ak.schema.contact_operations.v1

Arkret Contact and Direct Conversation Operation DTOs

ak.schema.contact_operations.v1 · file: schemas/contact-operations.schema.json

Closed request/response DTO bundle for the Contact lifecycle: request, respond, reject, scope replacement, tombstone, the portable Contact round evidence bundle, acceptance receipts and the peer Contact carrier, plus the contact-list projection.

* $ · anyOf[15]

anyOf · anyOf[0] · oneOf[2] · $ref #/$defs/contact_request_request_body

oneOf · oneOf[0] · object

* phase · const "prepare"

enum: "prepare"

* operation_id · string · $ref ./principal-operations.schema.json#/$defs/operation_id

pattern: ^ak:operation:[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$

* idempotency_key · string · $ref ./principal-operations.schema.json#/$defs/opaque_id

* peer · oneOf[2] · $ref #/$defs/contact_peer

oneOf · oneOf[0] · object

* kind · const "human"

enum: "human"

* account_id · object · $ref ./common-ids.schema.json#/$defs/account_id

Complete protocol identity for a principal at one Station, including human, Agent, Applet-managed Ghost and integration accounts. It does not imply a human login, provisioning workflow, credential class or authorization. Equality is byte-for-byte equality of both canonical did_core_id components; neither component may be inferred from a DID Document, route, session audience, current service, handle, or local database key. Accounts with the same principal_id at different station_id values are permanently distinct. Principal equality MUST NOT establish account equivalence or any permission inheritance, merging, delegation, substitution or recovery relationship. Account-scoped authority requires independent authorization for the exact AccountId. Permanent loss of a Station does not permit its accounts or PCR lineages to migrate to or revive at another Station; Realm takeover and RealmCommit recovery do not waive this boundary. See models/common-fields.md section 4.2.

* principal_id · string · $ref #/$defs/did_core_id

Canonical stable DID-derived identity core. The lowercase DID method name follows ak:did_core:, and the remaining method-adapter-defined core is opaque to generic consumers. The did:web v1 adapter uses the complete canonical method-specific-id, never a digest or truncated host. Principal-core and service-core equality is byte-for-byte equality of the complete did_core_id. Event actor and Realm membership equality instead use the complete closed ActorId, and account-scoped equality uses the complete AccountId; neither may be reduced to a principal core. A did_core_id is not a DID and cannot be resolved without a did or AuthenticatedServiceResolution.

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

* station_id · string · $ref #/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

oneOf · oneOf[1] · object

* kind · const "agent"

enum: "agent"

* actor_id · oneOf[2] · $ref ./common-ids.schema.json#/$defs/actor_id

Complete protocol identity for an Event author or Realm member: account carries the exact AccountId for every Station-hosted principal; service identifies a service acting as itself. The discriminator is validated against accepted registration and admission evidence; it never authorizes itself. Account and service are distinct, and no comparison may fall back to a bare principal_id. Agent and integration classification, provisioning, controller binding and credential authorization are independently verified facts, not identity variants. Account actors at different Stations MUST NOT share or inherit authority merely because their principal_id, DID controller or signing key matches, including membership, capability, RealmCommit-signing and recovery authority.

oneOf · oneOf[0] · object

* kind · const "account"

enum: "account"

* account_id · $ref #/$defs/account_id · $ref #/$defs/account_id

oneOf · oneOf[1] · object

* kind · const "service"

enum: "service"

* service_id · string · $ref #/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

* controller_account_id · object · $ref ./common-ids.schema.json#/$defs/account_id

* principal_id · string · $ref #/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

* station_id · string · $ref #/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

* granted_to_peer_scopes · array<$ref #/$defs/contact_scope> · $ref #/$defs/contact_scopes

items · string (enum) · $ref #/$defs/contact_scope

enum: "invite" "direct_message" "voice_call" "video_call" "presence"

* introduction_evidence · oneOf[5] · $ref #/$defs/contact_introduction_evidence

oneOf · oneOf[0] · object

* kind · const "locator_ref"

enum: "locator_ref"

* principal_locator · object · $ref ./principal-locator.schema.json

Signed online locator returned from a holder-controlled Station locator ref. It asserts an exact AccountId and current first-hop route used for private invite delivery; it is not a Realm membership grant and cannot alter account identity.

* schema · const "ak.schema.principal_locator.v1"

enum: "ak.schema.principal_locator.v1"

* account_id · object · $ref ./common-ids.schema.json#/$defs/account_id

* principal_id · string · $ref #/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

* station_id · string · $ref #/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

* service_resolution · oneOf[2] · $ref ./identity-resolution.schema.json#/$defs/service_resolution_carrier

First-hop resolution material for account_id.station_id; it is covered by the locator proofs.

oneOf · oneOf[0] · object

* inline · $ref #/$defs/authenticated_service_resolution · $ref #/$defs/authenticated_service_resolution

oneOf · oneOf[1] · object

* resolution_url · string (uri) · format=uri

Bounded canonical HTTPS discovery URL for the public method evidence of the expected service. Fetch success supplies no authority or freshness.

pattern: ^https://[^?#]+$

route_assistance · object · $ref ./identity-resolution.schema.json#/$defs/route_assistance

Transport-only bounded discovery hints. They do not authorize routing, extend outer token expiry, or supply current DID state.

* mirror_hints · array<$ref #/$defs/route_mirror_hint>

At most four independently routable mirror hints. Each item carries the mirror did_core_id together with a service_resolution_carrier; bare URLs and bare core ids are not valid items.

items · $ref #/$defs/route_mirror_hint · $ref #/$defs/route_mirror_hint

* issued_at · string (date-time) · format=date-time · $ref #/$defs/timestamp

Canonical Arkret-owned absolute instant. UTC Z form with exactly three millisecond digits. Whole seconds MUST use .000Z; offsets, missing/finer fractions, lowercase separators, leap seconds, and invalid Gregorian calendar dates are forbidden. Shape validation by this pattern is supplemented by semantic date validation.

