-specific-id, never a digest or truncated host. Principal-core and service-core equality is byte-for-byte equality of the complete did_core_id. Event actor and Realm membership equality instead use the complete closed ActorId, and account-scoped equality uses the complete AccountId; neither may be reduced to a principal core. A did_core_id is not a DID and cannot be resolved without a did or AuthenticatedServiceResolution.

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

primary_handle_claim · object · $ref ./handle-claim.schema.json

allOf · allOf[0] · ?

allOf · allOf[1] · ?

allOf · allOf[2] · ?

* schema · const "ak.schema.handle_claim.v1"

enum: "ak.schema.handle_claim.v1"

* claim · $ref #/$defs/handle_claim_core · $ref #/$defs/handle_claim_core

* status · string (enum)

enum: "pending" "verified" "revoked"

* as_of · string (date-time) · format=date-time · $ref #/$defs/timestamp

Canonical Arkret-owned absolute instant. UTC Z form with exactly three millisecond digits. Whole seconds MUST use .000Z; offsets, missing/finer fractions, lowercase separators, leap seconds, and invalid Gregorian calendar dates are forbidden. Shape validation by this pattern is supplemented by semantic date validation.

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

* verifier_id · string · $ref ./common-ids.schema.json#/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

* verified_at · $ref #/$defs/nullable_timestamp · $ref #/$defs/nullable_timestamp

* revocation · oneOf[2]

oneOf · oneOf[0] · $ref #/$defs/handle_claim_revocation · $ref #/$defs/handle_claim_revocation

oneOf · oneOf[1] · null

* fresh_until · string (date-time) · format=date-time · $ref #/$defs/timestamp

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

* status_proof · allOf[2]

allOf · allOf[0] · object · $ref ./event-envelope.schema.json#/$defs/proof

Generic detached-JWS proof shape reused by non-Event schemas (snapshot signature, snapshot witness attestations, identity receipts, handle claims, etc.). MUST NOT be used as the shape of Event Envelope `producer_proof` — Event proofs reference $defs/event_proof and bind canonical Event bytes via `event_digest`. Non-Event signed objects MUST define an object-family signing-context constant and include it in the canonical proof binding object with payload_digest; the context constant is not a wire field in this generic shape. drift detection: `payload_digest#event_proof` in forbidden-wire-fields.json is the hard-reject mirror of this rule. New non-Event signed objects MAY $ref this shape; new signed Event-shaped objects MUST instead $ref event_proof.

* kind · string (enum)

Generic detached JWS proof over a canonical non-Event payload binding object that includes an object-family context constant.

enum: "detached_jws"

* verification_method · string

DID URL of the signing key for this non-Event detached proof. Same pattern as $defs/event_proof.verification_method; semantics are decoupled from Event proof (see $defs/event_proof for the Event-only shape).

pattern: ^did:[a-z0-9]+:[^\s#?]+#[A-Za-z0-9._:-]+$

* payload_digest · string · $ref #/$defs/digest

Generic non-Event detached-proof hash. This $defs/proof shape is reused by non-Event schemas; Event.properties.producer_proof references $defs/event_proof and MUST use event_digest instead.

pattern: ^(sha256|blake3):[0-9a-f]{64}$

* created_at · string (date-time) · format=date-time · $ref #/$defs/timestamp

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

domain · string

audience · oneOf[2]

oneOf · oneOf[0] · string

oneOf · oneOf[1] · array<string>

items · string

proof_purpose · string (enum)

Optional role discriminator for non-Event proofs. HandleClaim core, status and revocation carriers make issuer_attestation, holder_acceptance, status_attestation and revocation_authorization load-bearing. governance_authorization marks a resource-governance-key authorization (directory withdraw/takedown-appeal, discovery-directory.md 8.7.1). Generic proof consumers ignore it unless their object-family contract makes it load-bearing.

enum: "issuer_attestation" "holder_acceptance" "status_attestation" "revocation_authorization" "governance_authorization"

* jws · string

pattern: ^[A-Za-z0-9_-]+\.\.[A-Za-z0-9_-]+$

allOf · allOf[1] · object

* domain · const "ak.handle_claim_status.v1"

enum: "ak.handle_claim_status.v1"

* proof_purpose · const "status_attestation"

enum: "status_attestation"

primary_handle_claim_ref · string · $ref #/$defs/handle_claim_ref

Opaque reference to a signed ak.schema.handle_claim.v1 claim, such as an event ref, issuer-local receipt ref, or content-addressed artifact ref.

handle_claim_digests · array<$ref #/$defs/digest> · $ref #/$defs/handle_claim_digests

items · string · $ref #/$defs/digest

pattern: ^(sha256|blake3):[0-9a-f]{64}$

* state · string (enum) · $ref #/$defs/account_state

Account lifecycle projection; mirrors zh/identity/account-lifecycle.md §3.

enum: "active" "soft_logged_out" "locked" "suspended" "deactivated" "erasure_pending"

* devices · array<$ref #/$defs/device_summary> · $ref #/$defs/device_summaries

items · object · $ref #/$defs/device_summary

allOf · allOf[0] · ?

allOf · allOf[1] · ?

allOf · allOf[2] · ?

allOf · allOf[3] · ?

allOf · allOf[4] · ?

* device_id · string · $ref #/$defs/device_id

pattern: ^ak:device:[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$

display_name · string (arkret-single-line-display-text) · format=arkret-single-line-display-text · $ref #/$defs/display_name

NFC multilingual single-line display text; mixed scripts, emoji, and symbols are allowed.

pattern:

^[^\u0000-\u001F\u007F-\u009F\u202A-\u202E\u2066-\u2069\uFEFF]*[^\s\u0000-\u001F\u007F-\u009F\u202A-\u202E\u2066-\u2069\uFEFF][^\u0000-\u001F\u007F-\u009F\u202A-\u202E\u2066-\u2069\uFEFF]*$

* status · string (enum)

Lifecycle projection only, matching device-lifecycle.md section 14.1. revocation_pending is authority-derived from a durable accepted ak.device.revoke security transaction; trust/evidence quality is reported separately in verification_state.

enum: "active" "revocation_pending" "revoked" "expired" "generation_fenced"

* verification_state · string (enum)

Trust verification of the device authorization evidence, separate from lifecycle status. A consumer MUST NOT interpret lifecycle status=active as usable authority unless verification_state=verified.

enum: "verified" "unresolved" "stale"

verification_source · string (enum)

Closed provenance of the verification checkpoint behind verification_state, per device-lifecycle.md section 10.1. genesis is the PCR genesis first device, pairing_code an accepted-device pairing or re-verification ceremony, and recovery an accepted recovery unit replacement device. Login factors, SSO sessions, ordinary session grants and bare server projections MUST NOT mint a checkpoint. Required when verification_state is verified, retained when a previously verified checkpoint went stale, and absent when verification_state is unresolved.

