ak.schema.device_revocation_state.v1

← Schemas

Arkret Durable Device Revocation State

ak.schema.device_revocation_state.v1 · file: schemas/device-revocation-state.schema.json

Durable exact-device revocation fence. A receiver that knows this authenticated pending/revoked state blocks affected new live actions locally. Unknown remote revocation can have a propagation window for ordinary data. Fresh proof issue is not a separate Event admission action. Terminal safety outcomes preserve exact transaction, authorization and generation binding.

* $ · oneOf[1]

Durable exact-device revocation fence. A receiver that knows this authenticated pending/revoked state blocks affected new live actions locally. Unknown remote revocation can have a propagation window for ordinary data. Fresh proof issue is not a separate Event admission action. Terminal safety outcomes preserve exact transaction, authorization and generation binding.

oneOf · oneOf[0] · oneOf[3] · $ref #/$defs/device_revocation_record

oneOf · oneOf[0] · allOf[2] · $ref #/$defs/device_revocation_pending_state

allOf · allOf[0] · object · $ref #/$defs/common_record

* schema · const "ak.schema.device_revocation_state.v1"

enum: "ak.schema.device_revocation_state.v1"

* account_id · object · $ref #/$defs/account_id

Complete protocol identity for a principal at one Station, including human, Agent, Applet-managed Ghost and integration accounts. It does not imply a human login, provisioning workflow, credential class or authorization. Equality is byte-for-byte equality of both canonical did_core_id components; neither component may be inferred from a DID Document, route, session audience, current service, handle, or local database key. Accounts with the same principal_id at different station_id values are permanently distinct. Principal equality MUST NOT establish account equivalence or any permission inheritance, merging, delegation, substitution or recovery relationship. Account-scoped authority requires independent authorization for the exact AccountId. Permanent loss of a Station does not permit its accounts or PCR lineages to migrate to or revive at another Station; Realm takeover and RealmCommit recovery do not waive this boundary. See models/common-fields.md section 4.2.

* principal_id · $ref #/$defs/did_core_id · $ref #/$defs/did_core_id

* station_id · $ref #/$defs/did_core_id · $ref #/$defs/did_core_id

* device_id · string · $ref ./common-ids.schema.json#/$defs/device_id

pattern: ^ak:device:[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$

* target_device_authorize_event_id · string · $ref ./common-ids.schema.json#/$defs/event_id

Complete Arkret Event cryptographic identity. The suffix is the canonical unpadded Base64URL encoding of exactly 33 octets: fixed current-v1 suite code 0x01 followed by all 32 octets of the SHA-256 Event digest. Regex validation is only lexical; receivers MUST decode, require 33 octets, require byte 0 == 0x01, canonical re-encode, and verify the full digest before use. Other registered digest suites remain available only to the typed domains that explicitly select them and MUST NOT appear in Event IDs.

pattern: ^ak:event:[A-Za-z0-9_-]{44}$

* target_device_generation_ref · integer · $ref #/$defs/device_generation_ref

* proposal_event_id · string · $ref ./common-ids.schema.json#/$defs/event_id

Complete Arkret Event cryptographic identity. The suffix is the canonical unpadded Base64URL encoding of exactly 33 octets: fixed current-v1 suite code 0x01 followed by all 32 octets of the SHA-256 Event digest. Regex validation is only lexical; receivers MUST decode, require 33 octets, require byte 0 == 0x01, canonical re-encode, and verify the full digest before use. Other registered digest suites remain available only to the typed domains that explicitly select them and MUST NOT appear in Event IDs.

pattern: ^ak:event:[A-Za-z0-9_-]{44}$

* accepted_at · string (date-time) · format=date-time · $ref #/$defs/timestamp

Canonical Arkret-owned absolute instant. UTC Z form with exactly three millisecond digits. Whole seconds MUST use .000Z; offsets, missing/finer fractions, lowercase separators, leap seconds, and invalid Gregorian calendar dates are forbidden. Shape validation by this pattern is supplemented by semantic date validation.