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

* expires_at · string (date-time) · format=date-time · $ref #/$defs/timestamp

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

* locator_ref_digest · $ref #/$defs/digest · $ref #/$defs/digest

Digest of the private locator ref material. The raw locator token MUST NOT appear in durable Realm events.

display_hint · object

UI-only display hint. It is not identity authority and MUST NOT be used for authorization.

display_name_hint · string

avatar_blob_ref · string · $ref ./common-ids.schema.json#/$defs/blob_ref

Content-addressed reference to exact Blob bytes. The embedded suite and digest are the sole wire commitment to those bytes; sibling content/ciphertext digest mirrors are forbidden.

pattern: ^ak:blob:(?:sha256|blake3):[0-9a-f]{64}$

* proofs · array<$ref #/$defs/principal_locator_proof>

At minimum contains recipient_service_acceptance. High-assurance deployments SHOULD also require subject_locator_authorization.

items · $ref #/$defs/principal_locator_proof · $ref #/$defs/principal_locator_proof

oneOf · oneOf[1] · object

* kind · const "shared_realm"

enum: "shared_realm"

* realm_id · string · $ref ./principal-operations.schema.json#/$defs/realm_id

Retyped ak.realm.create Event token. It therefore carries the same fixed current-v1 0x01/SHA-256 content-address identity and is not selected by Realm state.

pattern: ^ak:realm:[A-Za-z0-9_-]{44}$

* requester_member_ref · string · $ref #/$defs/event_id

pattern: ^ak:event:[A-Za-z0-9_-]{44}$

* target_member_ref · string · $ref #/$defs/event_id

pattern: ^ak:event:[A-Za-z0-9_-]{44}$

oneOf · oneOf[2] · object

* kind · const "handle_claim"

enum: "handle_claim"

* handle · string (arkret-canonical-handle) · format=arkret-canonical-handle · $ref ./string-profiles.schema.json#/$defs/canonical_handle

Canonical <prepared-localpart>:<lowercase-A-label-domain> handle or realm alias. The prepared localpart maximum is 128 Unicode code points; the domain maximum is 253 ASCII octets.

pattern: ^(?!ak:)[^\s:@/#?\\]+:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+$

* handle_claim · object · $ref ./handle-claim.schema.json

allOf · allOf[0] · ?

allOf · allOf[1] · ?

allOf · allOf[2] · ?

* schema · const "ak.schema.handle_claim.v1"

enum: "ak.schema.handle_claim.v1"

* claim · $ref #/$defs/handle_claim_core · $ref #/$defs/handle_claim_core

* status · string (enum)

enum: "pending" "verified" "revoked"

* as_of · string (date-time) · format=date-time · $ref #/$defs/timestamp

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

* verifier_id · string · $ref ./common-ids.schema.json#/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

* verified_at · $ref #/$defs/nullable_timestamp · $ref #/$defs/nullable_timestamp

* revocation · oneOf[2]

oneOf · oneOf[0] · $ref #/$defs/handle_claim_revocation · $ref #/$defs/handle_claim_revocation

oneOf · oneOf[1] · null

* fresh_until · string (date-time) · format=date-time · $ref #/$defs/timestamp

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

* status_proof · allOf[2]

allOf · allOf[0] · object · $ref ./event-envelope.schema.json#/$defs/proof

Generic detached-JWS proof shape reused by non-Event schemas (snapshot signature, snapshot witness attestations, identity receipts, handle claims, etc.). MUST NOT be used as the shape of Event Envelope `producer_proof` — Event proofs reference $defs/event_proof and bind canonical Event bytes via `event_digest`. Non-Event signed objects MUST define an object-family signing-context constant and include it in the canonical proof binding object with payload_digest; the context constant is not a wire field in this generic shape. drift detection: `payload_digest#event_proof` in forbidden-wire-fields.json is the hard-reject mirror of this rule. New non-Event signed objects MAY $ref this shape; new signed Event-shaped objects MUST instead $ref event_proof.

* kind · string (enum)

Generic detached JWS proof over a canonical non-Event payload binding object that includes an object-family context constant.

enum: "detached_jws"

* verification_method · string

DID URL of the signing key for this non-Event detached proof. Same pattern as $defs/event_proof.verification_method; semantics are decoupled from Event proof (see $defs/event_proof for the Event-only shape).

pattern: ^did:[a-z0-9]+:[^\s#?]+#[A-Za-z0-9._:-]+$

* payload_digest · $ref #/$defs/digest · $ref #/$defs/digest

Generic non-Event detached-proof hash. This $defs/proof shape is reused by non-Event schemas; Event.properties.producer_proof references $defs/event_proof and MUST use event_digest instead.

* created_at · string (date-time) · format=date-time · $ref #/$defs/timestamp

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

domain · string

audience · oneOf[2]

oneOf · oneOf[0] · …

recursion truncated at depth 8; see source schema for full shape

oneOf · oneOf[1] · …

recursion truncated at depth 8; see source schema for full shape

proof_purpose · string (enum)

Optional role discriminator for non-Event proofs. HandleClaim core, status and revocation carriers make issuer_attestation, holder_acceptance, status_attestation and revocation_authorization load-bearing. governance_authorization marks a resource-governance-key authorization (directory withdraw/takedown-appeal, discovery-directory.md 8.7.1). Generic proof consumers ignore it unless their object-family contract makes it load-bearing.

enum: "issuer_attestation" "holder_acceptance" "status_attestation" "revocation_authorization" "governance_authorization"

* jws · string

pattern: ^[A-Za-z0-9_-]+\.\.[A-Za-z0-9_-]+$

allOf · allOf[1] · object

* domain · const "ak.handle_claim_status.v1"

enum: "ak.handle_claim_status.v1"

* proof_purpose · const "status_attestation"

enum: "status_attestation"

resolved_by · string · $ref #/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

resolved_at · string (date-time) · format=date-time · $ref #/$defs/timestamp

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

oneOf · oneOf[3] · object

* kind · const "same_station"

enum: "same_station"

oneOf · oneOf[4] · object

* kind · const "explicit_address"

enum: "explicit_address"

continuity_evidence · object · $ref #/$defs/contact_continuity_evidence

Explicit portable import. The Station validates the checkpoint and bounded tail, binds the exact pair and committed lineage, and derives the predecessor. Ordinary online recontact loads Station durable evidence instead.

