ak.schema.mls_welcome_delivery.v1

← Schemas

Arkret MLS Welcome Delivery

ak.schema.mls_welcome_delivery.v1 · file: schemas/mls-welcome-delivery.schema.json

Producer-signed recipient delivery queued atomically with its winning MLS Commit. This is not a shared Realm Event and does not receive an independent RealmCommit.

* $ · object

Producer-signed recipient delivery queued atomically with its winning MLS Commit. This is not a shared Realm Event and does not receive an independent RealmCommit.

* welcome_id · string · $ref ./common-ids.schema.json#/$defs/mls_welcome_delivery_id

pattern: ^ak:mls_welcome_delivery:[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$

* realm_id · string · $ref ./common-ids.schema.json#/$defs/realm_id

Retyped ak.realm.create Event token. It therefore carries the same fixed current-v1 0x01/SHA-256 content-address identity and is not selected by Realm state.

pattern: ^ak:realm:[A-Za-z0-9_-]{44}$

* effective_scope · oneOf[4] · $ref ./event-envelope.schema.json#/$defs/scope_ref

oneOf · oneOf[0] · object

* kind · const "realm"

enum: "realm"

* realm_id · string · $ref ./common-ids.schema.json#/$defs/realm_id

Retyped ak.realm.create Event token. It therefore carries the same fixed current-v1 0x01/SHA-256 content-address identity and is not selected by Realm state.

pattern: ^ak:realm:[A-Za-z0-9_-]{44}$

oneOf · oneOf[1] · object

* kind · const "circle"

enum: "circle"

* realm_id · string · $ref ./common-ids.schema.json#/$defs/realm_id

Retyped ak.realm.create Event token. It therefore carries the same fixed current-v1 0x01/SHA-256 content-address identity and is not selected by Realm state.

pattern: ^ak:realm:[A-Za-z0-9_-]{44}$

* circle_id · string · $ref ./common-ids.schema.json#/$defs/circle_id

pattern: ^ak:circle:[A-Za-z0-9_-]{44}$

oneOf · oneOf[2] · object

Native controller-and-owned-Agents private scope. It is not a Circle and has no editable membership.

* kind · const "sidecar"

enum: "sidecar"

* realm_id · string · $ref ./common-ids.schema.json#/$defs/realm_id

Retyped ak.realm.create Event token. It therefore carries the same fixed current-v1 0x01/SHA-256 content-address identity and is not selected by Realm state.

pattern: ^ak:realm:[A-Za-z0-9_-]{44}$

* sidecar_id · string · $ref ./common-ids.schema.json#/$defs/sidecar_id

pattern: ^ak:sidecar:[A-Za-z0-9_-]{44}$

oneOf · oneOf[3] · object

Genesis scope for ak.realm.create only. It carries no realm_id because the receiver derives every Realm id, including Collaboration, Direct Conversation, human PCR, and Agent PCR, as retype(event_id, "realm") from this create Event (zh/models/realm-and-space.md section 2.5.0). The uniform omission also prevents the digest cycle.

* kind · const "realm_genesis"

enum: "realm_genesis"

* commit_event_ref · string · $ref ./common-ids.schema.json#/$defs/event_id

Complete Arkret Event cryptographic identity. The suffix is the canonical unpadded Base64URL encoding of exactly 33 octets: fixed current-v1 suite code 0x01 followed by all 32 octets of the SHA-256 Event digest. Regex validation is only lexical; receivers MUST decode, require 33 octets, require byte 0 == 0x01, canonical re-encode, and verify the full digest before use. Other registered digest suites remain available only to the typed domains that explicitly select them and MUST NOT appear in Event IDs.

pattern: ^ak:event:[A-Za-z0-9_-]{44}$

* recipient_actor_id · oneOf[2] · $ref ./common-ids.schema.json#/$defs/actor_id

Complete protocol identity for an Event author or Realm member: account carries the exact AccountId for every Station-hosted principal; service identifies a service acting as itself. The discriminator is validated against accepted registration and admission evidence; it never authorizes itself. Account and service are distinct, and no comparison may fall back to a bare principal_id. Agent and integration classification, provisioning, controller binding and credential authorization are independently verified facts, not identity variants. Account actors at different Stations MUST NOT share or inherit authority merely because their principal_id, DID controller or signing key matches, including membership, capability, RealmCommit-signing and recovery authority.

oneOf · oneOf[0] · object

* kind · const "account"

enum: "account"

* account_id · $ref #/$defs/account_id · $ref #/$defs/account_id

oneOf · oneOf[1] · object

* kind · const "service"

enum: "service"

