ak.schema.websocket_frame.v1

← Schemas

Arkret WebSocket Frame

ak.schema.websocket_frame.v1 · file: schemas/websocket-frame.schema.json

Closed union of all application frames for ak.profile.binding.websocket.v1. Duplicate JSON member names and the advertised UTF-8 byte limit are enforced before JSON Schema validation.

* $ · oneOf[2]

Closed union of all application frames for ak.profile.binding.websocket.v1. Duplicate JSON member names and the advertised UTF-8 byte limit are enforced before JSON Schema validation.

oneOf · oneOf[0] · oneOf[9] · $ref #/$defs/server_frame

oneOf · oneOf[0] · object · $ref #/$defs/challenge

* kind · const "challenge"

enum: "challenge"

* connection_id · string · $ref #/$defs/connection_id

pattern: ^[A-Za-z0-9_-]{22,128}$

* nonce · string · $ref #/$defs/nonce

pattern: ^[A-Za-z0-9_-]{22,128}$

* expires_at · string (date-time) · format=date-time · $ref #/$defs/timestamp

Canonical Arkret-owned absolute instant. UTC Z form with exactly three millisecond digits. Whole seconds MUST use .000Z; offsets, missing/finer fractions, lowercase separators, leap seconds, and invalid Gregorian calendar dates are forbidden. Shape validation by this pattern is supplemented by semantic date validation.

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

oneOf · oneOf[1] · object · $ref #/$defs/welcome

* kind · const "welcome"

enum: "welcome"

* connection_id · string · $ref #/$defs/connection_id

pattern: ^[A-Za-z0-9_-]{22,128}$

* max_frame_bytes · integer

* max_channels · integer

* max_connection_pending_bytes · integer

* max_channel_pending_bytes · integer

* max_connection_pending_frames · integer

* max_channel_pending_frames · integer

* heartbeat_interval_ms · integer

* auth_expires_at · string (date-time) · format=date-time · $ref #/$defs/timestamp

Canonical Arkret-owned absolute instant. UTC Z form with exactly three millisecond digits. Whole seconds MUST use .000Z; offsets, missing/finer fractions, lowercase separators, leap seconds, and invalid Gregorian calendar dates are forbidden. Shape validation by this pattern is supplemented by semantic date validation.

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

oneOf · oneOf[2] · object · $ref #/$defs/opened

* kind · const "opened"

enum: "opened"

* channel_id · string · $ref #/$defs/channel_id

pattern: ^[A-Za-z0-9._~-]{1,64}$

* operation_id · string (enum) · $ref #/$defs/operation_id

enum: "ak.self.account.stream.subscribe.v1" "ak.self.committed_event.stream.subscribe.v1" "ak.self.signal.stream.subscribe.v1"

oneOf · oneOf[3] · object · $ref #/$defs/data

* kind · const "data"

enum: "data"

* channel_id · string · $ref #/$defs/channel_id

pattern: ^[A-Za-z0-9._~-]{1,64}$

* payload · oneOf[3] · $ref #/$defs/data_payload

oneOf · oneOf[0] · allOf[2]

allOf · allOf[0] · object · $ref ./account-subscribe-frame.schema.json

Single NDJSON frame on the ak.self.account.stream.subscribe.v1 streaming channel (GET /_arkret/self/account/subscribe, Content-Type: application/x-ndjson). Each newline-delimited line is one frame object. Discriminated by the `kind` field: `delta` carries account-aggregate data (per-Realm stream heads, to_device, account_data, agent_draft_pending_intents, device_lists, notifications, unread counts); the other kinds are control frames that mirror ak.self.committed_event.stream.subscribe.v1 (`catchup_complete`, `checkpoint`, `heartbeat`, `dropped`, `resync_required`, `unauthorized`). Agent draft pending intents use their own holder-private baseline/delta channel and never reuse account_data.events, account_data.station_cas, notifications, or to_device. Encrypted broadcast signals use the optional Signal Extension rail and never appear in this durable/account aggregate stream. `dropped` and `resync_required` MAY carry `reconnect_after_ms` as a server-directed minimum delay before opening another account subscribe stream for the same principal/device/filter scope.

oneOf · oneOf[0] · object

Account aggregate data frame.

* kind · const "delta"

enum: "delta"

oneOf · oneOf[1] · object

This bounded catchup round completed. Per-channel and Realm baseline completion is declared separately.

* kind · const "catchup_complete"

enum: "catchup_complete"

oneOf · oneOf[2] · object

Cursor-only checkpoint advancement; no data fields are allowed.