* checkpoint · object · $ref #/$defs/bilateral_continuity_checkpoint

* core · object · $ref #/$defs/bilateral_continuity_checkpoint_core

Domain-neutral, root-anchored commitment to one contiguous prefix of a bilateral lineage. Sequence is monotonic; same sequence with a different checkpoint digest is a fork, never a winner election.

allOf · allOf[0] · ?

* context · const "ak.contact.round.continuity.v1"

enum: "ak.contact.round.continuity.v1"

* participant_ids · array<$ref #/$defs/actor_id>

The two exact ActorIds, sorted by RFC 8785 canonical bytes.

items · oneOf[2] · $ref #/$defs/actor_id

oneOf · oneOf[0] · object

* kind · …

recursion truncated at depth 8; see source schema for full shape

* account_id · …

recursion truncated at depth 8; see source schema for full shape

oneOf · oneOf[1] · object

* kind · …

recursion truncated at depth 8; see source schema for full shape

* service_id · …

recursion truncated at depth 8; see source schema for full shape

* root_basis · allOf[2]

Portable uncheckpointed root Contact round evidence. It is retained so founder and root identity remain independently derivable after prefix compaction.

allOf · allOf[0] · object · $ref #/$defs/contact_round_evidence_bundle

allOf · allOf[0] · ?

* contact_round_id · string · $ref ./principal-operations.schema.json#/$defs/digest

pattern: ^sha256:[0-9a-f]{64}$

previous_terminal_contact_round_id · string · $ref ./principal-operations.schema.json#/$defs/digest

Absent only for a root Contact round. On recontact it is copied from every signed request fact and request acceptance receipt in this bundle and points to the immediately preceding terminal round. The bundle field is derived convenience, never independent authority.

pattern: ^sha256:[0-9a-f]{64}$

* contact_round · oneOf[2] · $ref #/$defs/contact_round

oneOf · oneOf[0] · …

recursion truncated at depth 8; see source schema for full shape

oneOf · oneOf[1] · …

recursion truncated at depth 8; see source schema for full shape

* request_receipts · array<$ref #/$defs/request_acceptance_receipt>

items · …

recursion truncated at depth 8; see source schema for full shape

normal_response_receipt · object · $ref #/$defs/normal_response_acceptance_receipt

Source Station attestation issued only after the exact response Event's command unit is committed and its Contact effect atomically installed. Pending admission or proposal acknowledgement is not this receipt.

allOf · allOf[0] · …

recursion truncated at depth 8; see source schema for full shape

* contact_round_id · …

recursion truncated at depth 8; see source schema for full shape

* request_receipt · …

recursion truncated at depth 8; see source schema for full shape

* response_event_ref · …

recursion truncated at depth 8; see source schema for full shape

* producer_signer · …

recursion truncated at depth 8; see source schema for full shape

* outgoing_slot_absence_digest · …

recursion truncated at depth 8; see source schema for full shape

* accepted_at · …

recursion truncated at depth 8; see source schema for full shape

* issuer_id · …

recursion truncated at depth 8; see source schema for full shape

* signature · …

recursion truncated at depth 8; see source schema for full shape

glare_concurrency_attestations · array<$ref #/$defs/glare_concurrency_attestation>

items · …

recursion truncated at depth 8; see source schema for full shape

* current_proofs · array<$ref #/$defs/contact_current_proof>

items · …

recursion truncated at depth 8; see source schema for full shape

continuity_checkpoint · object · $ref #/$defs/bilateral_continuity_checkpoint

Latest mutually signed compacted prefix for this lineage. Its presence changes the chain terminator from the root round to covered_through_contact_round_id; it never changes the root basis or participant authority pair.

* core · …

recursion truncated at depth 8; see source schema for full shape

* checkpoint_digest · …

recursion truncated at depth 8; see source schema for full shape

* signatures · …

recursion truncated at depth 8; see source schema for full shape

allOf · allOf[1] · ?

* covered_through_contact_round_id · string · $ref ./principal-operations.schema.json#/$defs/digest

The exact terminal contact_round_id at the compacted-prefix boundary. The oldest remaining tail edge points here; bundle content digests are accumulated only in prefix_accumulator_root.

pattern: ^sha256:[0-9a-f]{64}$

* prefix_accumulator_root · string · $ref ./principal-operations.schema.json#/$defs/digest

pattern: ^sha256:[0-9a-f]{64}$

* covered_prefix_count · integer

* sequence · integer

previous_checkpoint_digest · string · $ref ./principal-operations.schema.json#/$defs/digest

pattern: ^sha256:[0-9a-f]{64}$

* checkpoint_digest · string · $ref ./principal-operations.schema.json#/$defs/digest

H(ak.bilateral-continuity.checkpoint.v1, canonical core).

pattern: ^sha256:[0-9a-f]{64}$

* signatures · array<$ref #/$defs/bilateral_continuity_checkpoint_signature>

Exactly one signature by each registered participant authority key over the checkpoint core.

