ak.schema.recovery_policy.v1
ak.schema.recovery_policy.v1 · file: schemas/recovery-policy.schema.json Normative grammar for an account's PCR recovery policy. Bound through signed control events to one exact AccountId and its local unique PCR lineage; receivers reject recovery and pcr_recovery device authorization whose proof family or optional DID-root factor is not allowed by the currently accepted policy.
* $ · object
Normative grammar for an account's PCR recovery policy. Bound through signed control events to one exact AccountId and its local unique PCR lineage; receivers reject recovery and pcr_recovery device authorization whose proof family or optional DID-root factor is not allowed by the currently accepted policy.
* schema ·
const "ak.schema.recovery_policy.v1"enum:
"ak.schema.recovery_policy.v1"* policy_id ·
stringpattern:
^ak:policy:[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$* account_id · object · $ref ./common-ids.schema.json#/$defs/account_id
Complete protocol identity for a principal at one Station, including human, Agent, Applet-managed Ghost and integration accounts. It does not imply a human login, provisioning workflow, credential class or authorization. Equality is byte-for-byte equality of both canonical did_core_id components; neither component may be inferred from a DID Document, route, session audience, current service, handle, or local database key. Accounts with the same principal_id at different station_id values are permanently distinct. Principal equality MUST NOT establish account equivalence or any permission inheritance, merging, delegation, substitution or recovery relationship. Account-scoped authority requires independent authorization for the exact AccountId. Permanent loss of a Station does not permit its accounts or PCR lineages to migrate to or revive at another Station; Realm takeover and RealmCommit recovery do not waive this boundary. See models/common-fields.md section 4.2.
* principal_id ·
$ref #/$defs/did_core_id · $ref #/$defs/did_core_id* station_id ·
$ref #/$defs/did_core_id · $ref #/$defs/did_core_id* version ·
integerMonotonically increasing counter scoped by the exact account_id. Receivers MUST reject a publish whose version is not strictly greater than the currently accepted policy.
* supersedes_id · oneOf[2]
Predecessor policy_id. Null only for the genesis policy of an exact account.
oneOf · oneOf[0] ·
nulloneOf · oneOf[1] ·
stringpattern:
^ak:policy:[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$* trust_domain ·
string · $ref ./common-ids.schema.json#/$defs/trust_domainDeployment-scope trust domain identifier the policy applies to. Cross-domain proofs MUST fail.
pattern:
^ak:trust_domain:[a-z0-9][a-z0-9._\-:]{0,127}$cooldown_seconds ·
integerMinimum wall-clock delay, in seconds, between recovery session creation and acceptance of a recovery proof for that session. Receivers MUST reject a proof submitted earlier. Absence is no delay; the value is a signed policy constraint and MUST NOT be ignored.
* issued_at ·
string (date-time) · format=date-time · $ref #/$defs/timestampCanonical Arkret-owned absolute instant. UTC Z form with exactly three millisecond digits. Whole seconds MUST use .000Z; offsets, missing/finer fractions, lowercase separators, leap seconds, and invalid Gregorian calendar dates are forbidden. Shape validation by this pattern is supplemented by semantic date validation.
pattern:
^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$not_before ·
string (date-time) · format=date-time · $ref #/$defs/timestampCanonical Arkret-owned absolute instant. UTC Z form with exactly three millisecond digits. Whole seconds MUST use .000Z; offsets, missing/finer fractions, lowercase separators, leap seconds, and invalid Gregorian calendar dates are forbidden. Shape validation by this pattern is supplemented by semantic date validation.
pattern:
^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$expires_at · oneOf[2]
oneOf · oneOf[0] ·
nulloneOf · oneOf[1] ·
string (date-time) · format=date-time · $ref #/$defs/timestampCanonical Arkret-owned absolute instant. UTC Z form with exactly three millisecond digits. Whole seconds MUST use .000Z; offsets, missing/finer fractions, lowercase separators, leap seconds, and invalid Gregorian calendar dates are forbidden. Shape validation by this pattern is supplemented by semantic date validation.