* kind · const "checkpoint"

enum: "checkpoint"

oneOf · oneOf[3] · object

Account stream gap signal; cursor is the account catch-up start. No data fields are allowed. `reconnect_after_ms` MAY be present to enforce a server-directed reconnect holdoff.

* kind · const "dropped"

enum: "dropped"

oneOf · oneOf[4] · object

Keepalive frame; cursor and data fields are forbidden.

* kind · const "heartbeat"

enum: "heartbeat"

oneOf · oneOf[5] · object

Hard reset signal; cursor and data fields are forbidden. `reconnect_after_ms` MAY be present to enforce a server-directed reconnect holdoff.

* kind · const "resync_required"

enum: "resync_required"

oneOf · oneOf[6] · object

Authorization-loss signal; cursor and data fields are forbidden.

* kind · const "unauthorized"

enum: "unauthorized"

* kind · string (enum)

enum: "delta" "catchup_complete" "checkpoint" "heartbeat" "dropped" "resync_required" "unauthorized"

cursor · $ref #/$defs/cursor_value · $ref #/$defs/cursor_value

Stream cursor (purpose='stream'). On `delta` / `catchup_complete` / `checkpoint` frames it points to the position covered by this frame; pass back as `after=` on the next subscribe call to resume. REQUIRED on `dropped` frames as the account-aggregate catch-up start for `GET /account/subscribe?after=<cursor>&catchup=true`. MUST be present on `delta` / `catchup_complete` / `checkpoint` / `dropped`; absent on `heartbeat` / `resync_required` / `unauthorized`. This one stays opaque even though each individual stream now has a total order: the account aggregate spans N independent streams so there is no scalar position to state in the clear, a cleartext position vector would let the caller infer private streams it cannot see from the gaps (zh/sync/client-sync.md §4), and the server-side handle also binds filter_digest and device so a changed filter cannot silently skip events. Single-stream reads do NOT use a cursor — see zh/sync/api-conventions.md §7.2.

realms · object

Per-Realm map on `delta` frames. Keys are `ak:realm:*`; values are that Realm's aggregate entry: per-stream window boundaries (streams[]), delivered commit rows (committed_events[]), projection state and account data. Membership state (`join` / `knock` / `leave` / `ban`) is carried by the events inside the Realm entry; pending Invite lifecycle remains a caller-private inbox projection and is not membership.

(^ak:realm:[A-Za-z0-9_-]{44}$) · $ref #/$defs/realm_sync_entry · $ref #/$defs/realm_sync_entry

to_device · $ref #/$defs/recipient_delivery_container · $ref #/$defs/recipient_delivery_container

To-device message batch on `delta` frames.

device_lists · $ref #/$defs/device_list_changes · $ref #/$defs/device_list_changes

Principal DID sets whose authoritative device list changed or left the caller's visibility scope on `delta` frames.

account_data · $ref #/$defs/account_data_container · $ref #/$defs/account_data_container

Account-scoped private data on `delta` frames, split by authority: holder-authored durable Events remain in events[], while registry-declared station_cas registers use the closed station_cas branch.

agent_draft_pending_intents · $ref #/$defs/agent_draft_pending_intent_container · $ref #/$defs/agent_draft_pending_intent_container

Dedicated controller-holder-private Agent draft pending-intent baseline/delta channel. It is authorized for an authenticated active device of the exact controller AccountId and is never an account-data, notification or to-device carrier.

notifications · $ref #/$defs/notification_container · $ref #/$defs/notification_container

Account-private notification projection deltas on `delta` frames. They are not Realm Events: the channel is authorized by the authenticated account context and is never filtered by the detail Realm window. Ordinary source-Event rows are additionally re-evaluated against the recipient's current read authorization on every frame, frozen baseline pages included.

partial · boolean

This frame contains at least one limited stream window (some streams[].limited is true). Missing older history is loaded on user demand through ak.self.committed_event.read.scan.v1 with before_position; partial does not describe account baseline completion.

priority · string

Optional server-side priority hint for the frame (UX scheduling).

reconnect_after_ms · integer

Optional server-directed minimum delay, in milliseconds, before opening another `ak.self.account.stream.subscribe.v1` stream for the same principal/device/filter scope. MAY appear only on `dropped` and `resync_required` frames. This is a stream reconnect hint, not a generic error retry field; it does not apply to unrelated API calls. Clients MUST wait at least this delay before reconnecting, and servers MUST reject earlier reconnect attempts with `429 rate_limited` plus `Retry-After`.