items · object · $ref #/$defs/bilateral_continuity_checkpoint_signature

* signer_id · oneOf[2] · $ref #/$defs/actor_id

oneOf · oneOf[0] · object

* kind · …

recursion truncated at depth 8; see source schema for full shape

* account_id · …

recursion truncated at depth 8; see source schema for full shape

oneOf · oneOf[1] · object

* kind · …

recursion truncated at depth 8; see source schema for full shape

* service_id · …

recursion truncated at depth 8; see source schema for full shape

* signature · object · $ref ./principal-operations.schema.json#/$defs/signature

* verification_method · string · $ref ./common-ids.schema.json#/$defs/did_url

Arkret verification-method DID URL profile (identity/did-usage-and-verification.md section 2.2): lowercase method name, no query, required fragment, fragment limited to ASCII [A-Za-z0-9._:-]. Every verification_method-family field and every kid/key_ref a schema declares to be a DID URL MUST resolve to exactly this definition; values compare byte-for-byte with no URI normalization or percent-decoding.

pattern: ^did:[a-z0-9]+:[^\s#?]+#[A-Za-z0-9._:-]+$

* created_at · string (date-time) · format=date-time · $ref #/$defs/timestamp

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

* jws · string

pattern: ^[A-Za-z0-9_-]+\.\.[A-Za-z0-9_-]+$

* uncompressed_tail_entries · array<$ref #/$defs/contact_round_evidence_bundle>

Immediate predecessor first; at least the latest terminal round remains explicit, and the final edge must terminate exactly at checkpoint.core.covered_through_contact_round_id.

items · object · $ref #/$defs/contact_round_evidence_bundle

allOf · allOf[0] · ?

* contact_round_id · string · $ref ./principal-operations.schema.json#/$defs/digest

pattern: ^sha256:[0-9a-f]{64}$

previous_terminal_contact_round_id · string · $ref ./principal-operations.schema.json#/$defs/digest

pattern: ^sha256:[0-9a-f]{64}$

* contact_round · oneOf[2] · $ref #/$defs/contact_round

oneOf · oneOf[0] · object

* kind · const "normal"

enum: "normal"

* sorted_pair_member_ids · array<$ref #/$defs/actor_id>

Exactly two distinct full ActorIds, strictly ascending by their RFC 8785 JCS UTF-8 unsigned bytes. Validation rejects noncanonical order without sorting the received array.

items · …

recursion truncated at depth 8; see source schema for full shape

* request_event_ref · string · $ref #/$defs/event_id

pattern: ^ak:event:[A-Za-z0-9_-]{44}$

* request_acceptance_receipt_digest · string · $ref ./principal-operations.schema.json#/$defs/digest

pattern: ^sha256:[0-9a-f]{64}$

oneOf · oneOf[1] · object

* kind · const "glare"

enum: "glare"

* sorted_pair_member_ids · array<$ref #/$defs/actor_id>

Exactly two distinct full ActorIds, strictly ascending by their RFC 8785 JCS UTF-8 unsigned bytes. Validation rejects noncanonical order without sorting the received array.

items · …

recursion truncated at depth 8; see source schema for full shape

* requests · array<object>

Exactly two distinct request_event_ref values, strictly ascending by the complete typed EventId wire string UTF-8 unsigned bytes. Receipt digest is not a sort key or tiebreaker. Duplicate refs are invalid even with different digests. Receivers reject unsorted input without normalization. The signed request Event author ActorId of requests[0], not the Station receipt issuer_id, is the root-round founder.

items · …

recursion truncated at depth 8; see source schema for full shape

* request_receipts · array<$ref #/$defs/request_acceptance_receipt>

items · object · $ref #/$defs/request_acceptance_receipt

Source Station attestation issued only after the exact request Event's command unit is committed and its Contact effect atomically installed. It may seed normal/glare round evidence; a pending admission receipt cannot occupy this type.

* core · object · $ref #/$defs/request_acceptance_receipt_core

allOf · allOf[0] · …

recursion truncated at depth 8; see source schema for full shape

allOf · allOf[1] · …

recursion truncated at depth 8; see source schema for full shape

* holder · …

recursion truncated at depth 8; see source schema for full shape

* peer · …

recursion truncated at depth 8; see source schema for full shape

* slot_version · …

recursion truncated at depth 8; see source schema for full shape

slot_predecessor · …

recursion truncated at depth 8; see source schema for full shape

previous_terminal_contact_round_id · …

recursion truncated at depth 8; see source schema for full shape

* request_event_ref · …

recursion truncated at depth 8; see source schema for full shape

* producer_signer · …

recursion truncated at depth 8; see source schema for full shape

* source_checkpoint · …

recursion truncated at depth 8; see source schema for full shape

* accepted_at · …

recursion truncated at depth 8; see source schema for full shape

* issuer_id · …

recursion truncated at depth 8; see source schema for full shape

* receipt_digest · string · $ref ./principal-operations.schema.json#/$defs/digest

pattern: ^sha256:[0-9a-f]{64}$

* signature · object · $ref ./principal-operations.schema.json#/$defs/signature

* verification_method · …

recursion truncated at depth 8; see source schema for full shape

* created_at · …

recursion truncated at depth 8; see source schema for full shape

* jws · …

recursion truncated at depth 8; see source schema for full shape

normal_response_receipt · object · $ref #/$defs/normal_response_acceptance_receipt

allOf · allOf[0] · ?