enum: "genesis" "pairing_code" "recovery"

authorized_event_ref · string · $ref #/$defs/event_id

pattern: ^ak:event:[A-Za-z0-9_-]{44}$

authorized_at · string (date-time) · format=date-time · $ref #/$defs/timestamp

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

last_seen_at · string (date-time) · format=date-time · $ref #/$defs/timestamp

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

revoked_at · string (date-time) · format=date-time · $ref #/$defs/timestamp

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

revocation_states · array<$ref ./device-revocation-state.schema.json#/$defs/device_revocation_gate_record>

All gate-relevant durable revoke records for the exact device/generation, sorted by acceptance_seq and Event id. At most 128 distinct unresolved transactions may be admitted; exact replay consumes no slot, a terminal rejected result removes one pending slot, and an already revoked generation accepts no new transaction. Committing one record makes lifecycle status revoked but MUST NOT hide other surviving pending records.

items · oneOf[2] · $ref ./device-revocation-state.schema.json#/$defs/device_revocation_gate_record

Gate-relevant durable state for an exact device generation. Rejected records are audit history and are excluded; pending and revoked records remain visible together so committing one transaction cannot hide another surviving pending transaction.

oneOf · oneOf[0] · $ref #/$defs/device_revocation_pending_state · $ref #/$defs/device_revocation_pending_state

oneOf · oneOf[1] · $ref #/$defs/device_revoked_state · $ref #/$defs/device_revoked_state

profile · allOf[2] · $ref #/$defs/account_materialized_profile

Materialized Actor Profile returned on the account surface. id is the actor_profile ID derived by retyping the accepted ak.profile.create Event ID; realm_id is the exact Principal Control Realm that carries the profile Event lineage.

allOf · allOf[0] · object · $ref ./actor-profile.schema.json

allOf · allOf[0] · ?

id · string

Present on the materialised object. MUST be absent from the create Event payload: zh/models/common-fields.md derives it from the create Event's own event_id (retyped), so a payload-supplied id would be a second, forgeable truth.

pattern: ^ak:actor_profile:[A-Za-z0-9_-]{44}$

* schema · const "ak.schema.actor_profile.v1"

enum: "ak.schema.actor_profile.v1"

realm_id · string · $ref ./common-ids.schema.json#/$defs/realm_id

Retyped ak.realm.create Event token. It therefore carries the same fixed current-v1 0x01/SHA-256 content-address identity and is not selected by Realm state.

pattern: ^ak:realm:[A-Za-z0-9_-]{44}$

* principal_id · string · $ref ./common-ids.schema.json#/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

* actor_kind · string (enum)

Closed Actor classification. agent is reserved exclusively for a controller-provisioned Agent; Applet-created or Applet-hosted automation uses bot; Ghost Actor is provenance rather than an actor_kind and uses integration for an external account/integration mirror or bot for an external bot mirror. MUST NOT include device: a device is an endpoint rather than an Actor principal. actor_kind alone grants no authority; authorization still requires the normative DID, provisioning/registration, Grant and Constraint evidence. See zh/models/actor.md.

enum: "user" "organization" "team" "agent" "bot" "service" "integration"

* display_name · string (arkret-single-line-display-text) · format=arkret-single-line-display-text · $ref string-profiles.schema.json#/$defs/display_text_128

NFC multilingual single-line display text; mixed scripts, emoji, and symbols are allowed.

pattern:

^[^\u0000-\u001F\u007F-\u009F\u202A-\u202E\u2066-\u2069\uFEFF]*[^\s\u0000-\u001F\u007F-\u009F\u202A-\u202E\u2066-\u2069\uFEFF][^\u0000-\u001F\u007F-\u009F\u202A-\u202E\u2066-\u2069\uFEFF]*$

handle · string (arkret-canonical-handle) · format=arkret-canonical-handle · $ref string-profiles.schema.json#/$defs/canonical_handle

Canonical <prepared-localpart>:<lowercase-A-label-domain> handle or realm alias. The prepared localpart maximum is 128 Unicode code points; the domain maximum is 253 ASCII octets.

pattern: ^(?!ak:)[^\s:@/#?\\]+:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+$

agent_slug · string (arkret-agent-slug) · format=arkret-agent-slug · $ref string-profiles.schema.json#/$defs/agent_slug

Canonical controller-scoped Agent Agent selector slug. Maximum 64 Unicode code points in prepared form.

pattern: ^[^\s:@/#?\\]+$

avatar_blob_ref · string

pattern: ^ak:blob:(?:[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}|(?:sha256|blake3):[0-9a-f]{64})$

accountable_principal_ids · array<$ref #/$defs/did_core_id>

items · string · $ref #/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

resolution · object · $ref ./identity-resolution.schema.json#/$defs/resolution_projection

Read-only current principal did projection derived from the PCR identity resolution typed current result. It is not writable through Actor Profile create/update patches and is not an authorization root.

* did · string · $ref ./common-ids.schema.json#/$defs/did

Canonical bare DID used for registration, DID method resolution and owner-published current resolution. It contains no path, query or fragment and MUST project through the registered method adapter to exactly one did_core_id.

pattern: ^did:[a-z0-9]+:[^\s/?#]+$

* method_history_head · string

* version_id · string

pattern: ^(?!ak:)

* resolution_event_ref · string · $ref ./event-envelope.schema.json#/$defs/event_ref

Complete Event reference carrying the suite wire_code and all 32 digest octets. It is suitable for authorization, equality, deduplication, RealmCommit coverage, and exact replay after normal recomputation and acceptance checks.

pattern: ^ak:event:[A-Za-z0-9_-]{44}$

* updated_at · string (date-time) · format=date-time · $ref ./time.schema.json#/$defs/timestamp

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

profile_fields · object

bio · string

status_message · string

applet_interaction · $ref #/$defs/applet_interaction · $ref #/$defs/applet_interaction

* created_at · string (date-time) · format=date-time · $ref #/$defs/timestamp

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

updated_by · oneOf[2] · $ref ./common-ids.schema.json#/$defs/actor_id

Complete protocol identity for an Event author or Realm member: account carries the exact AccountId for every Station-hosted principal; service identifies a service acting as itself. The discriminator is validated against accepted registration and admission evidence; it never authorizes itself. Account and service are distinct, and no comparison may fall back to a bare principal_id. Agent and integration classification, provisioning, controller binding and credential authorization are independently verified facts, not identity variants. Account actors at different Stations MUST NOT share or inherit authority merely because their principal_id, DID controller or signing key matches, including membership, capability, RealmCommit-signing and recovery authority.

