ak.schema.circle.v1
ak.schema.circle.v1 · file: schemas/circle.schema.json Circle — an intra-Realm scoped event/message boundary with its own membership, history_access and optional independent MLS group. Parent Realm membership supplies only the current-membership intersection gate; history_access is never dynamically inherited.
* $ · object
Circle — an intra-Realm scoped event/message boundary with its own membership, history_access and optional independent MLS group. Parent Realm membership supplies only the current-membership intersection gate; history_access is never dynamically inherited.
allOf · allOf[0] ·
?id ·
string · $ref ./common-ids.schema.json#/$defs/circle_idPresent on the materialised object. MUST be absent from the create Event payload: zh/models/common-fields.md derives it from the create Event's own event_id (retyped), so a payload-supplied id would be a second, forgeable truth.
pattern:
^ak:circle:[A-Za-z0-9_-]{44}$* schema ·
const "ak.schema.circle.v1"enum:
"ak.schema.circle.v1"* realm_id ·
string · $ref ./common-ids.schema.json#/$defs/realm_idRetyped ak.realm.create Event token. It therefore carries the same fixed current-v1 0x01/SHA-256 content-address identity and is not selected by Realm state.
pattern:
^ak:realm:[A-Za-z0-9_-]{44}$profile_ref ·
stringOptional create-locked Circle semantic profile discriminator. Ordinary Circles omit it. Profile-specific creation paths MUST persist their registered profile id. Agent Sidecar is a separate ak.schema.agent_sidecar.v1 object and MUST NOT be represented by this field.
pattern:
^ak\.profile\.[a-z0-9_.-]+\.v1$* title ·
string (arkret-single-line-display-text) · format=arkret-single-line-display-text · $ref string-profiles.schema.json#/$defs/display_text_256NFC multilingual single-line display text; mixed scripts, emoji, and symbols are allowed.
pattern:
^[^\u0000-\u001F\u007F-\u009F\u202A-\u202E\u2066-\u2069\uFEFF]*[^\s\u0000-\u001F\u007F-\u009F\u202A-\u202E\u2066-\u2069\uFEFF][^\u0000-\u001F\u007F-\u009F\u202A-\u202E\u2066-\u2069\uFEFF]*$summary ·
string (arkret-short-text) · format=arkret-short-text · $ref string-profiles.schema.json#/$defs/short_textNFC multilingual short text. LF is allowed; CR, other C0/C1 controls, BOM, and bidi embedding/override controls are rejected.
pattern:
^[^\u0000-\u0009\u000B-\u001F\u007F-\u009F\u202A-\u202E\uFEFF]*$* display · object · $ref #/$defs/display
* short_name ·
stringHuman-facing short name. Unique per (realm_id, short_name) case-insensitive — reducer-enforced. Circle naming has no Sidecar-reserved prefix because Sidecar is a separate native scope.
pattern:
^[A-Z][A-Za-z0-9 _-]{0,23}$* color_token ·
string (enum)Color token from the spec-controlled palette. Clients MUST map token -> theme color (light/dark/high-contrast) consistently across devices; clients MUST NOT reassign tokens.
enum:
"slate" "red" "orange" "amber" "yellow" "lime" "green" "emerald" "teal" "cyan" "sky" "blue" "indigo" "violet" "fuchsia" "pink" "gray_high_contrast"* symbol · object
oneOf · oneOf[0] ·
?oneOf · oneOf[1] ·
?emoji ·
stringglyph ·
string (enum)enum:
"lock" "shield" "eye" "eye_off" "user_shield" "fingerprint" "key" "diamond" "flame" "leaf" "authority commit" "compass" "atom" "bolt" "moon" "sun" "star" "globe" "satellite" "ring" "chain" "tag" "flag" "scroll" "scale" "hourglass" "spark"* directory_visibility ·
string (enum)Who may see this Circle exists as a directory entry. 'members' means only Circle members see its title/display/member_ids. 'realm_members' exposes directory metadata only and does NOT grant event or history access.
enum:
"members" "realm_members"* join_rule ·
string (enum)public permits parent-Realm members to self-join; invite requires an authorized administrator using ak.circle.member.add.others with the required same-unit audit. v1 has no Circle invitation or acceptance workflow. All joins bind the exact current parent membership revision.
enum:
"invite" "knock" "public"* history_access ·
string (enum)Circle's own governance history range ratchet, initialized by Circle create. The only state-changing update is all_history_for_current_members to since_join; widening is permanently forbidden. It is never dynamically inherited from or capped by the parent Realm history_access, while current access still requires active parent-Realm membership. Standard MLS requires since_join.
enum:
"since_join" "all_history_for_current_members"agent_participation · object
Optional wrapped five-bit Agent ceiling. When present every bit is explicit and may only tighten the parent Realm ceiling.