* service_id · $ref #/$defs/did_core_id · $ref #/$defs/did_core_id

* recipient_endpoint · oneOf[2]

oneOf · oneOf[0] · object

* kind · const "device"

enum: "device"

* device_id · string · $ref ./common-ids.schema.json#/$defs/device_id

pattern: ^ak:device:[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$

oneOf · oneOf[1] · object

* kind · const "agent_runtime"

enum: "agent_runtime"

* verification_method · string · $ref ./common-ids.schema.json#/$defs/did_url

Arkret verification-method DID URL profile (identity/did-usage-and-verification.md section 2.2): lowercase method name, no query, required fragment, fragment limited to ASCII [A-Za-z0-9._:-]. Every verification_method-family field and every kid/key_ref a schema declares to be a DID URL MUST resolve to exactly this definition; values compare byte-for-byte with no URI normalization or percent-decoding.

pattern: ^did:[a-z0-9]+:[^\s#?]+#[A-Za-z0-9._:-]+$

* keypackage_claim_ref · string

pattern: ^ak:keypackage_claim:[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$

* ciphertext_b64 · string

pattern: ^[A-Za-z0-9_-]+$

* producer_proof · allOf[2] · $ref ./detached-object-signature.schema.json#/$defs/mls_welcome_delivery_signature

allOf · allOf[0] · object · $ref #

Producer-signed recipient delivery queued atomically with its winning MLS Commit. This is not a shared Realm Event and does not receive an independent RealmCommit.

* welcome_id · string · $ref ./common-ids.schema.json#/$defs/mls_welcome_delivery_id

pattern: ^ak:mls_welcome_delivery:[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$

* realm_id · string · $ref ./common-ids.schema.json#/$defs/realm_id

Retyped ak.realm.create Event token. It therefore carries the same fixed current-v1 0x01/SHA-256 content-address identity and is not selected by Realm state.

pattern: ^ak:realm:[A-Za-z0-9_-]{44}$

* effective_scope · oneOf[4] · $ref ./event-envelope.schema.json#/$defs/scope_ref

oneOf · oneOf[0] · object

* kind · const "realm"

enum: "realm"

* realm_id · string · $ref ./common-ids.schema.json#/$defs/realm_id

Retyped ak.realm.create Event token. It therefore carries the same fixed current-v1 0x01/SHA-256 content-address identity and is not selected by Realm state.

pattern: ^ak:realm:[A-Za-z0-9_-]{44}$

oneOf · oneOf[1] · object

* kind · const "circle"

enum: "circle"

* realm_id · string · $ref ./common-ids.schema.json#/$defs/realm_id

Retyped ak.realm.create Event token. It therefore carries the same fixed current-v1 0x01/SHA-256 content-address identity and is not selected by Realm state.

pattern: ^ak:realm:[A-Za-z0-9_-]{44}$

* circle_id · string · $ref ./common-ids.schema.json#/$defs/circle_id

pattern: ^ak:circle:[A-Za-z0-9_-]{44}$

oneOf · oneOf[2] · object

Native controller-and-owned-Agents private scope. It is not a Circle and has no editable membership.

* kind · const "sidecar"

enum: "sidecar"

* realm_id · string · $ref ./common-ids.schema.json#/$defs/realm_id

Retyped ak.realm.create Event token. It therefore carries the same fixed current-v1 0x01/SHA-256 content-address identity and is not selected by Realm state.

pattern: ^ak:realm:[A-Za-z0-9_-]{44}$

* sidecar_id · string · $ref ./common-ids.schema.json#/$defs/sidecar_id

pattern: ^ak:sidecar:[A-Za-z0-9_-]{44}$

oneOf · oneOf[3] · object

Genesis scope for ak.realm.create only. It carries no realm_id because the receiver derives every Realm id, including Collaboration, Direct Conversation, human PCR, and Agent PCR, as retype(event_id, "realm") from this create Event (zh/models/realm-and-space.md section 2.5.0). The uniform omission also prevents the digest cycle.