oneOf · oneOf[0] · object

* kind · const "account"

enum: "account"

* account_id · $ref #/$defs/account_id · $ref #/$defs/account_id

oneOf · oneOf[1] · object

* kind · const "service"

enum: "service"

* service_id · string · $ref #/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

updated_at · string (date-time) · format=date-time · $ref #/$defs/timestamp

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

allOf · allOf[1] · ?

is_server_admin · boolean

True when the authenticated principal is a deployment server administrator (the server's configured admin principal set). Operator-only product surfaces (e.g. organization creation) gate their UI on this. Reducer/config-derived, not a stored account field; absent or false means non-admin.

anyOf · anyOf[1] · object · $ref #/$defs/account_handoff_request_body

* request_id · string · $ref #/$defs/request_id

pattern: ^ak:request:[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$

* proof · object · $ref #/$defs/account_handoff_authentication_proof

OIDC authorization-code exchange proof used only to create a DPoP-bound account handoff. The signature is made by the same Ed25519 holder key as the request DPoP proof over utf8('ak.account_handoff_authentication_proof.v1\n') || RFC8785_JCS(this object with signature omitted).

* proof_kind · const "oidc_code_exchange"

enum: "oidc_code_exchange"

* challenge · string

Account Authority-generated challenge persisted with the OIDC authorization transaction and consumed by this exchange.

* request_canonical_digest · string · $ref #/$defs/sha256_digest

sha256:<lowercase-hex> of SHA-256 over RFC 8785 JCS bytes of the complete account_handoff_request_body with proof.request_canonical_digest and proof.signature omitted.

pattern: ^sha256:[0-9a-f]{64}$

* audience_id · string · $ref ./common-ids.schema.json#/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

* issuer_uri · string (uri) · format=uri

* client_id · allOf[2]

allOf · allOf[0] · string · $ref #/$defs/non_empty_string

allOf · allOf[1] · ? · $ref string-profiles.schema.json#/$defs/non_typed_identifier_floor

Lexical floor of every identifier value category that does NOT own the ak: namespace (opaque_correlation, document_local_symbol, external_system_identifier, registry_catalog_symbol, unregistered_object_identifier); see common-fields.md 2.1. The negative lookahead IS the floor: it mechanically proves the value cannot be an ak: typed id, which maxLength alone can never prove, while admitting every other value the field already accepted. It deliberately constrains nothing else - the per-field convergence direction (a registered typed kind, or a tighter opaque profile) is decided per object family, so a pattern-only floor composes with whatever profile the field already carries instead of pre-empting it.

pattern: ^(?!ak:)

* redirect_uri · string (uri) · format=uri

* state · string

* nonce · string

* authorization_code · string · $ref #/$defs/non_empty_string

* code_verifier · string

* signature · string

64-byte Ed25519 signature encoded base64url without padding.

pattern: ^[A-Za-z0-9_-]{86}$

anyOf · anyOf[2] · object · $ref #/$defs/account_handoff_outcome

* request_id · string · $ref #/$defs/request_id

pattern: ^ak:request:[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$

* account_handle · string (arkret-canonical-handle) · format=arkret-canonical-handle · $ref ./handle-claim.schema.json#/$defs/handle_claim_core/properties/handle

Canonical <prepared-localpart>:<lowercase-A-label-domain> handle or realm alias. The prepared localpart maximum is 128 Unicode code points; the domain maximum is 253 ASCII octets.

pattern: ^(?!ak:)[^\s:@/#?\\]+:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+$

* account_subject · string · $ref #/$defs/account_subject

Stable subject for the authenticated service account. The client freezes this value from the DPoP-bound handoff and MUST require the identity-binding challenge to echo it byte-for-byte before signing.

pattern: ^sha256:[0-9a-f]{64}$

preferred_locale · string (enum)

Optional private UI-language preference of the authenticated service account. It is returned only in this DPoP-bound handoff response so the client can continue the just-completed authentication flow in the selected language; it MUST NOT be copied into a public actor profile.

enum: "en" "zh"

* account_handoff_grant · string

Opaque, short-lived credential bound to the request DPoP key. It is not ak.session.grant and has no refresh-token semantics.

* expires_at · string (date-time) · format=date-time · $ref #/$defs/timestamp

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

* allowed_operations ·

const ["ak.gate.account.command.issue_identity_binding_challenge.v1","ak.gate.account.command.issue_did_binding_challenge.v1","ak.gate.account.command.abandon_identity_creation.v1","ak.gate.account.command.register.v1","ak.gate.account.command.finalize_device_pairing.v1","ak.gate.account.command.issue_session_grant.v1","ak.gate.account.command.issue_recovery_completion_grant.v1"]

Closed set of operations this handoff may be presented at. The abandonment command is a member because a never-accepted PCR leaves the holder without a principal, so no principal-bound ak.session.grant can carry them. The device-pairing finalize command is a member for the mirror reason: a fresh device of an already bound account has no accepted-device signer yet, so this handoff is the only sender-constrained credential that can supply the exact AccountId its target proof must sign. Membership here does not widen the handoff into a session credential.

enum:

["ak.gate.account.command.issue_identity_binding_challenge.v1","ak.gate.account.command.issue_did_binding_challenge.v1","ak.gate.account.command.abandon_identity_creation.v1","ak.gate.account.command.register.v1","ak.gate.account.command.finalize_device_pairing.v1","ak.gate.account.command.issue_session_grant.v1","ak.gate.account.command.issue_recovery_completion_grant.v1"]

* binding · oneOf[3] · $ref #/$defs/account_handoff_binding

oneOf · oneOf[0] · object

* state · const "identity_creation_active"

enum: "identity_creation_active"

* identity_creation_lease · object · $ref #/$defs/identity_creation_lease

* identity_creation_lease_id · string · $ref #/$defs/opaque_registration_id

pattern: ^[A-Za-z0-9_-]{22,128}$

* fence · integer

* state · string (enum)

Account-Authority-authored durable identity-creation saga state. Clients MUST derive their onboarding phase from this value and MUST NOT infer a phase from local checkpoint presence. reserved_identity MUST be absent only in active and present in every later state.

enum: "active" "reserved" "did_published" "pcr_accepted" "account_bound" "completed"

* expires_at · string (date-time) · format=date-time · $ref #/$defs/timestamp

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

reserved_identity · object · $ref #/$defs/reserved_identity_creation

Server-persisted identity-creation checkpoint, readable only by the authenticated current holder of the owning service account's identity-creation lease. It is NOT public: an unfinished reservation would otherwise leak that a specific account is mid-registration, and abandoning it would leave a permanent public trace. Once registration completes the public artifact is the published method-native anchor itself, so this checkpoint never needs to become public. It contains the exact unpublished or already-published registration anchor, never recovery words, seed material, private keys, or an encrypted root export.