* contact_round_id · string · $ref ./principal-operations.schema.json#/$defs/digest

pattern: ^sha256:[0-9a-f]{64}$

* request_receipt · object · $ref #/$defs/request_acceptance_receipt

* core · object · $ref #/$defs/request_acceptance_receipt_core

allOf · allOf[0] · …

recursion truncated at depth 8; see source schema for full shape

allOf · allOf[1] · …

recursion truncated at depth 8; see source schema for full shape

* holder · …

recursion truncated at depth 8; see source schema for full shape

* peer · …

recursion truncated at depth 8; see source schema for full shape

* slot_version · …

recursion truncated at depth 8; see source schema for full shape

slot_predecessor · …

recursion truncated at depth 8; see source schema for full shape

previous_terminal_contact_round_id · …

recursion truncated at depth 8; see source schema for full shape

* request_event_ref · …

recursion truncated at depth 8; see source schema for full shape

* producer_signer · …

recursion truncated at depth 8; see source schema for full shape

* source_checkpoint · …

recursion truncated at depth 8; see source schema for full shape

* accepted_at · …

recursion truncated at depth 8; see source schema for full shape

* issuer_id · …

recursion truncated at depth 8; see source schema for full shape

* receipt_digest · string · $ref ./principal-operations.schema.json#/$defs/digest

pattern: ^sha256:[0-9a-f]{64}$

* signature · object · $ref ./principal-operations.schema.json#/$defs/signature

* verification_method · …

recursion truncated at depth 8; see source schema for full shape

* created_at · …

recursion truncated at depth 8; see source schema for full shape

* jws · …

recursion truncated at depth 8; see source schema for full shape

* response_event_ref · string · $ref #/$defs/event_id

Complete identity of the accepted response Event. Its digest is derived by decoding this suite-tagged full-digest EventId; no parallel response_digest is carried.

pattern: ^ak:event:[A-Za-z0-9_-]{44}$

* producer_signer · oneOf[2] · $ref #/$defs/contact_producer_signer

Exact-Event source-signed producer projection. Closed direct and delegated branches are distinguished by delegated_actor_did presence, with no new wire tag. Enclosing carrier validation MUST select delegated if and only if the original Event is a legal Agent controller-device Event with executed_by; human and Agent runtime use direct. Method/raw32 authenticate the original producer, while delegated_actor_did only locates the independently verified Agent public identity. No reusable authorization, new endpoint or private PCR disclosure is created.

oneOf · oneOf[0] · object · $ref #/$defs/contact_direct_producer_signer

Closed direct producer branch for human-device and Agent-runtime Contact Events. The original Event has no executed_by; its producer method already locates its Actor DID. No delegated_actor_did is permitted.

* verification_method · …

recursion truncated at depth 8; see source schema for full shape

* public_key_b64u · …

recursion truncated at depth 8; see source schema for full shape

oneOf · oneOf[1] · object · $ref #/$defs/contact_delegated_producer_signer

Closed delegated producer branch, required exactly for a legal Agent controller-device Contact Event with executed_by. The receiver verifies the original producer signature and separately validates this complete Agent DID history against exact actor/controller/Station and the create-locked tuple.

* verification_method · …

recursion truncated at depth 8; see source schema for full shape

* public_key_b64u · …

recursion truncated at depth 8; see source schema for full shape

* delegated_actor_did · …

recursion truncated at depth 8; see source schema for full shape

* outgoing_slot_absence_digest · string · $ref ./principal-operations.schema.json#/$defs/digest

H('ak.contact.no_outgoing_slot.v1', outgoing_slot_absence_transcript) over the exact closed transcript defined by identity/contact-and-direct-conversation.md section 2.

pattern: ^sha256:[0-9a-f]{64}$

* accepted_at · string (date-time) · format=date-time · $ref #/$defs/timestamp

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

* issuer_id · string · $ref #/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

* signature · object · $ref ./principal-operations.schema.json#/$defs/signature

* verification_method · string · $ref ./common-ids.schema.json#/$defs/did_url

pattern: ^did:[a-z0-9]+:[^\s#?]+#[A-Za-z0-9._:-]+$

* created_at · string (date-time) · format=date-time · $ref #/$defs/timestamp

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

* jws · string

pattern: ^[A-Za-z0-9_-]+\.\.[A-Za-z0-9_-]+$

glare_concurrency_attestations · array<$ref #/$defs/glare_concurrency_attestation>

items · object · $ref #/$defs/glare_concurrency_attestation

Source-service-signed evidence for the subject_id -> peer_id direction that both request receipts were accepted while neither request slot had yet been consumed. A glare bundle requires the two opposite directions; issuer_id is the signing service and is never used as the participant discriminator.

* subject_id · oneOf[2] · $ref #/$defs/actor_id

oneOf · oneOf[0] · …

recursion truncated at depth 8; see source schema for full shape

oneOf · oneOf[1] · …

recursion truncated at depth 8; see source schema for full shape

* issuer_id · string · $ref #/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

* peer_id · oneOf[2] · $ref #/$defs/actor_id

oneOf · oneOf[0] · …

recursion truncated at depth 8; see source schema for full shape

oneOf · oneOf[1] · …

recursion truncated at depth 8; see source schema for full shape

* request_receipt_digests · array<$ref ./principal-operations.schema.json#/$defs/digest>

items · …

recursion truncated at depth 8; see source schema for full shape

* observed_commit_event_ids · array<$ref #/$defs/event_id>

items · …

recursion truncated at depth 8; see source schema for full shape

* complete_through · integer

* unconsumed_slot_checkpoint · string · $ref ./principal-operations.schema.json#/$defs/digest

pattern: ^sha256:[0-9a-f]{64}$

* observed_at · string (date-time) · format=date-time · $ref #/$defs/timestamp

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

* signature · object · $ref ./principal-operations.schema.json#/$defs/signature

* verification_method · …

recursion truncated at depth 8; see source schema for full shape

* created_at · …

recursion truncated at depth 8; see source schema for full shape

* jws · …

recursion truncated at depth 8; see source schema for full shape

* current_proofs · array<$ref #/$defs/contact_current_proof>

items · object · $ref #/$defs/contact_current_proof

Existing source Station attestation of its confirmed directional Contact projection. Authorizing proofs are issued only after the exact source command is committed by the unique confirmed RealmCommit; the peer verifies the independently derived Station's historical service authority and the original holder producer separately, without receiving private PCR history.