realm_list · $ref #/$defs/realm_list_page · $ref #/$defs/realm_list_page

realm_list_changes · $ref #/$defs/realm_list_changes · $ref #/$defs/realm_list_changes

baseline · $ref #/$defs/account_baseline_segment · $ref #/$defs/account_baseline_segment

realm_invalidations · array<$ref #/$defs/realm_invalidation>

items · $ref #/$defs/realm_invalidation · $ref #/$defs/realm_invalidation

allOf · allOf[1] · object

kind · const "delta"

enum: "delta"

oneOf · oneOf[1] · allOf[2]

allOf · allOf[0] · object · $ref ./committed-event-subscribe-frame.schema.json

Closed frame union emitted by ak.self.committed_event.stream.subscribe.v1 over NDJSON or an Arkret WebSocket channel.

oneOf · oneOf[0] · object

* kind · const "committed_event"

enum: "committed_event"

* payload · oneOf[2] · $ref ./service-operation-dtos.schema.json#/$defs/CommittedEventView

Caller-scoped, non-durable read representation pairing one RealmCommit with either the exact producer-signed Event or a minimal withheld marker. It has no independent identity, signature or persistence semantics and is never reducer input.

oneOf · oneOf[0] · object

* commit · …

recursion truncated at depth 8; see source schema for full shape

* event · …

recursion truncated at depth 8; see source schema for full shape

oneOf · oneOf[1] · object

* commit · …

recursion truncated at depth 8; see source schema for full shape

* event_disclosure · …

recursion truncated at depth 8; see source schema for full shape

oneOf · oneOf[1] · object

* kind · const "epoch_rotation"

enum: "epoch_rotation"

* payload · $ref #/$defs/epoch_rotation_payload · $ref #/$defs/epoch_rotation_payload

oneOf · oneOf[2] · object

* kind · string (enum)

enum: "checkpoint" "catchup_complete"

oneOf · oneOf[3] · object

* kind · const "dropped"

enum: "dropped"

oneOf · oneOf[4] · object

* kind · const "resync_required"

enum: "resync_required"

oneOf · oneOf[5] · object

* kind · const "unauthorized"

enum: "unauthorized"

oneOf · oneOf[6] · object

* kind · const "heartbeat"

enum: "heartbeat"

oneOf · oneOf[7] · object

* kind · const "quarantined"

enum: "quarantined"

* payload · object

* realm_id · string · $ref ./common-ids.schema.json#/$defs/realm_id

Retyped ak.realm.create Event token. It therefore carries the same fixed current-v1 0x01/SHA-256 content-address identity and is not selected by Realm state.

pattern: ^ak:realm:[A-Za-z0-9_-]{44}$

* error_code · const "witness_disagreement"

enum: "witness_disagreement"

* affected_stream_refs · array<$ref ./realm-commit.schema.json#/$defs/stream_ref>

items · …

recursion truncated at depth 8; see source schema for full shape

* kind · string (enum)

enum: "committed_event" "checkpoint" "heartbeat" "catchup_complete" "epoch_rotation" "dropped" "resync_required" "unauthorized" "quarantined"

realm_id · string · $ref ./common-ids.schema.json#/$defs/realm_id

Retyped ak.realm.create Event token. It therefore carries the same fixed current-v1 0x01/SHA-256 content-address identity and is not selected by Realm state.

pattern: ^ak:realm:[A-Za-z0-9_-]{44}$

cursor · string

pattern: ^ak:cursor:[A-Za-z0-9_-]{1,2028}$

payload · object

reconnect_after_ms · integer

allOf · allOf[1] · object

kind · const "committed_event"

enum: "committed_event"

oneOf · oneOf[2] · object · $ref ./signal-stream-frame.schema.json#/$defs/signal

* kind · const "signal"

enum: "signal"

* envelope · object · $ref ./signal-envelope.schema.json

Encrypted-only broadcast signal envelope. Exact product payload type and target are inside encrypted_payload. This object is never a durable Event and never advances RealmCommit coverage or reducer state.

oneOf · oneOf[0] · ?

oneOf · oneOf[1] · ?

allOf · allOf[0] · ?

* realm_id · string · $ref ./common-ids.schema.json#/$defs/realm_id

Retyped ak.realm.create Event token. It therefore carries the same fixed current-v1 0x01/SHA-256 content-address identity and is not selected by Realm state.

pattern: ^ak:realm:[A-Za-z0-9_-]{44}$

* scope_ref · oneOf[4] · $ref ./event-envelope.schema.json#/$defs/scope_ref

oneOf · oneOf[0] · object

* kind · const "realm"

enum: "realm"

* realm_id · string · $ref ./common-ids.schema.json#/$defs/realm_id

Retyped ak.realm.create Event token. It therefore carries the same fixed current-v1 0x01/SHA-256 content-address identity and is not selected by Realm state.