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

* acceptance_seq · integer

Monotonic sequence assigned by the origin Station in the same atomic commit as accepted_at and the pending index.

allOf · allOf[1] · object

* status · const "revocation_pending"

enum: "revocation_pending"

* denied_actions · array · $ref #/$defs/denied_actions

Closed canonical action-class list blocked by revocation_pending on every deployment.

[0] · const "session_grant_issue_or_refresh"

enum: "session_grant_issue_or_refresh"

[1] · const "device_pairing_code_claim"

enum: "device_pairing_code_claim"

[2] · const "keypackage_claim"

enum: "keypackage_claim"

[3] · const "to_device_write"

enum: "to_device_write"

[4] · const "event_write"

enum: "event_write"

oneOf · oneOf[1] · allOf[2] · $ref #/$defs/device_revocation_rejected_state

allOf · allOf[0] · object · $ref #/$defs/common_record

* schema · const "ak.schema.device_revocation_state.v1"

enum: "ak.schema.device_revocation_state.v1"

* account_id · object · $ref #/$defs/account_id

Complete protocol identity for a principal at one Station, including human, Agent, Applet-managed Ghost and integration accounts. It does not imply a human login, provisioning workflow, credential class or authorization. Equality is byte-for-byte equality of both canonical did_core_id components; neither component may be inferred from a DID Document, route, session audience, current service, handle, or local database key. Accounts with the same principal_id at different station_id values are permanently distinct. Principal equality MUST NOT establish account equivalence or any permission inheritance, merging, delegation, substitution or recovery relationship. Account-scoped authority requires independent authorization for the exact AccountId. Permanent loss of a Station does not permit its accounts or PCR lineages to migrate to or revive at another Station; Realm takeover and RealmCommit recovery do not waive this boundary. See models/common-fields.md section 4.2.

* principal_id · $ref #/$defs/did_core_id · $ref #/$defs/did_core_id

* station_id · $ref #/$defs/did_core_id · $ref #/$defs/did_core_id

* device_id · string · $ref ./common-ids.schema.json#/$defs/device_id

pattern: ^ak:device:[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$

* target_device_authorize_event_id · string · $ref ./common-ids.schema.json#/$defs/event_id

Complete Arkret Event cryptographic identity. The suffix is the canonical unpadded Base64URL encoding of exactly 33 octets: fixed current-v1 suite code 0x01 followed by all 32 octets of the SHA-256 Event digest. Regex validation is only lexical; receivers MUST decode, require 33 octets, require byte 0 == 0x01, canonical re-encode, and verify the full digest before use. Other registered digest suites remain available only to the typed domains that explicitly select them and MUST NOT appear in Event IDs.

pattern: ^ak:event:[A-Za-z0-9_-]{44}$

* target_device_generation_ref · integer · $ref #/$defs/device_generation_ref

* proposal_event_id · string · $ref ./common-ids.schema.json#/$defs/event_id

Complete Arkret Event cryptographic identity. The suffix is the canonical unpadded Base64URL encoding of exactly 33 octets: fixed current-v1 suite code 0x01 followed by all 32 octets of the SHA-256 Event digest. Regex validation is only lexical; receivers MUST decode, require 33 octets, require byte 0 == 0x01, canonical re-encode, and verify the full digest before use. Other registered digest suites remain available only to the typed domains that explicitly select them and MUST NOT appear in Event IDs.

pattern: ^ak:event:[A-Za-z0-9_-]{44}$

* accepted_at · string (date-time) · format=date-time · $ref #/$defs/timestamp

Canonical Arkret-owned absolute instant. UTC Z form with exactly three millisecond digits. Whole seconds MUST use .000Z; offsets, missing/finer fractions, lowercase separators, leap seconds, and invalid Gregorian calendar dates are forbidden. Shape validation by this pattern is supplemented by semantic date validation.