* contact_round_id · string · $ref ./principal-operations.schema.json#/$defs/digest

pattern: ^sha256:[0-9a-f]{64}$

* issuer_id · string · $ref #/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

* peer · oneOf[2] · $ref #/$defs/contact_peer

Signed peer component of the issuer-local lineage key. The directional subject is the other exact member of the bound Contact pair.

oneOf · oneOf[0] · …

recursion truncated at depth 8; see source schema for full shape

oneOf · oneOf[1] · …

recursion truncated at depth 8; see source schema for full shape

* head_event_ref · string · $ref #/$defs/event_id

Complete identity of the actual confirmed current-head Event at proof issuance. It may equal the carrier's original fact or be its authenticated same-direction successor; exact coverage requires the complete verified predecessor chain, never only a larger complete_through. A round-wide terminal uses the separately verified source tombstone and counterpart fence rules. Missing chain material stays non-authorizing pending. A source MUST NOT sign a superseded fact as a fresh head or backdate a proof. Its digest is derived by decoding this suite-tagged full-digest EventId; no parallel head_digest is carried.

pattern: ^ak:event:[A-Za-z0-9_-]{44}$

* terminal · boolean

Signed current-head classification. true authenticates the round-wide fence from a confirmed ak.contact.tombstone; both directional proofs may reference that same source tombstone without inventing another holder Event. The counterpart verifies the original source proof and retains its own direction's complete_through version. Incomplete local direction material permits a known-terminal fence but no fabricated completeness proof. A historical predecessor in a recontact continuity chain requires true from both directional proofs.

* accepted_commit_event_ids · array<$ref #/$defs/event_id>

items · …

recursion truncated at depth 8; see source schema for full shape

* complete_through · integer

Last completely authenticated version of the direction identified by (contact_round_id, issuer_id, peer): version 1 is either the normal responder's initial accepted Event or a founding request head, which covers both glare sides and the normal requester (identity/contact-and-direct-conversation.md section 3, founding edge); successors use their confirmed payload.version. Never the PCR stream position, request slot_version, RealmCommit height or receiver time. A counterpart terminal acknowledgement retains its local confirmed version, without copying the remote version or incrementing it.

* fresh_until · string (date-time) · format=date-time · $ref #/$defs/timestamp

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

* signature · object · $ref ./principal-operations.schema.json#/$defs/signature

* verification_method · …

recursion truncated at depth 8; see source schema for full shape

* created_at · …

recursion truncated at depth 8; see source schema for full shape

* jws · …

recursion truncated at depth 8; see source schema for full shape

continuity_checkpoint · object · $ref #/$defs/bilateral_continuity_checkpoint

* core · object · $ref #/$defs/bilateral_continuity_checkpoint_core

Domain-neutral, root-anchored commitment to one contiguous prefix of a bilateral lineage. Sequence is monotonic; same sequence with a different checkpoint digest is a fork, never a winner election.

allOf · allOf[0] · ?

* context · const "ak.contact.round.continuity.v1"

enum: "ak.contact.round.continuity.v1"

* participant_ids · array<$ref #/$defs/actor_id>

The two exact ActorIds, sorted by RFC 8785 canonical bytes.

items · …

recursion truncated at depth 8; see source schema for full shape

* root_basis · allOf[2]

Portable uncheckpointed root Contact round evidence. It is retained so founder and root identity remain independently derivable after prefix compaction.

allOf · allOf[0] · …

recursion truncated at depth 8; see source schema for full shape

allOf · allOf[1] · …

recursion truncated at depth 8; see source schema for full shape

* covered_through_contact_round_id · string · $ref ./principal-operations.schema.json#/$defs/digest

The exact terminal contact_round_id at the compacted-prefix boundary. The oldest remaining tail edge points here; bundle content digests are accumulated only in prefix_accumulator_root.

pattern: ^sha256:[0-9a-f]{64}$

* prefix_accumulator_root · string · $ref ./principal-operations.schema.json#/$defs/digest

pattern: ^sha256:[0-9a-f]{64}$

* covered_prefix_count · integer

* sequence · integer

previous_checkpoint_digest · string · $ref ./principal-operations.schema.json#/$defs/digest

pattern: ^sha256:[0-9a-f]{64}$

* checkpoint_digest · string · $ref ./principal-operations.schema.json#/$defs/digest

H(ak.bilateral-continuity.checkpoint.v1, canonical core).

pattern: ^sha256:[0-9a-f]{64}$

* signatures · array<$ref #/$defs/bilateral_continuity_checkpoint_signature>

Exactly one signature by each registered participant authority key over the checkpoint core.

items · object · $ref #/$defs/bilateral_continuity_checkpoint_signature

* signer_id · …

recursion truncated at depth 8; see source schema for full shape

* signature · …

recursion truncated at depth 8; see source schema for full shape

message · string

oneOf · oneOf[1] · object

* phase · const "commit"

enum: "commit"

* operation_id · string · $ref ./principal-operations.schema.json#/$defs/operation_id

pattern: ^ak:operation:[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$

* idempotency_key · string · $ref ./principal-operations.schema.json#/$defs/opaque_id

* reservation_handle · string · $ref ./principal-operations.schema.json#/$defs/opaque_id

* signed_event · allOf[2]

allOf · allOf[0] · object · $ref ./principal-operations.schema.json#/$defs/signed_event

Closed producer-signed Event. Shared persistent Events become final only when the current Realm governance Station issues a RealmCommit in the derived Realm, Circle, or Sidecar stream.

allOf · allOf[0] · ?

allOf · allOf[1] · ?

allOf · allOf[2] · ?

allOf · allOf[3] · ?

allOf · allOf[4] · ?

allOf · allOf[5] · $ref #/$defs/registered_admission_shape · $ref #/$defs/registered_admission_shape

allOf · allOf[6] · $ref #/$defs/registered_execution_shape · $ref #/$defs/registered_execution_shape

allOf · allOf[7] · ?

allOf · allOf[8] · ?

allOf · allOf[9] · ?

allOf · allOf[10] · ?

allOf · allOf[11] · ?