pattern: ^ak:realm:[A-Za-z0-9_-]{44}$

oneOf · oneOf[1] · object

* kind · const "circle"

enum: "circle"

* realm_id · string · $ref ./common-ids.schema.json#/$defs/realm_id

Retyped ak.realm.create Event token. It therefore carries the same fixed current-v1 0x01/SHA-256 content-address identity and is not selected by Realm state.

pattern: ^ak:realm:[A-Za-z0-9_-]{44}$

* circle_id · string · $ref ./common-ids.schema.json#/$defs/circle_id

pattern: ^ak:circle:[A-Za-z0-9_-]{44}$

oneOf · oneOf[2] · object

Native controller-and-owned-Agents private scope. It is not a Circle and has no editable membership.

* kind · const "sidecar"

enum: "sidecar"

* realm_id · string · $ref ./common-ids.schema.json#/$defs/realm_id

Retyped ak.realm.create Event token. It therefore carries the same fixed current-v1 0x01/SHA-256 content-address identity and is not selected by Realm state.

pattern: ^ak:realm:[A-Za-z0-9_-]{44}$

* sidecar_id · string · $ref ./common-ids.schema.json#/$defs/sidecar_id

pattern: ^ak:sidecar:[A-Za-z0-9_-]{44}$

oneOf · oneOf[3] · object

Genesis scope for ak.realm.create only. It carries no realm_id because the receiver derives every Realm id, including Collaboration, Direct Conversation, human PCR, and Agent PCR, as retype(event_id, "realm") from this create Event (zh/models/realm-and-space.md section 2.5.0). The uniform omission also prevents the digest cycle.

* kind · const "realm_genesis"

enum: "realm_genesis"

* sender_actor_id · oneOf[2] · $ref ./common-ids.schema.json#/$defs/actor_id

Complete protocol identity for an Event author or Realm member: account carries the exact AccountId for every Station-hosted principal; service identifies a service acting as itself. The discriminator is validated against accepted registration and admission evidence; it never authorizes itself. Account and service are distinct, and no comparison may fall back to a bare principal_id. Agent and integration classification, provisioning, controller binding and credential authorization are independently verified facts, not identity variants. Account actors at different Stations MUST NOT share or inherit authority merely because their principal_id, DID controller or signing key matches, including membership, capability, RealmCommit-signing and recovery authority.

oneOf · oneOf[0] · object

* kind · const "account"

enum: "account"

* account_id · $ref #/$defs/account_id · $ref #/$defs/account_id

oneOf · oneOf[1] · object

* kind · const "service"

enum: "service"

* service_id · $ref #/$defs/did_core_id · $ref #/$defs/did_core_id

sender_device_id · string · $ref ./common-ids.schema.json#/$defs/device_id

Closed sender discriminator: required exactly for an ordinary account-device sender and absent exactly for an Agent sender. null and sentinels are forbidden. Absence only selects the candidate Agent branch; source and recipient still verify accepted Agent classification and current runtime authority.

pattern: ^ak:device:[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$

* authority_commit_id · string · $ref ./common-ids.schema.json#/$defs/realm_commit_id

Content-addressed identity of a closed unsigned RealmCommit body. The suffix uses the fixed v1 digest suite and the same canonical 33-octet token encoding as Event IDs.

pattern: ^ak:realm_commit:[A-Za-z0-9_-]{44}$

parent_realm_authority_commit_id · string · $ref ./common-ids.schema.json#/$defs/realm_commit_id

Content-addressed identity of a closed unsigned RealmCommit body. The suffix uses the fixed v1 digest suite and the same canonical 33-octet token encoding as Event IDs.

pattern: ^ak:realm_commit:[A-Za-z0-9_-]{44}$

* signal_class · string (enum)

enum: "setup" "moderation" "session"

* sent_at · string (date-time) · format=date-time · $ref ./time.schema.json#/$defs/timestamp

Canonical Arkret-owned absolute instant. UTC Z form with exactly three millisecond digits. Whole seconds MUST use .000Z; offsets, missing/finer fractions, lowercase separators, leap seconds, and invalid Gregorian calendar dates are forbidden. Shape validation by this pattern is supplemented by semantic date validation.

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

* expires_at · string (date-time) · format=date-time · $ref ./time.schema.json#/$defs/timestamp

Canonical Arkret-owned absolute instant. UTC Z form with exactly three millisecond digits. Whole seconds MUST use .000Z; offsets, missing/finer fractions, lowercase separators, leap seconds, and invalid Gregorian calendar dates are forbidden. Shape validation by this pattern is supplemented by semantic date validation.