* principal_id · string · $ref ./common-ids.schema.json#/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

* did · string · $ref ./common-ids.schema.json#/$defs/did

pattern: ^did:[a-z0-9]+:[^\s/?#]+$

* registration_anchor_digest · string · $ref #/$defs/sha256_digest

sha256:<lowercase-hex> of SHA-256 over RFC 8785 JCS bytes of the complete principal_registration_anchor object.

pattern: ^sha256:[0-9a-f]{64}$

* principal_registration_anchor · oneOf[1] · $ref ./principal-registration-anchor.schema.json

Closed WebVH registration anchor for a v1 human principal. It is the single primary method-native material that human registration and PCR genesis both consume. v1 human registration supports exactly the active did:webvh adapter and anchor_kind=webvh_registration; every other DID method, including did:key and did:web, fails closed with unsupported_did_method before method-specific parsing. The anchor carries originals, never receipts: a verifier reconstructs did, method_history_head, version_id, the exact normalized DID document and the root verification method/key from the branch material alone, offline, without a current resolver, a database row or an Account Authority attestation. registration_did_evidence and identity_creation_control_proof keep their own registration anti-replay and control-intent roles and never substitute for this object. Adding another branch requires a separately registered publication-proof or independent-witness trust model, threat model and conformance vectors. Complete canonical anchor bytes MUST NOT exceed 1 MiB.

oneOf · oneOf[0] · $ref #/$defs/webvh_registration_anchor · $ref #/$defs/webvh_registration_anchor

oneOf · oneOf[1] · object

* state · const "identity_creation_busy"

enum: "identity_creation_busy"

* retry_after_ms · integer

* expires_at · string (date-time) · format=date-time · $ref #/$defs/timestamp

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

oneOf · oneOf[2] · object

* state · const "bound"

enum: "bound"

* principal_id · string · $ref ./common-ids.schema.json#/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

* did · string · $ref ./common-ids.schema.json#/$defs/did

pattern: ^did:[a-z0-9]+:[^\s/?#]+$

anyOf · anyOf[3] · object · $ref #/$defs/account_onboarding_state

* handoff_request_id · string · $ref #/$defs/request_id

pattern: ^ak:request:[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$

* account_subject · string · $ref #/$defs/account_subject

pattern: ^sha256:[0-9a-f]{64}$

* observed_at · string (date-time) · format=date-time · $ref #/$defs/timestamp

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

* binding · oneOf[3] · $ref #/$defs/account_handoff_binding

oneOf · oneOf[0] · object

* state · const "identity_creation_active"

enum: "identity_creation_active"

* identity_creation_lease · object · $ref #/$defs/identity_creation_lease

* identity_creation_lease_id · string · $ref #/$defs/opaque_registration_id

pattern: ^[A-Za-z0-9_-]{22,128}$

* fence · integer

* state · string (enum)

enum: "active" "reserved" "did_published" "pcr_accepted" "account_bound" "completed"

* expires_at · string (date-time) · format=date-time · $ref #/$defs/timestamp

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

reserved_identity · object · $ref #/$defs/reserved_identity_creation

* principal_id · string · $ref ./common-ids.schema.json#/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

* did · string · $ref ./common-ids.schema.json#/$defs/did

pattern: ^did:[a-z0-9]+:[^\s/?#]+$

* registration_anchor_digest · string · $ref #/$defs/sha256_digest

sha256:<lowercase-hex> of SHA-256 over RFC 8785 JCS bytes of the complete principal_registration_anchor object.

pattern: ^sha256:[0-9a-f]{64}$

* principal_registration_anchor · oneOf[1] · $ref ./principal-registration-anchor.schema.json

oneOf · oneOf[0] · $ref #/$defs/webvh_registration_anchor · $ref #/$defs/webvh_registration_anchor

oneOf · oneOf[1] · object

* state · const "identity_creation_busy"

enum: "identity_creation_busy"

* retry_after_ms · integer

* expires_at · string (date-time) · format=date-time · $ref #/$defs/timestamp

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

oneOf · oneOf[2] · object

* state · const "bound"

enum: "bound"

* principal_id · string · $ref ./common-ids.schema.json#/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

* did · string · $ref ./common-ids.schema.json#/$defs/did

pattern: ^did:[a-z0-9]+:[^\s/?#]+$

* goal · object · $ref #/$defs/account_onboarding_goal

* goal · const "complete_identity"

enum: "complete_identity"

anyOf · anyOf[4] · object · $ref #/$defs/identity_binding_challenge_request_body

* request_id · string · $ref #/$defs/request_id

pattern: ^ak:request:[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$

* identity_creation_lease_id · string · $ref #/$defs/opaque_registration_id

pattern: ^[A-Za-z0-9_-]{22,128}$

* lease_fence · integer

* did · string · $ref #/$defs/did

Canonical bare DID for a v1 human principal anchor. The method set is derived from role_requirements.human_principal_anchor and contains exactly did:webvh. Every other method, including did:key and did:web, MUST fail closed with unsupported_did_method here rather than inside a method parser or history replay. Capability checks for relocation, DID-root recovery and ongoing governance are separate.

pattern: ^did:webvh:[^\s#?]+$

* principal_registration_anchor · oneOf[1] · $ref ./principal-registration-anchor.schema.json

oneOf · oneOf[0] · $ref #/$defs/webvh_registration_anchor · $ref #/$defs/webvh_registration_anchor

* pcr_realm_id · string · $ref ./common-ids.schema.json#/$defs/realm_id

Retyped ak.realm.create Event token. It therefore carries the same fixed current-v1 0x01/SHA-256 content-address identity and is not selected by Realm state.

pattern: ^ak:realm:[A-Za-z0-9_-]{44}$

* realm_create_payload_digest · string · $ref #/$defs/sha256_digest

pattern: ^sha256:[0-9a-f]{64}$

* founding_authorize_payload_digest · string · $ref #/$defs/sha256_digest

pattern: ^sha256:[0-9a-f]{64}$

* initial_session_request_digest · string · $ref #/$defs/sha256_digest

pattern: ^sha256:[0-9a-f]{64}$

anyOf · anyOf[5] · object · $ref #/$defs/identity_binding_challenge_outcome

Only fresh challenge material and domain separation. The authority durably retains the full request, account/handoff subject, lease/fence, DID operation and independently derived pins, PCR/genesis/session digests, audience/origin/trust-domain, and rechecks all of them atomically at registration. The client reconstructs the proof from its frozen submission and authenticated onboarding context.