allOf · allOf[12] · ?

allOf · allOf[13] · ?

allOf · allOf[14] · ?

allOf · allOf[15] · ?

allOf · allOf[16] · ?

allOf · allOf[17] · ?

allOf · allOf[18] · ?

allOf · allOf[19] · ?

allOf · allOf[20] · ?

allOf · allOf[21] · ?

allOf · allOf[22] · ?

allOf · allOf[23] · ?

allOf · allOf[24] · ?

allOf · allOf[25] · ?

allOf · allOf[26] · ?

allOf · allOf[27] · ?

allOf · allOf[28] · ?

allOf · allOf[29] · ?

allOf · allOf[30] · ?

allOf · allOf[31] · ?

allOf · allOf[32] · ?

allOf · allOf[33] · ?

allOf · allOf[34] · ?

allOf · allOf[35] · ?

allOf · allOf[36] · ?

allOf · allOf[37] · ?

allOf · allOf[38] · ?

allOf · allOf[39] · ?

allOf · allOf[40] · ?

allOf · allOf[41] · ?

allOf · allOf[42] · ?

allOf · allOf[43] · ?

allOf · allOf[44] · ?

allOf · allOf[45] · ?

allOf · allOf[46] · ?

allOf · allOf[47] · ?

allOf · allOf[48] · ?

allOf · allOf[49] · ?

allOf · allOf[50] · ?

allOf · allOf[51] · ?

allOf · allOf[52] · ?

allOf · allOf[53] · ?

allOf · allOf[54] · ?

allOf · allOf[55] · ?

allOf · allOf[56] · ?

allOf · allOf[57] · ?

allOf · allOf[58] · ?

allOf · allOf[59] · ?

allOf · allOf[60] · ?

allOf · allOf[61] · ?

allOf · allOf[62] · ?

allOf · allOf[63] · ?

allOf · allOf[64] · ?

allOf · allOf[65] · ?

allOf · allOf[66] · ?

allOf · allOf[67] · ?

allOf · allOf[68] · ?

allOf · allOf[69] · ?

allOf · allOf[70] · ?

allOf · allOf[71] · ?

allOf · allOf[72] · ?

allOf · allOf[73] · ?

allOf · allOf[74] · ?

allOf · allOf[75] · ?

allOf · allOf[76] · ?

allOf · allOf[77] · ?

allOf · allOf[78] · ?

allOf · allOf[79] · ?

allOf · allOf[80] · ?

allOf · allOf[81] · ?

allOf · allOf[82] · ?

allOf · allOf[83] · ?

allOf · allOf[84] · ?

allOf · allOf[85] · ?

allOf · allOf[86] · ?

allOf · allOf[87] · ?

allOf · allOf[88] · ?

allOf · allOf[89] · ?

allOf · allOf[90] · ?

allOf · allOf[91] · ?

allOf · allOf[92] · ?

allOf · allOf[93] · ?

allOf · allOf[94] · ?

allOf · allOf[95] · ?

allOf · allOf[96] · ?

allOf · allOf[97] · ?

allOf · allOf[98] · ?

allOf · allOf[99] · ?

allOf · allOf[100] · ?

allOf · allOf[101] · ?

allOf · allOf[102] · ?

allOf · allOf[103] · ?

allOf · allOf[104] · ?

allOf · allOf[105] · ?

allOf · allOf[106] · ?

allOf · allOf[107] · ?

allOf · allOf[108] · ?

allOf · allOf[109] · ?

allOf · allOf[110] · ?

allOf · allOf[111] · ?

allOf · allOf[112] · ?

allOf · allOf[113] · ?

allOf · allOf[114] · ?

allOf · allOf[115] · ?

allOf · allOf[116] · ?

allOf · allOf[117] · ?

allOf · allOf[118] · ?

allOf · allOf[119] · ?

allOf · allOf[120] · ?

allOf · allOf[121] · ?

allOf · allOf[122] · ?

allOf · allOf[123] · ?

allOf · allOf[124] · ?

allOf · allOf[125] · ?

allOf · allOf[126] · ?

allOf · allOf[127] · ?

allOf · allOf[128] · ?

allOf · allOf[129] · ?

allOf · allOf[130] · ?

allOf · allOf[131] · ?

allOf · allOf[132] · ?

allOf · allOf[133] · ?

allOf · allOf[134] · ?

allOf · allOf[135] · ?

allOf · allOf[136] · ?

allOf · allOf[137] · ?

allOf · allOf[138] · ?

allOf · allOf[139] · ?

allOf · allOf[140] · ?

* event_id · string · $ref ./common-ids.schema.json#/$defs/event_id

Complete Arkret Event cryptographic identity. The suffix is the canonical unpadded Base64URL encoding of exactly 33 octets: fixed current-v1 suite code 0x01 followed by all 32 octets of the SHA-256 Event digest. Regex validation is only lexical; receivers MUST decode, require 33 octets, require byte 0 == 0x01, canonical re-encode, and verify the full digest before use. Other registered digest suites remain available only to the typed domains that explicitly select them and MUST NOT appear in Event IDs.

pattern: ^ak:event:[A-Za-z0-9_-]{44}$

* kind · string

Standard ak.* Event kinds MUST appear in artifacts/registry/event-kind-registry.json. State convergence is defined by the registered pure reducer over kind + payload; producers do not submit typed current result writes.

pattern: ^ak\.[a-z0-9_]+(\.[a-z0-9_]+)*$

realm_id · string · $ref ./common-ids.schema.json#/$defs/realm_id

Retyped ak.realm.create Event token. It therefore carries the same fixed current-v1 0x01/SHA-256 content-address identity and is not selected by Realm state.

pattern: ^ak:realm:[A-Za-z0-9_-]{44}$

* scope_ref · $ref #/$defs/scope_ref · $ref #/$defs/scope_ref

Required producer-signed security scope. The closed union is ordinary existing realm, circle, or native sidecar scope plus the create-only realm_genesis exception. It enters proof.event_digest and E2EE AAD. Reducers independently derive the exact scope from schema-validated payload and accepted references; missing dependencies, nonexistent scope, realm_id mismatch, omitted sidecar_id, substituting circle for sidecar, or any unequal field is fail closed. Sidecar domain Event kinds remain Extension-owned; recognizing this native security shape does not make Kernel interpret the Sidecar reducer. Exact product targets remain inside recipient-visible ciphertext.