* kind · const "realm_genesis"

enum: "realm_genesis"

* commit_event_ref · string · $ref ./common-ids.schema.json#/$defs/event_id

Complete Arkret Event cryptographic identity. The suffix is the canonical unpadded Base64URL encoding of exactly 33 octets: fixed current-v1 suite code 0x01 followed by all 32 octets of the SHA-256 Event digest. Regex validation is only lexical; receivers MUST decode, require 33 octets, require byte 0 == 0x01, canonical re-encode, and verify the full digest before use. Other registered digest suites remain available only to the typed domains that explicitly select them and MUST NOT appear in Event IDs.

pattern: ^ak:event:[A-Za-z0-9_-]{44}$

* recipient_actor_id · oneOf[2] · $ref ./common-ids.schema.json#/$defs/actor_id

Complete protocol identity for an Event author or Realm member: account carries the exact AccountId for every Station-hosted principal; service identifies a service acting as itself. The discriminator is validated against accepted registration and admission evidence; it never authorizes itself. Account and service are distinct, and no comparison may fall back to a bare principal_id. Agent and integration classification, provisioning, controller binding and credential authorization are independently verified facts, not identity variants. Account actors at different Stations MUST NOT share or inherit authority merely because their principal_id, DID controller or signing key matches, including membership, capability, RealmCommit-signing and recovery authority.

oneOf · oneOf[0] · object

* kind · const "account"

enum: "account"

* account_id · $ref #/$defs/account_id · $ref #/$defs/account_id

oneOf · oneOf[1] · object

* kind · const "service"

enum: "service"

* service_id · $ref #/$defs/did_core_id · $ref #/$defs/did_core_id

* recipient_endpoint · oneOf[2]

oneOf · oneOf[0] · object

* kind · const "device"

enum: "device"

* device_id · string · $ref ./common-ids.schema.json#/$defs/device_id

pattern: ^ak:device:[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$

oneOf · oneOf[1] · object

* kind · const "agent_runtime"

enum: "agent_runtime"

* verification_method · string · $ref ./common-ids.schema.json#/$defs/did_url

Arkret verification-method DID URL profile (identity/did-usage-and-verification.md section 2.2): lowercase method name, no query, required fragment, fragment limited to ASCII [A-Za-z0-9._:-]. Every verification_method-family field and every kid/key_ref a schema declares to be a DID URL MUST resolve to exactly this definition; values compare byte-for-byte with no URI normalization or percent-decoding.

pattern: ^did:[a-z0-9]+:[^\s#?]+#[A-Za-z0-9._:-]+$

* keypackage_claim_ref · string

pattern: ^ak:keypackage_claim:[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$

* ciphertext_b64 · string

pattern: ^[A-Za-z0-9_-]+$

* producer_proof · allOf[2] · $ref ./detached-object-signature.schema.json#/$defs/mls_welcome_delivery_signature

allOf · allOf[0] · object · $ref #

Producer-signed recipient delivery queued atomically with its winning MLS Commit. This is not a shared Realm Event and does not receive an independent RealmCommit.

* welcome_id · string · $ref ./common-ids.schema.json#/$defs/mls_welcome_delivery_id

pattern: ^ak:mls_welcome_delivery:[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$

* realm_id · string · $ref ./common-ids.schema.json#/$defs/realm_id

Retyped ak.realm.create Event token. It therefore carries the same fixed current-v1 0x01/SHA-256 content-address identity and is not selected by Realm state.

pattern: ^ak:realm:[A-Za-z0-9_-]{44}$

* effective_scope · oneOf[4] · $ref ./event-envelope.schema.json#/$defs/scope_ref

oneOf · oneOf[0] · object

* kind · const "realm"

enum: "realm"

* realm_id · string · $ref ./common-ids.schema.json#/$defs/realm_id

Retyped ak.realm.create Event token. It therefore carries the same fixed current-v1 0x01/SHA-256 content-address identity and is not selected by Realm state.

pattern: ^ak:realm:[A-Za-z0-9_-]{44}$

oneOf · oneOf[1] · object

* kind · const "circle"

enum: "circle"

* realm_id · string · $ref ./common-ids.schema.json#/$defs/realm_id

Retyped ak.realm.create Event token. It therefore carries the same fixed current-v1 0x01/SHA-256 content-address identity and is not selected by Realm state.

pattern: ^ak:realm:[A-Za-z0-9_-]{44}$

* circle_id · string · $ref ./common-ids.schema.json#/$defs/circle_id

pattern: ^ak:circle:[A-Za-z0-9_-]{44}$

oneOf · oneOf[2] · object

Native controller-and-owned-Agents private scope. It is not a Circle and has no editable membership.

* kind · const "sidecar"

enum: "sidecar"

* realm_id · string · $ref ./common-ids.schema.json#/$defs/realm_id

Retyped ak.realm.create Event token. It therefore carries the same fixed current-v1 0x01/SHA-256 content-address identity and is not selected by Realm state.

pattern: ^ak:realm:[A-Za-z0-9_-]{44}$

* sidecar_id · string · $ref ./common-ids.schema.json#/$defs/sidecar_id

pattern: ^ak:sidecar:[A-Za-z0-9_-]{44}$

oneOf · oneOf[3] · object

Genesis scope for ak.realm.create only. It carries no realm_id because the receiver derives every Realm id, including Collaboration, Direct Conversation, human PCR, and Agent PCR, as retype(event_id, "realm") from this create Event (zh/models/realm-and-space.md section 2.5.0). The uniform omission also prevents the digest cycle.

