ak.schema.invite_delivery.v1

Arkret Invite Delivery

ak.schema.invite_delivery.v1 · file: schemas/invite-delivery.schema.json

Actor-private plaintext account-data typed current result value containing delivered directed-invite references and untrusted authority-bundle locator hints. It is not part of Realm history and carries no bearer credential.

* $ · object

* schema · const "ak.schema.invite_delivery.v1"

enum: "ak.schema.invite_delivery.v1"

* updated_at · string (date-time) · format=date-time · $ref ./time.schema.json#/$defs/timestamp

Canonical Arkret-owned absolute instant. UTC Z form with exactly three millisecond digits. Whole seconds MUST use .000Z; offsets, missing/finer fractions, lowercase separators, leap seconds, and invalid Gregorian calendar dates are forbidden. Shape validation by this pattern is supplemented by semantic date validation.

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

* delivery_entries · array<$ref #/$defs/delivery_entry>

Bounded register of delivered directed invites, oldest first. At most one entry per invite_id; a redelivery of the same invite_id replaces the previous entry. Entries whose expires_at has passed are purged on the next write; overflow beyond 200 evicts the oldest entries.

items · object · $ref #/$defs/delivery_entry

* invite_id · string

Invite ID derived from the accepted ak.invite.create Event; the deduplication key of this register.

pattern: ^ak:invite:[A-Za-z0-9_-]{44}$

* realm_id · string · $ref ./common-ids.schema.json#/$defs/realm_id

Retyped ak.realm.create Event token. It therefore carries the same fixed current-v1 0x01/SHA-256 content-address identity and is not selected by Realm state.

pattern: ^ak:realm:[A-Za-z0-9_-]{44}$

* inviter_account_id · object · $ref ./common-ids.schema.json#/$defs/account_id

Complete protocol identity for a principal at one Station, including human, Agent, Applet-managed Ghost and integration accounts. It does not imply a human login, provisioning workflow, credential class or authorization. Equality is byte-for-byte equality of both canonical did_core_id components; neither component may be inferred from a DID Document, route, session audience, current service, handle, or local database key. Accounts with the same principal_id at different station_id values are permanently distinct. Principal equality MUST NOT establish account equivalence or any permission inheritance, merging, delegation, substitution or recovery relationship. Account-scoped authority requires independent authorization for the exact AccountId. Permanent loss of a Station does not permit its accounts or PCR lineages to migrate to or revive at another Station; Realm takeover and RealmCommit recovery do not waive this boundary. See models/common-fields.md section 4.2.

* principal_id · $ref #/$defs/did_core_id · $ref #/$defs/did_core_id

* station_id · $ref #/$defs/did_core_id · $ref #/$defs/did_core_id

* authority_locator_hints · array<$ref ./realm-join-candidate.schema.json>

One to eight untrusted locator cores, strictly sorted by service_id UTF-8 bytes. service_id is the semantic identity key; duplicate or conflicting representations of one service_id invalidate the entire array. The invitee's own Station must fetch and verify a nonce-bound RealmAuthorityBundle before any preview, join preparation, or bootstrap request.

items · object · $ref ./realm-join-candidate.schema.json

A closed, untrusted locator core for obtaining a nonce-bound RealmAuthorityBundle. Realm scope and freshness belong to the enclosing carrier and current assertion. The core carries no proof, authority assertion, governance history, operation advertisement, preference, or trust level; only a verified genesis, continuous handoff chain, and valid nonce-bound current assertion can identify the current governance Station.

* service_kind · string (enum)

enum: "station"

* service_id · string · $ref ./common-ids.schema.json#/$defs/did_core_id

Canonical stable DID-derived identity core. The lowercase DID method name follows ak:did_core:, and the remaining method-adapter-defined core is opaque to generic consumers. The did:web v1 adapter uses the complete canonical method-specific-id, never a digest or truncated host. Principal-core and service-core equality is byte-for-byte equality of the complete did_core_id. Event actor and Realm membership equality instead use the complete closed ActorId, and account-scoped equality uses the complete AccountId; neither may be reduced to a principal core. A did_core_id is not a DID and cannot be resolved without a did or AuthenticatedServiceResolution.

pattern: ^ak:did_core:[a-z0-9]+:[^\s/?#]+$

endpoint_url · string (uri) · format=uri

pattern: ^https://

* source · string (enum)

enum: "invite" "directory" "cache"

* received_at · string (date-time) · format=date-time · $ref ./time.schema.json#/$defs/timestamp

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

* expires_at · string (date-time) · format=date-time · $ref ./time.schema.json#/$defs/timestamp

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

Source

registry row: spec/v1/artifacts/registry/schema-registry.json
schema document: spec/v1/artifacts/schemas/invite-delivery.schema.json