* request_id · string · $ref #/$defs/request_id

pattern: ^ak:request:[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$

* challenge_id · string · $ref #/$defs/opaque_registration_id

pattern: ^[A-Za-z0-9_-]{22,128}$

* challenge · string

* purpose · const "account_binding_and_pcr_genesis"

enum: "account_binding_and_pcr_genesis"

* issued_at · string (date-time) · format=date-time · $ref #/$defs/timestamp

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

* expires_at · string (date-time) · format=date-time · $ref #/$defs/timestamp

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

anyOf · anyOf[6] · object · $ref #/$defs/account_register_request_body

Canonical account binding request. Exactly one branch is required: proof binds an already-published did, while identity_creation carries the account-first DID operation and PCR genesis unit. In either branch every repeated principal_id and did in the selected proof/creation objects and genesis initial_resolution MUST equal the outer values byte-for-byte, and the Account Authority MUST independently require project(did)=principal_id before any write.

oneOf · oneOf[0] · ?

oneOf · oneOf[1] · ?

* principal_id · string · $ref ./common-ids.schema.json#/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

* did · string · $ref #/$defs/did

pattern: ^did:webvh:[^\s#?]+$

display_name · string (arkret-single-line-display-text) · format=arkret-single-line-display-text · $ref #/$defs/display_name

NFC multilingual single-line display text; mixed scripts, emoji, and symbols are allowed.

pattern:

^[^\u0000-\u001F\u007F-\u009F\u202A-\u202E\u2066-\u2069\uFEFF]*[^\s\u0000-\u001F\u007F-\u009F\u202A-\u202E\u2066-\u2069\uFEFF][^\u0000-\u001F\u007F-\u009F\u202A-\u202E\u2066-\u2069\uFEFF]*$

device_id · string · $ref #/$defs/device_id

pattern: ^ak:device:[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$

proof · object · $ref #/$defs/account_registration_control_proof

Closed control proof for binding an already-published did to principal_id through account register. OIDC, passkey, or agent authentication alone is insufficient to establish DID control. The Account Authority resolves did at high freshness, requires project(did)=principal_id, and selects the current active update key of the entry pinned by did_version_id from verified method history rather than from request-supplied key material. The signature covers every field except signature as canonical JSON with domain separator ak.account_registration_control_proof.v1 and MUST replay the durable challenge issued by ak.gate.account.command.issue_did_binding_challenge.v1.

* proof_kind · const "did_bound_signature"

enum: "did_bound_signature"

* challenge_id · string · $ref #/$defs/opaque_registration_id

pattern: ^[A-Za-z0-9_-]{22,128}$

* challenge · string

* purpose · const "account_binding_for_published_did"

enum: "account_binding_for_published_did"

* request_canonical_digest · string · $ref #/$defs/sha256_digest

SHA-256 over RFC 8785 JCS of the complete account_register_request_body with proof.request_canonical_digest and proof.signature omitted.

pattern: ^sha256:[0-9a-f]{64}$

* account_subject · string · $ref #/$defs/non_empty_string

Service account subject this identity is being bound to. Signed so the proof cannot be replayed to bind the same identity to a different account.

* principal_id · string · $ref ./common-ids.schema.json#/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

* did · string · $ref #/$defs/did

pattern: ^did:webvh:[^\s#?]+$

* did_version_id · allOf[2]

Adapter-defined versionId of the entry whose current active update key signed this proof.

allOf · allOf[0] · string · $ref #/$defs/non_empty_string

allOf · allOf[1] · ? · $ref string-profiles.schema.json#/$defs/non_typed_identifier_floor

pattern: ^(?!ak:)

* control_key_digest · string · $ref #/$defs/sha256_digest

SHA-256 over the canonical multikey bytes of the verified current active update key.

pattern: ^sha256:[0-9a-f]{64}$

* dpop_jkt · string · $ref #/$defs/dpop_jkt

RFC 7638 SHA-256 JWK thumbprint of the holder key, encoded base64url without padding.

pattern: ^[A-Za-z0-9_-]{43}$

* audience_id · string · $ref ./common-ids.schema.json#/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

* origin · string (uri) · format=uri · $ref ./common-ids.schema.json#/$defs/web_origin

Canonical HTTP(S) Web Origin: lowercase scheme/host plus an optional valid non-default effective port. Userinfo, path (including a trailing slash), query, fragment, explicit :80 on HTTP, and explicit :443 on HTTPS are forbidden.

pattern:

^(?:http://(?:\[[0-9A-Fa-f:.]+\]|[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?)(?::(?!80$)(?:[1-9]|[1-9][0-9]{1,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?|https://(?:\[[0-9A-Fa-f:.]+\]|[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?)(?::(?!443$)(?:[1-9]|[1-9][0-9]{1,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?)$

* trust_domain · string · $ref ./common-ids.schema.json#/$defs/trust_domain

pattern: ^ak:trust_domain:[a-z0-9][a-z0-9._\-:]{0,127}$

* issued_at · string (date-time) · format=date-time · $ref #/$defs/timestamp

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

* expires_at · string (date-time) · format=date-time · $ref #/$defs/timestamp

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

* verification_method · string · $ref #/$defs/did_url

Current active update-key DID URL under did. The verifier parses its bare DID component with the registered adapter and requires the projected did_core_id to equal principal_id; it never appends a fragment to principal_id.

pattern: ^did:[a-z0-9]+:[^\s#?]+#[A-Za-z0-9._:-]+$

witness_evidence · string · $ref #/$defs/non_empty_string

Method-native witness / freshness evidence digest for the external DID, required by deployments that do not host the DID themselves.

* signature · string · $ref #/$defs/non_empty_string

identity_creation · object · $ref #/$defs/identity_creation_registration

allOf · allOf[0] · allOf[1] · $ref #/$defs/registration_anchor_control_proof_pairing

allOf · allOf[0] · ?

* identity_creation_lease_id · string · $ref #/$defs/opaque_registration_id

pattern: ^[A-Za-z0-9_-]{22,128}$

* lease_fence · integer

* did · string · $ref #/$defs/did

pattern: ^did:webvh:[^\s#?]+$

* principal_registration_anchor · oneOf[1] · $ref ./principal-registration-anchor.schema.json

oneOf · oneOf[0] · $ref #/$defs/webvh_registration_anchor · $ref #/$defs/webvh_registration_anchor

* registration_did_evidence_draft · object · $ref ./registration-did-evidence.schema.json#/$defs/registration_did_evidence_draft

Client-authored historical DID evidence before Account Authority acceptance. control_proof signs canonical_json({context:'ak.registration_did_evidence_control_proof.v1',principal_id,did,adapter_version,method_history_head,version_id,control_key_digest,method_evidence_digest,verification_method,created_at}); method_evidence_digest is sha256 over RFC 8785 JCS of method_evidence. accepted_at is deliberately absent: the Account Authority adds it only after the exact did_operation has been accepted by the registry.