* agent · object · $ref ./principal-operations.schema.json#/$defs/participation_bits
* reply_message ·
boolean* reaction_add ·
boolean* reaction_remove ·
boolean* accept_third_party_mention ·
boolean* act_on_behalf ·
booleanmls_group_id ·
string · $ref ./common-ids.schema.json#/$defs/mls_group_idRFC 9420 group_id as base64url_no_pad(SHA-256(UTF8("ak.mls.group_id.v1") || 0x00 || canonical_effective_scope_key_bytes(effective_scope))), so exactly 43 characters. Derived by the reducer and the SDK from the effective scope alone; actors never submit it. The v1 formula is the only one: the earlier reversible base64url of the scope key bytes MUST NOT be accepted alongside it. See zh/models/realm-and-space.md section 2.2.
pattern:
^[A-Za-z0-9_-]{43}$* state ·
string (enum)Circle lifecycle state. v1 defines active, archived, and tombstoned only; Circle has no independent freeze or destroy state because parent Realm freeze/destroy applies at the Realm boundary.
enum:
"active" "archived" "tombstoned"state_changed_at ·
string (date-time) · format=date-time · $ref #/$defs/timestampCanonical Arkret-owned absolute instant. UTC Z form with exactly three millisecond digits. Whole seconds MUST use .000Z; offsets, missing/finer fractions, lowercase separators, leap seconds, and invalid Gregorian calendar dates are forbidden. Shape validation by this pattern is supplemented by semantic date validation.
pattern:
^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$* created_by · oneOf[2] · $ref ./common-ids.schema.json#/$defs/actor_id
Complete protocol identity for an Event author or Realm member: account carries the exact AccountId for every Station-hosted principal; service identifies a service acting as itself. The discriminator is validated against accepted registration and admission evidence; it never authorizes itself. Account and service are distinct, and no comparison may fall back to a bare principal_id. Agent and integration classification, provisioning, controller binding and credential authorization are independently verified facts, not identity variants. Account actors at different Stations MUST NOT share or inherit authority merely because their principal_id, DID controller or signing key matches, including membership, capability, RealmCommit-signing and recovery authority.
oneOf · oneOf[0] · object
* kind ·
const "account"enum:
"account"* account_id ·
$ref #/$defs/account_id · $ref #/$defs/account_idoneOf · oneOf[1] · object
* kind ·
const "service"enum:
"service"* service_id ·
$ref #/$defs/did_core_id · $ref #/$defs/did_core_id* created_at ·
string (date-time) · format=date-time · $ref #/$defs/timestampCanonical Arkret-owned absolute instant. UTC Z form with exactly three millisecond digits. Whole seconds MUST use .000Z; offsets, missing/finer fractions, lowercase separators, leap seconds, and invalid Gregorian calendar dates are forbidden. Shape validation by this pattern is supplemented by semantic date validation.
pattern:
^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$updated_by · oneOf[2] · $ref ./common-ids.schema.json#/$defs/actor_id
Complete protocol identity for an Event author or Realm member: account carries the exact AccountId for every Station-hosted principal; service identifies a service acting as itself. The discriminator is validated against accepted registration and admission evidence; it never authorizes itself. Account and service are distinct, and no comparison may fall back to a bare principal_id. Agent and integration classification, provisioning, controller binding and credential authorization are independently verified facts, not identity variants. Account actors at different Stations MUST NOT share or inherit authority merely because their principal_id, DID controller or signing key matches, including membership, capability, RealmCommit-signing and recovery authority.
oneOf · oneOf[0] · object
* kind ·
const "account"enum:
"account"* account_id ·
$ref #/$defs/account_id · $ref #/$defs/account_idoneOf · oneOf[1] · object
* kind ·
const "service"enum:
"service"* service_id ·
$ref #/$defs/did_core_id · $ref #/$defs/did_core_idupdated_at ·
string (date-time) · format=date-time · $ref #/$defs/timestampCanonical Arkret-owned absolute instant. UTC Z form with exactly three millisecond digits. Whole seconds MUST use .000Z; offsets, missing/finer fractions, lowercase separators, leap seconds, and invalid Gregorian calendar dates are forbidden. Shape validation by this pattern is supplemented by semantic date validation.
pattern:
^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$Source
- registry row:
spec/v1/artifacts/registry/schema-registry.json - schema document:
spec/v1/artifacts/schemas/circle.schema.json