跳转到内容

ak.schema.principal_locator.v1

← Schemas

Arkret Principal Locator
ak.schema.principal_locator.v1 · file: schemas/principal-locator.schema.json

Signed online locator returned from a holder-controlled Station locator ref. It asserts an exact AccountId and current first-hop route used for private invite delivery; it is not a Realm membership grant and cannot alter account identity.

* $ · object
Signed online locator returned from a holder-controlled Station locator ref. It asserts an exact AccountId and current first-hop route used for private invite delivery; it is not a Realm membership grant and cannot alter account identity.
* schema · const "ak.schema.principal_locator.v1"
enum: "ak.schema.principal_locator.v1"
* account_id · object · $ref ./common-ids.schema.json#/$defs/account_id
Complete protocol identity for a principal at one Station, including human, Agent, Applet-managed Ghost and integration accounts. It does not imply a human login, provisioning workflow, credential class or authorization. Equality is byte-for-byte equality of both canonical did_core_id components; neither component may be inferred from a DID Document, route, session audience, current service, handle, or local database key. Accounts with the same principal_id at different station_id values are permanently distinct. Principal equality MUST NOT establish account equivalence or any permission inheritance, merging, delegation, substitution or recovery relationship. Account-scoped authority requires independent authorization for the exact AccountId. Permanent loss of a Station does not permit its accounts or PCR lineages to migrate to or revive at another Station; Realm takeover and RealmCommit recovery do not waive this boundary. See models/common-fields.md section 4.2.
* principal_id · $ref #/$defs/did_core_id · $ref #/$defs/did_core_id
* station_id · $ref #/$defs/did_core_id · $ref #/$defs/did_core_id
* service_resolution · oneOf[2] · $ref ./identity-resolution.schema.json#/$defs/service_resolution_carrier
First-hop resolution material for account_id.station_id; it is covered by the locator proofs.
oneOf · oneOf[0] · object
* inline · $ref #/$defs/authenticated_service_resolution · $ref #/$defs/authenticated_service_resolution
oneOf · oneOf[1] · object
* resolution_url · string (uri) · format=uri
Bounded canonical HTTPS discovery URL for the public method evidence of the expected service. Fetch success supplies no authority or freshness.
pattern: ^https://[^?#]+$
route_assistance · object · $ref ./identity-resolution.schema.json#/$defs/route_assistance
Transport-only bounded discovery hints. They do not authorize routing, extend outer token expiry, or supply current DID state.
* mirror_hints · array<$ref #/$defs/route_mirror_hint>
At most four independently routable mirror hints. Each item carries the mirror did_core_id together with a service_resolution_carrier; bare URLs and bare core ids are not valid items.
items · $ref #/$defs/route_mirror_hint · $ref #/$defs/route_mirror_hint
* issued_at · string (date-time) · format=date-time · $ref #/$defs/timestamp
Canonical Arkret-owned absolute instant. UTC Z form with exactly three millisecond digits. Whole seconds MUST use .000Z; offsets, missing/finer fractions, lowercase separators, leap seconds, and invalid Gregorian calendar dates are forbidden. Shape validation by this pattern is supplemented by semantic date validation.
pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$
* expires_at · string (date-time) · format=date-time · $ref #/$defs/timestamp
Canonical Arkret-owned absolute instant. UTC Z form with exactly three millisecond digits. Whole seconds MUST use .000Z; offsets, missing/finer fractions, lowercase separators, leap seconds, and invalid Gregorian calendar dates are forbidden. Shape validation by this pattern is supplemented by semantic date validation.
pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$
* locator_ref_digest · string · $ref #/$defs/digest
Digest of the private locator ref material. The raw locator token MUST NOT appear in durable Realm events.
pattern: ^(sha256|blake3):[0-9a-f]{64}$
display_hint · object
UI-only display hint. It is not identity authority and MUST NOT be used for authorization.
display_name_hint · string
avatar_blob_ref · string · $ref ./common-ids.schema.json#/$defs/blob_ref
Content-addressed reference to exact Blob bytes. The embedded suite and digest are the sole wire commitment to those bytes; sibling content/ciphertext digest mirrors are forbidden.
pattern: ^ak:blob:(?:sha256|blake3):[0-9a-f]{64}$
* proofs · array<$ref #/$defs/principal_locator_proof>
At minimum contains recipient_service_acceptance. High-assurance deployments SHOULD also require subject_locator_authorization.
items · object · $ref #/$defs/principal_locator_proof
* proof_purpose · string (enum)
enum: "subject_locator_authorization" "recipient_service_acceptance"
* proof · object · $ref ./event-envelope.schema.json#/$defs/proof
Generic detached-JWS proof shape reused by non-Event schemas (snapshot signature, snapshot witness attestations, identity receipts, handle claims, etc.). MUST NOT be used as the shape of Event Envelope `producer_proof` — Event proofs reference $defs/event_proof and bind canonical Event bytes via `event_digest`. Non-Event signed objects MUST define an object-family signing-context constant and include it in the canonical proof binding object with payload_digest; the context constant is not a wire field in this generic shape. drift detection: `payload_digest#event_proof` in forbidden-wire-fields.json is the hard-reject mirror of this rule. New non-Event signed objects MAY $ref this shape; new signed Event-shaped objects MUST instead $ref event_proof.
* kind · string (enum)
Generic detached JWS proof over a canonical non-Event payload binding object that includes an object-family context constant.
enum: "detached_jws"
* verification_method · string
DID URL of the signing key for this non-Event detached proof. Same pattern as $defs/event_proof.verification_method; semantics are decoupled from Event proof (see $defs/event_proof for the Event-only shape).
pattern: ^did:[a-z0-9]+:[^\s#?]+#[A-Za-z0-9._:-]+$
* payload_digest · string · $ref #/$defs/digest
Generic non-Event detached-proof hash. This $defs/proof shape is reused by non-Event schemas; Event.properties.producer_proof references $defs/event_proof and MUST use event_digest instead.
pattern: ^(sha256|blake3):[0-9a-f]{64}$
* created_at · string (date-time) · format=date-time · $ref #/$defs/timestamp
Canonical Arkret-owned absolute instant. UTC Z form with exactly three millisecond digits. Whole seconds MUST use .000Z; offsets, missing/finer fractions, lowercase separators, leap seconds, and invalid Gregorian calendar dates are forbidden. Shape validation by this pattern is supplemented by semantic date validation.
pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$
domain · string
audience · oneOf[2]
oneOf · oneOf[0] · string
oneOf · oneOf[1] · array<string>
items · string
proof_purpose · string (enum)
Optional role discriminator for non-Event proofs. HandleClaim core, status and revocation carriers make issuer_attestation, holder_acceptance, status_attestation and revocation_authorization load-bearing. governance_authorization marks a resource-governance-key authorization (directory withdraw/takedown-appeal, discovery-directory.md 8.7.1). Generic proof consumers ignore it unless their object-family contract makes it load-bearing.
enum: "issuer_attestation" "holder_acceptance" "status_attestation" "revocation_authorization" "governance_authorization"
* jws · string
pattern: ^[A-Za-z0-9_-]+\.\.[A-Za-z0-9_-]+$

Source