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

* acceptance_seq · integer

Monotonic sequence assigned by the origin Station in the same atomic commit as accepted_at and the pending index.

allOf · allOf[1] · object

* status · const "revocation_rejected"

enum: "revocation_rejected"

oneOf · oneOf[2] · allOf[2] · $ref #/$defs/device_revoked_state

allOf · allOf[0] · object · $ref #/$defs/common_record

* schema · const "ak.schema.device_revocation_state.v1"

enum: "ak.schema.device_revocation_state.v1"

* account_id · object · $ref #/$defs/account_id

Complete protocol identity for a principal at one Station, including human, Agent, Applet-managed Ghost and integration accounts. It does not imply a human login, provisioning workflow, credential class or authorization. Equality is byte-for-byte equality of both canonical did_core_id components; neither component may be inferred from a DID Document, route, session audience, current service, handle, or local database key. Accounts with the same principal_id at different station_id values are permanently distinct. Principal equality MUST NOT establish account equivalence or any permission inheritance, merging, delegation, substitution or recovery relationship. Account-scoped authority requires independent authorization for the exact AccountId. Permanent loss of a Station does not permit its accounts or PCR lineages to migrate to or revive at another Station; Realm takeover and RealmCommit recovery do not waive this boundary. See models/common-fields.md section 4.2.

* principal_id · $ref #/$defs/did_core_id · $ref #/$defs/did_core_id

* station_id · $ref #/$defs/did_core_id · $ref #/$defs/did_core_id

* device_id · string · $ref ./common-ids.schema.json#/$defs/device_id

pattern: ^ak:device:[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$

* target_device_authorize_event_id · string · $ref ./common-ids.schema.json#/$defs/event_id

Complete Arkret Event cryptographic identity. The suffix is the canonical unpadded Base64URL encoding of exactly 33 octets: fixed current-v1 suite code 0x01 followed by all 32 octets of the SHA-256 Event digest. Regex validation is only lexical; receivers MUST decode, require 33 octets, require byte 0 == 0x01, canonical re-encode, and verify the full digest before use. Other registered digest suites remain available only to the typed domains that explicitly select them and MUST NOT appear in Event IDs.

pattern: ^ak:event:[A-Za-z0-9_-]{44}$

* target_device_generation_ref · integer · $ref #/$defs/device_generation_ref

* proposal_event_id · string · $ref ./common-ids.schema.json#/$defs/event_id

Complete Arkret Event cryptographic identity. The suffix is the canonical unpadded Base64URL encoding of exactly 33 octets: fixed current-v1 suite code 0x01 followed by all 32 octets of the SHA-256 Event digest. Regex validation is only lexical; receivers MUST decode, require 33 octets, require byte 0 == 0x01, canonical re-encode, and verify the full digest before use. Other registered digest suites remain available only to the typed domains that explicitly select them and MUST NOT appear in Event IDs.

pattern: ^ak:event:[A-Za-z0-9_-]{44}$

* accepted_at · string (date-time) · format=date-time · $ref #/$defs/timestamp

Canonical Arkret-owned absolute instant. UTC Z form with exactly three millisecond digits. Whole seconds MUST use .000Z; offsets, missing/finer fractions, lowercase separators, leap seconds, and invalid Gregorian calendar dates are forbidden. Shape validation by this pattern is supplemented by semantic date validation.

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

* acceptance_seq · integer

Monotonic sequence assigned by the origin Station in the same atomic commit as accepted_at and the pending index.

allOf · allOf[1] · object

* status · const "revoked"

enum: "revoked"

* committed_at · string (date-time) · format=date-time · $ref #/$defs/timestamp

Canonical Arkret-owned absolute instant. UTC Z form with exactly three millisecond digits. Whole seconds MUST use .000Z; offsets, missing/finer fractions, lowercase separators, leap seconds, and invalid Gregorian calendar dates are forbidden. Shape validation by this pattern is supplemented by semantic date validation.

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

Source

• registry row: spec/v1/artifacts/registry/schema-registry.json
• schema document: spec/v1/artifacts/schemas/device-revocation-state.schema.json