* principal_id · string · $ref ./common-ids.schema.json#/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

* did · string · $ref ./common-ids.schema.json#/$defs/webvh_did

Canonical bare did:webvh identifier used at method-native registration, document and evidence boundaries. Role admission is enforced separately.

pattern: ^did:webvh:[^\s:/?#]+:[^\s/?#]+$

* adapter_version · const "did:webvh:1.0"

enum: "did:webvh:1.0"

* method_history_head · string

* version_id · string

pattern: ^(?!ak:)

* control_key_digest · string

pattern: ^sha256:[0-9a-f]{64}$

* method_evidence · object · $ref ./did-binding-contracts.schema.json#/$defs/evidence_receipt

Canonical evidence receipt. evidence_digest = "sha256:" + lowercase_hex(SHA-256(RFC8785_JCS(evidence_receipt))). The receipt MUST be retained so an auditor can recompute the digest; a method without proofs degrades to an empty method_proofs array (a document-bound receipt), never to an implementation-invented placeholder. Unknown method or proof kinds fail closed.

* kind · const "ak.did.binding_evidence.v1"

enum: "ak.did.binding_evidence.v1"

* method · $ref #/$defs/method_token · $ref #/$defs/method_token

* document_digest · string · $ref #/$defs/digest

Digest of the resolver's verified normalized DID Document projection (did-usage-and-verification.md section 5.1); never the raw response bytes (those use the differently named raw_document_digest).

pattern: ^(sha256|blake3):[0-9a-f]{64}$

* method_proofs · array<$ref #/$defs/webvh_log_evidence>

Closed per-method proof rows; empty for proofless methods (did:key, bare did:web). v1 registers exactly one row kind (webvh_log); receiving any unregistered proof kind fails closed. Rows never reuse resolver response order: each row kind registers its own canonical sort and duplicate-rejection rules.

items · $ref #/$defs/webvh_log_evidence · $ref #/$defs/webvh_log_evidence

* control_proof · object · $ref ./principal-operations.schema.json#/$defs/signature

* verification_method · string · $ref ./common-ids.schema.json#/$defs/did_url

Arkret verification-method DID URL profile (identity/did-usage-and-verification.md section 2.2): lowercase method name, no query, required fragment, fragment limited to ASCII [A-Za-z0-9._:-]. Every verification_method-family field and every kid/key_ref a schema declares to be a DID URL MUST resolve to exactly this definition; values compare byte-for-byte with no URI normalization or percent-decoding.

pattern: ^did:[a-z0-9]+:[^\s#?]+#[A-Za-z0-9._:-]+$

* created_at · string (date-time) · format=date-time · $ref #/$defs/timestamp

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

* jws · string

pattern: ^[A-Za-z0-9_-]+\.\.[A-Za-z0-9_-]+$

* control_proof · object · $ref #/$defs/identity_creation_control_proof

Fresh proof signed by the WebVH registration root control key. The verifier derives that key from the accepted did:webvh entry's parameters.updateKeys[0] in principal_registration_anchor and MUST NOT treat a request-supplied key or a DID Document verificationMethod as authority. proof_kind is fixed to did_webvh_inception_update_key and MUST agree with anchor_kind=webvh_registration. The Ed25519 signature covers every field except signature as canonical JSON with domain separator ak.identity_creation_control_proof.v1; signature_algorithm is part of those signed bytes.

* proof_kind · string (enum)

Closed registration root-key derivation discriminator. v1 permits only did_webvh_inception_update_key paired with anchor_kind=webvh_registration.

enum: "did_webvh_inception_update_key"

* challenge_id · string · $ref #/$defs/opaque_registration_id

pattern: ^[A-Za-z0-9_-]{22,128}$

* challenge · string

* purpose · const "account_binding_and_pcr_genesis"

enum: "account_binding_and_pcr_genesis"

* account_subject · string · $ref #/$defs/account_subject

pattern: ^sha256:[0-9a-f]{64}$

* principal_id · string · $ref ./common-ids.schema.json#/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

* did · string · $ref #/$defs/did

pattern: ^did:webvh:[^\s#?]+$

* registration_anchor_digest · string · $ref #/$defs/sha256_digest

SHA-256 over RFC 8785 JCS of the complete principal_registration_anchor. The verifier recomputes it from the submitted anchor.

pattern: ^sha256:[0-9a-f]{64}$

* did_version_id · string

pattern: ^(?!ak:)

* control_key_digest · string · $ref #/$defs/sha256_digest

pattern: ^sha256:[0-9a-f]{64}$

* pcr_realm_id · string · $ref ./common-ids.schema.json#/$defs/realm_id

Retyped ak.realm.create Event token. It therefore carries the same fixed current-v1 0x01/SHA-256 content-address identity and is not selected by Realm state.

pattern: ^ak:realm:[A-Za-z0-9_-]{44}$

* realm_create_payload_digest · string · $ref #/$defs/sha256_digest

Canonical digest of the ak.realm.create payload only. Event ids and envelope digests are forbidden from this transcript.

pattern: ^sha256:[0-9a-f]{64}$

* founding_authorize_payload_digest · string · $ref #/$defs/sha256_digest

Canonical digest of the founding ak.device.authorize payload only. Event ids and envelope digests are forbidden from this transcript.

pattern: ^sha256:[0-9a-f]{64}$

* initial_session_request_digest · string · $ref #/$defs/sha256_digest

SHA-256 digest of RFC 8785 JCS InitialSessionGrantRequest. The embedded session_public_key MUST thumbprint to dpop_jkt; this binds the first Standard grant intent without turning it into a separate root-signed object.

pattern: ^sha256:[0-9a-f]{64}$

* genesis_unit_kinds · array · $ref #/$defs/pcr_genesis_unit_kinds

Closed ordered declaration copied into the identity-root creation transcript.