* actor_id · oneOf[2] · $ref ./common-ids.schema.json#/$defs/actor_id

oneOf · oneOf[0] · object

* kind · const "account"

enum: "account"

* account_id · $ref #/$defs/account_id · $ref #/$defs/account_id

oneOf · oneOf[1] · object

* kind · const "service"

enum: "service"

* service_id · string · $ref #/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

executed_by · oneOf[2] · $ref ./common-ids.schema.json#/$defs/actor_id

oneOf · oneOf[0] · object

* kind · const "account"

enum: "account"

* account_id · $ref #/$defs/account_id · $ref #/$defs/account_id

oneOf · oneOf[1] · object

* kind · const "service"

enum: "service"

* service_id · string · $ref #/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

authorization_ref · oneOf[6]

Optional. Required when executed_by is present. It identifies an accepted Grant, delegation Event, DID-document delegation, or one of the closed profile-specific authority constants. The current governance Station evaluates the reference against the target stream's committed state.

oneOf · oneOf[0] · $ref #/$defs/grant_ref · $ref #/$defs/grant_ref

oneOf · oneOf[1] · $ref #/$defs/event_ref · $ref #/$defs/event_ref

oneOf · oneOf[2] · $ref #/$defs/did_delegation_ref · $ref #/$defs/did_delegation_ref

oneOf · oneOf[3] · $ref #/$defs/direct_conversation_participant_authority_ref · $ref #/$defs/direct_conversation_participant_authority_ref

oneOf · oneOf[4] · $ref #/$defs/direct_conversation_bootstrap_authority_ref · $ref #/$defs/direct_conversation_bootstrap_authority_ref

oneOf · oneOf[5] · $ref #/$defs/membership_compensation_delegation_ref · $ref #/$defs/membership_compensation_delegation_ref

applet_id · $ref #/$defs/applet_id · $ref #/$defs/applet_id

Optional signed Applet provenance. Required by ak.profile.applet_* when the Event is introduced by an Applet, Ghost Actor, bridge, or delegated applet path. Enters canonical event bytes and therefore is covered by proof.event_digest. When present, authorization_ref MUST also be present and resolve to a real active registration/capability grant binding this applet_id, registration_epoch, action and resource per zh/extensions/applet-integration.md sections 4, 8 and 11. Service-actor self-signature proves provenance but is not an authorization substitute. Capability-gated actions require a grant covering action/resource. For subject_only operations the referenced grant binds only the exact active install and cannot replace the subject signature, FSM or independent action authority. Service self-authored Events use ActorId.service; the install grant subject MUST be the same exact ActorId.service as its producer; hosting Station and effective scope are verified separately without coercing a Service into an account variant.

external_ref · $ref #/$defs/external_ref · $ref #/$defs/external_ref

Optional signed external provenance reference for Applet / bridge-originated Events. It is covered by event_digest and MUST NOT be carried only in unsigned when used for loop prevention, audit, or external-message idempotency. Must not contain unauthorized external plaintext.

* created_at · $ref #/$defs/canonical_event_timestamp · $ref #/$defs/canonical_event_timestamp

semantic_refs · array<$ref #/$defs/semantic_ref>

Optional semantic refs with role. Omit when there are no semantic references; an explicitly empty array is not canonical. Admission selectors determine any required references. PCR policy recovery has no DID-root anchor reference; its policy/session/replacement-key authority is verified separately.

items · $ref #/$defs/semantic_ref · $ref #/$defs/semantic_ref

* payload · object

* producer_proof · $ref #/$defs/event_proof · $ref #/$defs/event_proof

The Event's sole portable producer proof. Storage receipts are separate objects and never authorize this Event. producer_proof and unsigned remain outside the canonical Event digest. Exact retries preserve the verified producer proof.

allOf · allOf[1] · object

* kind · const "ak.contact.requested"

enum: "ak.contact.requested"

anyOf · anyOf[1] · allOf[2] · $ref #/$defs/contact_request_outcome

allOf · allOf[0] · oneOf[11] · $ref #/$defs/contact_operation_outcome

oneOf · oneOf[0] · object

* status · const "prepared"

enum: "prepared"

* result_kind · const "request"

enum: "request"

* operation_id · string · $ref ./principal-operations.schema.json#/$defs/operation_id

pattern: ^ak:operation:[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$

* reservation_handle · string · $ref ./principal-operations.schema.json#/$defs/opaque_id

* expires_at · string (date-time) · format=date-time · $ref #/$defs/timestamp

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

* event_draft · object · $ref ./principal-operations.schema.json#/$defs/prepared_event_draft

Service-built canonical producer Event digest-payload bytes with producer_proof and reducer-managed fields absent. The client MUST decode these exact bytes under the suite carried by event_digest, add only the required producer proof, and return the resulting signed Event. Event id and kind are derived views, never parallel wire inputs.

* unsigned_event_bytes · $ref #/$defs/base64url · $ref #/$defs/base64url

* event_digest · string · $ref ./account-operations.schema.json#/$defs/sha256_digest

SHA-256 digest of unsigned_event_bytes under the fixed current-v1 Event identity suite. The value MUST use the sha256 prefix; no Realm state selects or changes it.

pattern: ^sha256:[0-9a-f]{64}$

oneOf · oneOf[1] · object

* status · const "prepared"

enum: "prepared"

* result_kind · const "response"

enum: "response"