pattern:
^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$* auth_data · object
* verification_method ·
string · $ref #/$defs/did_urlDID URL identifying the authorized issuer: founding device after genesis; current-generation accepted device for later updates; identity root for re-anchor; or a coordinator satisfying the superseded policy quorum. Receivers resolve this semantic authority from accepted principal-control state, not from arbitrary DID Document membership.
pattern:
^did:[a-z0-9]+:[^\s#?]+#[A-Za-z0-9._:-]+$* signature_algorithm ·
string (enum)enum:
"Ed25519"* signature ·
stringbase64url signature over UTF8('ak.identity.recovery_policy.signature.v1\n') followed by RFC 8785 JCS of all present top-level policy members except auth_data. The closed policy shape fixes the projection; absent optional members are omitted and null is retained only where the schema explicitly admits null.
pattern:
^[A-Za-z0-9_-]+$* methods · array<$ref #/$defs/recovery_method>
Single signed source of recovery acceptance and derived publication authority. Each kind occurs at most once (semantic MUST). Entries are independent OR alternatives; device_quorum.k counts distinct eligible member devices within that entry and MUST NOT exceed its member count. Empty methods is explicit policy revocation. did_root is an opt-in to validated DID history/pre-rotation authority, never an accepted device key. Every published entry MUST be executable by the receiving deployment; no constraint may be silently discarded.
items · oneOf[4] · $ref #/$defs/recovery_method
oneOf · oneOf[0] · object
* kind ·
const "did_root"enum:
"did_root"oneOf · oneOf[1] · object
* kind ·
const "recovery_unlock"enum:
"recovery_unlock"* keys · array<$ref #/$defs/recovery_key_entry>
items · object · $ref #/$defs/recovery_key_entry
Recovery proof signing key with its distinct, inline backup-only HPKE recipient. The signing verification_method and backup_hpke.key_agreement_ref MUST be unique within the policy. Public material, algorithm, validity and revocation are checked independently for the two roles.
* verification_method ·
string · $ref #/$defs/did_urlExact and sole recovery signing-key selector used by recovery_unlock proofs. It resolves only within this accepted policy entry, never through arbitrary DID Document membership or a caller-provided fallback.
pattern:
^did:[a-z0-9]+:[^\s#?]+#[A-Za-z0-9._:-]+$* public_key_multibase ·
stringMultikey for the recovery proof signature algorithm. MUST NOT equal or be converted into the paired HPKE key.
pattern:
^z[1-9A-HJ-NP-Za-km-z]+$* signature_algorithm ·
string (enum)Current-v1 signature algorithm used by the recovery key. Reserved algorithms, including ML-DSA-65, fail closed as unsupported until a future negotiated schema/profile activation.
enum:
"Ed25519"* not_before ·
string (date-time) · format=date-time · $ref #/$defs/timestampCanonical Arkret-owned absolute instant. UTC Z form with exactly three millisecond digits. Whole seconds MUST use .000Z; offsets, missing/finer fractions, lowercase separators, leap seconds, and invalid Gregorian calendar dates are forbidden. Shape validation by this pattern is supplemented by semantic date validation.
pattern:
^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$* expires_at ·
string (date-time) · format=date-time · $ref #/$defs/timestampCanonical Arkret-owned absolute instant. UTC Z form with exactly three millisecond digits. Whole seconds MUST use .000Z; offsets, missing/finer fractions, lowercase separators, leap seconds, and invalid Gregorian calendar dates are forbidden. Shape validation by this pattern is supplemented by semantic date validation.
pattern:
^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$revoked_at · oneOf[2]
When set, the entry is revoked from this instant onward and MUST NOT satisfy any recovery_unlock proof whose binding time is at or after it.
oneOf · oneOf[0] ·
nulloneOf · oneOf[1] ·
string (date-time) · format=date-time · $ref #/$defs/timestampCanonical Arkret-owned absolute instant. UTC Z form with exactly three millisecond digits. Whole seconds MUST use .000Z; offsets, missing/finer fractions, lowercase separators, leap seconds, and invalid Gregorian calendar dates are forbidden. Shape validation by this pattern is supplemented by semantic date validation.
pattern:
^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$* backup_hpke · object · $ref #/$defs/recovery_key_agreement_entry
Dedicated X25519 HPKE recipient for key-backup envelopes. It cannot verify recovery_unlock or authorize DID/Event operations.