[0] · const "ak.realm.create"

enum: "ak.realm.create"

[1] · const "ak.device.authorize"

enum: "ak.device.authorize"

* identity_creation_lease_id · string · $ref #/$defs/opaque_registration_id

pattern: ^[A-Za-z0-9_-]{22,128}$

* lease_fence · integer

* dpop_jkt · string · $ref #/$defs/dpop_jkt

RFC 7638 SHA-256 JWK thumbprint of the holder key, encoded base64url without padding.

pattern: ^[A-Za-z0-9_-]{43}$

* audience_id · string · $ref ./common-ids.schema.json#/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

* origin · string (uri) · format=uri · $ref ./common-ids.schema.json#/$defs/web_origin

pattern:

^(?:http://(?:\[[0-9A-Fa-f:.]+\]|[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?)(?::(?!80$)(?:[1-9]|[1-9][0-9]{1,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?|https://(?:\[[0-9A-Fa-f:.]+\]|[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?)(?::(?!443$)(?:[1-9]|[1-9][0-9]{1,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?)$

* trust_domain · string · $ref ./common-ids.schema.json#/$defs/trust_domain

pattern: ^ak:trust_domain:[a-z0-9][a-z0-9._\-:]{0,127}$

* issued_at · string (date-time) · format=date-time · $ref #/$defs/timestamp

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

* expires_at · string (date-time) · format=date-time · $ref #/$defs/timestamp

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

* verification_key_multibase · string

pattern: ^z[1-9A-HJ-NP-Za-km-z]+$

* signature_algorithm · const "Ed25519"

enum: "Ed25519"

* signature · string

64-byte Ed25519 identity-root signature encoded base64url without padding.

pattern: ^[A-Za-z0-9_-]{86}$

* pcr_genesis_unit · object · $ref ./principal-operations.schema.json#/$defs/pcr_genesis_unit

Exact ordered, atomic PCR genesis unit. The first Event is identity-root signed ak.realm.create; the second is founding-device signed ak.device.authorize. Neither signer has an accepted Arkret signer projection before this unit, so neither producer proof is resolved through the ordinary device directory. The first key is resolved only from principal_registration_anchor, registration_did_evidence and identity_creation_control_proof; the second key is resolved only from the root-signed founding descriptor, authorize payload and unit-local candidate overlay. For the second Event proof.verification_method, the verifier parses the DID URL, requires the registered adapter to project its bare DID component to principal_id, and requires its fragment to equal device_id (the complete ak:device UUID string); constructing a DID URL by appending to did_core_id is forbidden, and did:key is not accepted for this slot. The verifier MUST NOT consult or mutate the durable device directory until every check succeeds. These Events are replayable only inside this complete unit and its accepted receipt closure, never as standalone shared-history Events. No partial acceptance is permitted.

* events · array

[0] · allOf[2]

allOf · allOf[0] · object · $ref ./event-envelope.schema.json

Closed producer-signed Event. Shared persistent Events become final only when the current Realm governance Station issues a RealmCommit in the derived Realm, Circle, or Sidecar stream.

allOf · allOf[0] · ?

allOf · allOf[1] · ?

allOf · allOf[2] · ?

allOf · allOf[3] · ?

allOf · allOf[4] · ?

allOf · allOf[5] · $ref #/$defs/registered_admission_shape · $ref #/$defs/registered_admission_shape

allOf · allOf[6] · $ref #/$defs/registered_execution_shape · $ref #/$defs/registered_execution_shape

allOf · allOf[7] · ?

allOf · allOf[8] · ?

allOf · allOf[9] · ?

allOf · allOf[10] · ?

allOf · allOf[11] · ?

allOf · allOf[12] · ?

allOf · allOf[13] · ?

allOf · allOf[14] · ?

allOf · allOf[15] · ?

allOf · allOf[16] · ?

allOf · allOf[17] · ?

allOf · allOf[18] · ?

allOf · allOf[19] · ?

allOf · allOf[20] · ?

allOf · allOf[21] · ?

allOf · allOf[22] · ?

allOf · allOf[23] · ?

allOf · allOf[24] · ?

allOf · allOf[25] · ?

allOf · allOf[26] · ?

allOf · allOf[27] · ?

allOf · allOf[28] · ?

allOf · allOf[29] · ?

allOf · allOf[30] · ?

allOf · allOf[31] · ?

allOf · allOf[32] · ?

allOf · allOf[33] · ?

allOf · allOf[34] · ?

allOf · allOf[35] · ?

allOf · allOf[36] · ?

allOf · allOf[37] · ?

allOf · allOf[38] · ?

allOf · allOf[39] · ?

allOf · allOf[40] · ?

allOf · allOf[41] · ?

allOf · allOf[42] · ?

allOf · allOf[43] · ?

allOf · allOf[44] · ?

allOf · allOf[45] · ?

allOf · allOf[46] · ?

allOf · allOf[47] · ?

allOf · allOf[48] · ?

allOf · allOf[49] · ?

allOf · allOf[50] · ?

allOf · allOf[51] · ?

allOf · allOf[52] · ?

allOf · allOf[53] · ?

allOf · allOf[54] · ?

allOf · allOf[55] · ?

allOf · allOf[56] · ?

allOf · allOf[57] · ?

allOf · allOf[58] · ?

allOf · allOf[59] · ?

allOf · allOf[60] · ?

allOf · allOf[61] · ?

allOf · allOf[62] · ?

allOf · allOf[63] · ?

allOf · allOf[64] · ?

allOf · allOf[65] · ?

allOf · allOf[66] · ?

allOf · allOf[67] · ?

allOf · allOf[68] · ?

allOf · allOf[69] · ?

allOf · allOf[70] · ?

allOf · allOf[71] · ?

allOf · allOf[72] · ?

allOf · allOf[73] · ?

allOf · allOf[74] · ?

allOf · allOf[75] · ?

allOf · allOf[76] · ?

allOf · allOf[77] · ?

allOf · allOf[78] · ?

allOf · allOf[79] · ?

allOf · allOf[80] · ?

allOf · allOf[81] · ?

allOf · allOf[82] · ?

allOf · allOf[83] · ?

allOf · allOf[84] · ?

allOf · allOf[85] · ?

allOf · allOf[86] · ?

allOf · allOf[87] · ?

allOf · allOf[88] · ?

allOf · allOf[89] · ?

allOf · allOf[90] · ?

allOf · allOf[91] · ?

allOf · allOf[92] · ?

allOf · allOf[93] · ?

allOf · allOf[94] · ?

allOf · allOf[95] · ?

allOf · allOf[96] · ?

allOf · allOf[97] · ?

allOf · allOf[98] · ?

allOf · allOf[99] · ?

allOf · allOf[100] · ?

allOf · allOf[101] · ?

allOf · allOf[102] · ?

allOf · allOf[103] · ?

allOf · allOf[104] · ?

allOf · allOf[105] · ?

allOf · allOf[106] · ?

allOf · allOf[107] · ?

allOf · allOf[108] · ?

allOf · allOf[109] · ?

allOf · allOf[110] · ?

allOf · allOf[111] · ?

allOf · allOf[112] · ?

allOf · allOf[113] · ?

allOf · allOf[114] · ?

allOf · allOf[115] · ?

allOf · allOf[116] · ?

allOf · allOf[117] · ?

allOf · allOf[118] · ?

allOf · allOf[119] · ?

allOf · allOf[120] · ?

allOf · allOf[121] · ?

allOf · allOf[122] · ?

allOf · allOf[123] · ?

allOf · allOf[124] · ?

allOf · allOf[125] · ?

allOf · allOf[126] · ?

allOf · allOf[127] · ?

allOf · allOf[128] · ?

allOf · allOf[129] · ?

allOf · allOf[130] · ?

allOf · allOf[131] · ?

allOf · allOf[132] · ?

allOf · allOf[133] · ?

allOf · allOf[134] · ?

allOf · allOf[135] · ?

allOf · allOf[136] · ?

allOf · allOf[137] · ?

allOf · allOf[138] · ?

allOf · allOf[139] · ?

allOf · allOf[140] · ?