* kind · const "realm_genesis"

enum: "realm_genesis"

* commit_event_ref · string · $ref ./common-ids.schema.json#/$defs/event_id

Complete Arkret Event cryptographic identity. The suffix is the canonical unpadded Base64URL encoding of exactly 33 octets: fixed current-v1 suite code 0x01 followed by all 32 octets of the SHA-256 Event digest. Regex validation is only lexical; receivers MUST decode, require 33 octets, require byte 0 == 0x01, canonical re-encode, and verify the full digest before use. Other registered digest suites remain available only to the typed domains that explicitly select them and MUST NOT appear in Event IDs.

pattern: ^ak:event:[A-Za-z0-9_-]{44}$

* recipient_actor_id · oneOf[2] · $ref ./common-ids.schema.json#/$defs/actor_id

Complete protocol identity for an Event author or Realm member: account carries the exact AccountId for every Station-hosted principal; service identifies a service acting as itself. The discriminator is validated against accepted registration and admission evidence; it never authorizes itself. Account and service are distinct, and no comparison may fall back to a bare principal_id. Agent and integration classification, provisioning, controller binding and credential authorization are independently verified facts, not identity variants. Account actors at different Stations MUST NOT share or inherit authority merely because their principal_id, DID controller or signing key matches, including membership, capability, RealmCommit-signing and recovery authority.

oneOf · oneOf[0] · object

* kind · const "account"

enum: "account"

* account_id · $ref #/$defs/account_id · $ref #/$defs/account_id

oneOf · oneOf[1] · object

* kind · const "service"

enum: "service"

* service_id · $ref #/$defs/did_core_id · $ref #/$defs/did_core_id

* recipient_endpoint · oneOf[2]

oneOf · oneOf[0] · object

* kind · const "device"

enum: "device"

* device_id · string · $ref ./common-ids.schema.json#/$defs/device_id

pattern: ^ak:device:[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$

oneOf · oneOf[1] · object

* kind · const "agent_runtime"

enum: "agent_runtime"

* verification_method · string · $ref ./common-ids.schema.json#/$defs/did_url

Arkret verification-method DID URL profile (identity/did-usage-and-verification.md section 2.2): lowercase method name, no query, required fragment, fragment limited to ASCII [A-Za-z0-9._:-]. Every verification_method-family field and every kid/key_ref a schema declares to be a DID URL MUST resolve to exactly this definition; values compare byte-for-byte with no URI normalization or percent-decoding.

pattern: ^did:[a-z0-9]+:[^\s#?]+#[A-Za-z0-9._:-]+$

* keypackage_claim_ref · string

pattern: ^ak:keypackage_claim:[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$

* ciphertext_b64 · string

pattern: ^[A-Za-z0-9_-]+$

* producer_proof · allOf[2] · $ref ./detached-object-signature.schema.json#/$defs/mls_welcome_delivery_signature

allOf · allOf[0] · object · $ref #

Producer-signed recipient delivery queued atomically with its winning MLS Commit. This is not a shared Realm Event and does not receive an independent RealmCommit.

* welcome_id · string · $ref ./common-ids.schema.json#/$defs/mls_welcome_delivery_id

pattern: ^ak:mls_welcome_delivery:[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$

* realm_id · string · $ref ./common-ids.schema.json#/$defs/realm_id

Retyped ak.realm.create Event token. It therefore carries the same fixed current-v1 0x01/SHA-256 content-address identity and is not selected by Realm state.

pattern: ^ak:realm:[A-Za-z0-9_-]{44}$

* effective_scope · oneOf[4] · $ref ./event-envelope.schema.json#/$defs/scope_ref

oneOf · oneOf[0] · object

* kind · …

recursion truncated at depth 8; see source schema for full shape

* realm_id · …

recursion truncated at depth 8; see source schema for full shape

oneOf · oneOf[1] · object

* kind · …

recursion truncated at depth 8; see source schema for full shape

* realm_id · …

recursion truncated at depth 8; see source schema for full shape

* circle_id · …

recursion truncated at depth 8; see source schema for full shape

oneOf · oneOf[2] · object

Native controller-and-owned-Agents private scope. It is not a Circle and has no editable membership.

