ak.schema.device_message.v1

Arkret Device Message Envelope

ak.schema.device_message.v1 · file: schemas/device-message.schema.json

* $ · object

allOf · allOf[0] · ?

allOf · allOf[1] · oneOf[3]

oneOf · oneOf[0] · ?

oneOf · oneOf[1] · ?

oneOf · oneOf[2] · ?

allOf · allOf[2] · ?

allOf · allOf[3] · ?

* device_message_id · string · $ref #/$defs/device_message_id

Sender-assigned stable identity of one logical to-device message. Queue services MUST preserve it byte-for-byte across retries and redelivery. Receivers deduplicate by the exact closed sender identity and device_message_id: (sender_account_id, sender_device_id, device_message_id), (sender_agent_id, device_message_id), or (sender_id, device_message_id).

pattern: ^ak:device_message:[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$

* kind · string

pattern: ^ak\.[a-z0-9_]+(\.[a-z0-9_]+)*$

sender_account_id · object · $ref ./common-ids.schema.json#/$defs/account_id

Complete protocol identity for a principal at one Station, including human, Agent, Applet-managed Ghost and integration accounts. It does not imply a human login, provisioning workflow, credential class or authorization. Equality is byte-for-byte equality of both canonical did_core_id components; neither component may be inferred from a DID Document, route, session audience, current service, handle, or local database key. Accounts with the same principal_id at different station_id values are permanently distinct. Principal equality MUST NOT establish account equivalence or any permission inheritance, merging, delegation, substitution or recovery relationship. Account-scoped authority requires independent authorization for the exact AccountId. Permanent loss of a Station does not permit its accounts or PCR lineages to migrate to or revive at another Station; Realm takeover and RealmCommit recovery do not waive this boundary. See models/common-fields.md section 4.2.

* principal_id · string · $ref #/$defs/did_core_id

Canonical stable DID-derived identity core. The lowercase DID method name follows ak:did_core:, and the remaining method-adapter-defined core is opaque to generic consumers. The did:web v1 adapter uses the complete canonical method-specific-id, never a digest or truncated host. Principal-core and service-core equality is byte-for-byte equality of the complete did_core_id. Event actor and Realm membership equality instead use the complete closed ActorId, and account-scoped equality uses the complete AccountId; neither may be reduced to a principal core. A did_core_id is not a DID and cannot be resolved without a did or AuthenticatedServiceResolution.

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

* station_id · string · $ref #/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

sender_device_id · string · $ref #/$defs/device_id

Authoring human device. Exactly one sender endpoint branch is present: sender_account_id plus this field, the complete sender_agent_* triple, or sender_id. An Agent runtime has no device identity and MUST NOT be disguised as an ak:device; the restricted Station materializer likewise has a service identity rather than a fake device.

pattern: ^ak:device:[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$

sender_agent_id · string · $ref #/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

sender_agent_verification_method · string · $ref ./common-ids.schema.json#/$defs/did_url

Arkret verification-method DID URL profile (identity/did-usage-and-verification.md section 2.2): lowercase method name, no query, required fragment, fragment limited to ASCII [A-Za-z0-9._:-]. Every verification_method-family field and every kid/key_ref a schema declares to be a DID URL MUST resolve to exactly this definition; values compare byte-for-byte with no URI normalization or percent-decoding.

pattern: ^did:[a-z0-9]+:[^\s#?]+#[A-Za-z0-9._:-]+$

sender_agent_key_authorize_event_id · string · $ref ./common-ids.schema.json#/$defs/event_id

Complete Arkret Event cryptographic identity. The suffix is the canonical unpadded Base64URL encoding of exactly 33 octets: fixed current-v1 suite code 0x01 followed by all 32 octets of the SHA-256 Event digest. Regex validation is only lexical; receivers MUST decode, require 33 octets, require byte 0 == 0x01, canonical re-encode, and verify the full digest before use. Other registered digest suites remain available only to the typed domains that explicitly select them and MUST NOT appear in Event IDs.

pattern: ^ak:event:[A-Za-z0-9_-]{44}$

sender_id · string · $ref #/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

* recipient_account_id · object · $ref ./common-ids.schema.json#/$defs/account_id

* principal_id · string · $ref #/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

* station_id · string · $ref #/$defs/did_core_id

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

* recipient_device_id · string · $ref #/$defs/device_id

pattern: ^ak:device:[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$

* sent_at · string (date-time) · format=date-time · $ref #/$defs/timestamp

Canonical Arkret-owned absolute instant. UTC Z form with exactly three millisecond digits. Whole seconds MUST use .000Z; offsets, missing/finer fractions, lowercase separators, leap seconds, and invalid Gregorian calendar dates are forbidden. Shape validation by this pattern is supplemented by semantic date validation.

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

* expires_at · string (date-time) · format=date-time · $ref #/$defs/timestamp

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

* content · object

unsigned · object

Optional non-authenticated metadata block (transport-layer hints only). Receivers MUST NOT trust any field here for authorization, ordering, or cryptographic verification. Typical sub-fields: progress (delivery progress hint), error_context (transport-layer error diagnostics), retry_after_ms. By convention this block is excluded from the signed transcript of the enclosing transport envelope and is dropped on persist.

Source

registry row: spec/v1/artifacts/registry/schema-registry.json
schema document: spec/v1/artifacts/schemas/device-message.schema.json