* event_id · string · $ref ./common-ids.schema.json#/$defs/event_id

Complete Arkret Event cryptographic identity. The suffix is the canonical unpadded Base64URL encoding of exactly 33 octets: fixed current-v1 suite code 0x01 followed by all 32 octets of the SHA-256 Event digest. Regex validation is only lexical; receivers MUST decode, require 33 octets, require byte 0 == 0x01, canonical re-encode, and verify the full digest before use. Other registered digest suites remain available only to the typed domains that explicitly select them and MUST NOT appear in Event IDs.

pattern: ^ak:event:[A-Za-z0-9_-]{44}$

* kind · string

Standard ak.* Event kinds MUST appear in artifacts/registry/event-kind-registry.json. State convergence is defined by the registered pure reducer over kind + payload; producers do not submit typed current result writes.

pattern: ^ak\.[a-z0-9_]+(\.[a-z0-9_]+)*$

realm_id · string · $ref ./common-ids.schema.json#/$defs/realm_id

Retyped ak.realm.create Event token. It therefore carries the same fixed current-v1 0x01/SHA-256 content-address identity and is not selected by Realm state.

pattern: ^ak:realm:[A-Za-z0-9_-]{44}$

* scope_ref · $ref #/$defs/scope_ref · $ref #/$defs/scope_ref

Required producer-signed security scope. The closed union is ordinary existing realm, circle, or native sidecar scope plus the create-only realm_genesis exception. It enters proof.event_digest and E2EE AAD. Reducers independently derive the exact scope from schema-validated payload and accepted references; missing dependencies, nonexistent scope, realm_id mismatch, omitted sidecar_id, substituting circle for sidecar, or any unequal field is fail closed. Sidecar domain Event kinds remain Extension-owned; recognizing this native security shape does not make Kernel interpret the Sidecar reducer. Exact product targets remain inside recipient-visible ciphertext.

* actor_id · oneOf[2] · $ref ./common-ids.schema.json#/$defs/actor_id

oneOf · oneOf[0] · object

* kind · …

recursion truncated at depth 8; see source schema for full shape

* account_id · …

recursion truncated at depth 8; see source schema for full shape

oneOf · oneOf[1] · object

* kind · …

recursion truncated at depth 8; see source schema for full shape

* service_id · …

recursion truncated at depth 8; see source schema for full shape

executed_by · oneOf[2] · $ref ./common-ids.schema.json#/$defs/actor_id

oneOf · oneOf[0] · object

* kind · …

recursion truncated at depth 8; see source schema for full shape

* account_id · …

recursion truncated at depth 8; see source schema for full shape

oneOf · oneOf[1] · object

* kind · …

recursion truncated at depth 8; see source schema for full shape

* service_id · …

recursion truncated at depth 8; see source schema for full shape

authorization_ref · oneOf[6]

Optional. Required when executed_by is present. It identifies an accepted Grant, delegation Event, DID-document delegation, or one of the closed profile-specific authority constants. The current governance Station evaluates the reference against the target stream's committed state.

oneOf · oneOf[0] · $ref #/$defs/grant_ref · $ref #/$defs/grant_ref

oneOf · oneOf[1] · $ref #/$defs/event_ref · $ref #/$defs/event_ref

oneOf · oneOf[2] · $ref #/$defs/did_delegation_ref · $ref #/$defs/did_delegation_ref

oneOf · oneOf[3] · $ref #/$defs/direct_conversation_participant_authority_ref · $ref #/$defs/direct_conversation_participant_authority_ref

oneOf · oneOf[4] · $ref #/$defs/direct_conversation_bootstrap_authority_ref · $ref #/$defs/direct_conversation_bootstrap_authority_ref

oneOf · oneOf[5] · $ref #/$defs/membership_compensation_delegation_ref · $ref #/$defs/membership_compensation_delegation_ref

applet_id · $ref #/$defs/applet_id · $ref #/$defs/applet_id

Optional signed Applet provenance. Required by ak.profile.applet_* when the Event is introduced by an Applet, Ghost Actor, bridge, or delegated applet path. Enters canonical event bytes and therefore is covered by proof.event_digest. When present, authorization_ref MUST also be present and resolve to a real active registration/capability grant binding this applet_id, registration_epoch, action and resource per zh/extensions/applet-integration.md sections 4, 8 and 11. Service-actor self-signature proves provenance but is not an authorization substitute. Capability-gated actions require a grant covering action/resource. For subject_only operations the referenced grant binds only the exact active install and cannot replace the subject signature, FSM or independent action authority. Service self-authored Events use ActorId.service; the install grant subject MUST be the same exact ActorId.service as its producer; hosting Station and effective scope are verified separately without coercing a Service into an account variant.

external_ref · $ref #/$defs/external_ref · $ref #/$defs/external_ref

Optional signed external provenance reference for Applet / bridge-originated Events. It is covered by event_digest and MUST NOT be carried only in unsigned when used for loop prevention, audit, or external-message idempotency. Must not contain unauthorized external plaintext.

* created_at · $ref #/$defs/canonical_event_timestamp · $ref #/$defs/canonical_event_timestamp

semantic_refs · array<$ref #/$defs/semantic_ref>

Optional semantic refs with role. Omit when there are no semantic references; an explicitly empty array is not canonical. Admission selectors determine any required references. PCR policy recovery has no DID-root anchor reference; its policy/session/replacement-key authority is verified separately.

items · $ref #/$defs/semantic_ref · $ref #/$defs/semantic_ref

* payload · object

* producer_proof · $ref #/$defs/event_proof · $ref #/$defs/event_proof

The Event's sole portable producer proof. Storage receipts are separate objects and never authorize this Event. producer_proof and unsigned remain outside the canonical Event digest. Exact retries preserve the verified producer proof.

allOf · allOf[1] · object

* kind · const "ak.realm.create"

enum: "ak.realm.create"

payload · object

* object · object

[1] · allOf[2]