* kind · …

recursion truncated at depth 8; see source schema for full shape

* realm_id · …

recursion truncated at depth 8; see source schema for full shape

* sidecar_id · …

recursion truncated at depth 8; see source schema for full shape

oneOf · oneOf[3] · object

Genesis scope for ak.realm.create only. It carries no realm_id because the receiver derives every Realm id, including Collaboration, Direct Conversation, human PCR, and Agent PCR, as retype(event_id, "realm") from this create Event (zh/models/realm-and-space.md section 2.5.0). The uniform omission also prevents the digest cycle.

* kind · …

recursion truncated at depth 8; see source schema for full shape

* commit_event_ref · string · $ref ./common-ids.schema.json#/$defs/event_id

Complete Arkret Event cryptographic identity. The suffix is the canonical unpadded Base64URL encoding of exactly 33 octets: fixed current-v1 suite code 0x01 followed by all 32 octets of the SHA-256 Event digest. Regex validation is only lexical; receivers MUST decode, require 33 octets, require byte 0 == 0x01, canonical re-encode, and verify the full digest before use. Other registered digest suites remain available only to the typed domains that explicitly select them and MUST NOT appear in Event IDs.

pattern: ^ak:event:[A-Za-z0-9_-]{44}$

* recipient_actor_id · oneOf[2] · $ref ./common-ids.schema.json#/$defs/actor_id

Complete protocol identity for an Event author or Realm member: account carries the exact AccountId for every Station-hosted principal; service identifies a service acting as itself. The discriminator is validated against accepted registration and admission evidence; it never authorizes itself. Account and service are distinct, and no comparison may fall back to a bare principal_id. Agent and integration classification, provisioning, controller binding and credential authorization are independently verified facts, not identity variants. Account actors at different Stations MUST NOT share or inherit authority merely because their principal_id, DID controller or signing key matches, including membership, capability, RealmCommit-signing and recovery authority.

oneOf · oneOf[0] · object

* kind · …

recursion truncated at depth 8; see source schema for full shape

* account_id · …

recursion truncated at depth 8; see source schema for full shape

oneOf · oneOf[1] · object

* kind · …

recursion truncated at depth 8; see source schema for full shape

* service_id · …

recursion truncated at depth 8; see source schema for full shape

* recipient_endpoint · oneOf[2]

oneOf · oneOf[0] · object

* kind · …

recursion truncated at depth 8; see source schema for full shape

* device_id · …

recursion truncated at depth 8; see source schema for full shape

oneOf · oneOf[1] · object

* kind · …

recursion truncated at depth 8; see source schema for full shape

* verification_method · …

recursion truncated at depth 8; see source schema for full shape

* keypackage_claim_ref · string

pattern: ^ak:keypackage_claim:[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$

* ciphertext_b64 · string

pattern: ^[A-Za-z0-9_-]+$

* producer_proof · allOf[2] · $ref ./detached-object-signature.schema.json#/$defs/mls_welcome_delivery_signature

allOf · allOf[0] · object · $ref #

Producer-signed recipient delivery queued atomically with its winning MLS Commit. This is not a shared Realm Event and does not receive an independent RealmCommit.

* welcome_id · …

recursion truncated at depth 8; see source schema for full shape

* realm_id · …

recursion truncated at depth 8; see source schema for full shape

* effective_scope · …

recursion truncated at depth 8; see source schema for full shape

* commit_event_ref · …

recursion truncated at depth 8; see source schema for full shape

* recipient_actor_id · …

recursion truncated at depth 8; see source schema for full shape

* recipient_endpoint · …

recursion truncated at depth 8; see source schema for full shape

* keypackage_claim_ref · …

recursion truncated at depth 8; see source schema for full shape

* ciphertext_b64 · …

recursion truncated at depth 8; see source schema for full shape

* producer_proof · …

recursion truncated at depth 8; see source schema for full shape

allOf · allOf[1] · object

context · …

recursion truncated at depth 8; see source schema for full shape

allOf · allOf[1] · object

context · const "ak.mls_welcome_delivery_signature.v1"

enum: "ak.mls_welcome_delivery_signature.v1"

allOf · allOf[1] · object

context · const "ak.mls_welcome_delivery_signature.v1"

enum: "ak.mls_welcome_delivery_signature.v1"

allOf · allOf[1] · object

context · const "ak.mls_welcome_delivery_signature.v1"

enum: "ak.mls_welcome_delivery_signature.v1"

Source

• registry row: spec/v1/artifacts/registry/schema-registry.json
• schema document: spec/v1/artifacts/schemas/mls-welcome-delivery.schema.json