* key_agreement_ref ·
string · $ref #/$defs/did_urlStable identifier used by key-backup encryption.recipient_key_ref.
pattern:
^did:[a-z0-9]+:[^\s#?]+#[A-Za-z0-9._:-]+$* key_agreement_algorithm ·
const "X25519"enum:
"X25519"* public_key_multibase ·
stringX25519 public multikey (multicodec x25519-pub).
pattern:
^z[1-9A-HJ-NP-Za-km-z]+$* hpke_suites · array<string (enum)>
items ·
string (enum)enum:
"ak.hpke_x25519_aead_chacha20poly1305.v1" "ak.hpke_x25519_aead_aes256gcm.v1"* use ·
const "backup_hpke"enum:
"backup_hpke"* not_before ·
string (date-time) · format=date-time · $ref #/$defs/timestampCanonical Arkret-owned absolute instant. UTC Z form with exactly three millisecond digits. Whole seconds MUST use .000Z; offsets, missing/finer fractions, lowercase separators, leap seconds, and invalid Gregorian calendar dates are forbidden. Shape validation by this pattern is supplemented by semantic date validation.
pattern:
^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$* expires_at ·
string (date-time) · format=date-time · $ref #/$defs/timestampCanonical Arkret-owned absolute instant. UTC Z form with exactly three millisecond digits. Whole seconds MUST use .000Z; offsets, missing/finer fractions, lowercase separators, leap seconds, and invalid Gregorian calendar dates are forbidden. Shape validation by this pattern is supplemented by semantic date validation.
pattern:
^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$revoked_at · oneOf[2]
oneOf · oneOf[0] ·
nulloneOf · oneOf[1] ·
string (date-time) · format=date-time · $ref #/$defs/timestampCanonical Arkret-owned absolute instant. UTC Z form with exactly three millisecond digits. Whole seconds MUST use .000Z; offsets, missing/finer fractions, lowercase separators, leap seconds, and invalid Gregorian calendar dates are forbidden. Shape validation by this pattern is supplemented by semantic date validation.
pattern:
^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$oneOf · oneOf[2] · object
* kind ·
const "device_quorum"enum:
"device_quorum"* k ·
integer* member_ids · array<string>
items ·
stringpattern:
^ak:device:[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$oneOf · oneOf[3] · object
* kind ·
const "trusted_recovery_service"enum:
"trusted_recovery_service"* services · array<object>
Recovery authorization issuers accepted by this policy. Entries are independent OR alternatives: exactly one entry MUST match the submitted authorization verbatim on service_id, authorization_verification_method and audience. There is no threshold across entries and no deployment-level issuer.
items · object
* service_id ·
string · $ref ./common-ids.schema.json#/$defs/did_core_idCanonical stable DID-derived identity core. The lowercase DID method name follows ak:did_core:, and the remaining method-adapter-defined core is opaque to generic consumers. The did:web v1 adapter uses the complete canonical method-specific-id, never a digest or truncated host. Principal-core and service-core equality is byte-for-byte equality of the complete did_core_id. Event actor and Realm membership equality instead use the complete closed ActorId, and account-scoped equality uses the complete AccountId; neither may be reduced to a principal core. A did_core_id is not a DID and cannot be resolved without a did or AuthenticatedServiceResolution.
pattern:
^ak:did_core:[a-z0-9]+:[^\s/?#]+$* audience ·
string* authorization_verification_method ·
string · $ref #/$defs/did_urlExact accepted policy method authorized for this service; both method and audience MUST match verbatim. DID membership or recursive string mention is insufficient.
pattern:
^did:[a-z0-9]+:[^\s#?]+#[A-Za-z0-9._:-]+$(^x_[a-z][a-z0-9_]{0,63}$) ·
anySource
- registry row:
spec/v1/artifacts/registry/schema-registry.json - schema document:
spec/v1/artifacts/schemas/recovery-policy.schema.json