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

* encrypted_payload · object

AEAD ciphertext. The AAD is the JCS bytes of the closed pre-encryption header projected from the envelope top level, this object's scheme/key_ref/purpose/aead_profile/epoch/nonce and the verified group state (zh/sync/signal.md section 1); it is rebuilt by the recipient and never carried as an aad_digest. Exact payload kind, product target, and sender sequence exist only in plaintext after recipient decryption. The scheme names the construction, never the algorithm: aead_profile carries the algorithm and MUST equal the active MLS ciphersuite the group at key_ref.group_state_ref actually negotiated (zh/conformance/encoding.md section 10.1), so key_ref carries no algorithm mirror. Activating a further ciphersuite therefore reaches Signal with no wire change.

* scheme · const "ak.signal_exporter_aead.v1"

enum: "ak.signal_exporter_aead.v1"

* key_ref · object

* group_state_ref · oneOf[2]

Accepted ak.mls.genesis / winning ak.mls.commit for the scope's MLS group, or an equivalent group state proof hash. It is what fixes which ciphersuite aead_profile must equal.

oneOf · oneOf[0] · …

recursion truncated at depth 8; see source schema for full shape

oneOf · oneOf[1] · …

recursion truncated at depth 8; see source schema for full shape

* purpose · const "ak.signal.v1"

AEAD purpose for this domain. It is a nonce-derivation and AAD input, so it keeps a Signal nonce from colliding with a content-encryption nonce under the same key and epoch.

enum: "ak.signal.v1"

* aead_profile · string

canonical_id of an active row of artifacts/registry/mls-ciphersuite-registry.json. It MUST equal the ciphersuite the group at key_ref.group_state_ref actually negotiated; a reserved suite, an unregistered suite, or a mismatch MUST fail closed.

* epoch · integer

* nonce · string

pattern: ^[A-Za-z0-9_-]{16}$

* ciphertext · string

pattern: ^[A-Za-z0-9_-]+$

* proof · $ref #/$defs/signal_proof · $ref #/$defs/signal_proof

* delivery_authority · $ref #/$defs/delivery_authority · $ref #/$defs/delivery_authority

oneOf · oneOf[4] · oneOf[2] · $ref #/$defs/control

oneOf · oneOf[0] · object · $ref #/$defs/channel_control

* kind · const "control"

enum: "control"

* frame_scope · const "channel"

enum: "channel"

* channel_id · string · $ref #/$defs/channel_id

pattern: ^[A-Za-z0-9._~-]{1,64}$

* payload · anyOf[5] · $ref #/$defs/channel_control_payload

anyOf · anyOf[0] · allOf[2]

allOf · allOf[0] · object · $ref ./account-subscribe-frame.schema.json

Single NDJSON frame on the ak.self.account.stream.subscribe.v1 streaming channel (GET /_arkret/self/account/subscribe, Content-Type: application/x-ndjson). Each newline-delimited line is one frame object. Discriminated by the `kind` field: `delta` carries account-aggregate data (per-Realm stream heads, to_device, account_data, agent_draft_pending_intents, device_lists, notifications, unread counts); the other kinds are control frames that mirror ak.self.committed_event.stream.subscribe.v1 (`catchup_complete`, `checkpoint`, `heartbeat`, `dropped`, `resync_required`, `unauthorized`). Agent draft pending intents use their own holder-private baseline/delta channel and never reuse account_data.events, account_data.station_cas, notifications, or to_device. Encrypted broadcast signals use the optional Signal Extension rail and never appear in this durable/account aggregate stream. `dropped` and `resync_required` MAY carry `reconnect_after_ms` as a server-directed minimum delay before opening another account subscribe stream for the same principal/device/filter scope.

oneOf · oneOf[0] · object

Account aggregate data frame.

* kind · const "delta"

enum: "delta"

oneOf · oneOf[1] · object

This bounded catchup round completed. Per-channel and Realm baseline completion is declared separately.

* kind · const "catchup_complete"

enum: "catchup_complete"

oneOf · oneOf[2] · object

Cursor-only checkpoint advancement; no data fields are allowed.

* kind · const "checkpoint"

enum: "checkpoint"

oneOf · oneOf[3] · object

Account stream gap signal; cursor is the account catch-up start. No data fields are allowed. `reconnect_after_ms` MAY be present to enforce a server-directed reconnect holdoff.

* kind · const "dropped"

enum: "dropped"

oneOf · oneOf[4] · object

Keepalive frame; cursor and data fields are forbidden.

* kind · const "heartbeat"

enum: "heartbeat"

oneOf · oneOf[5] · object

Hard reset signal; cursor and data fields are forbidden. `reconnect_after_ms` MAY be present to enforce a server-directed reconnect holdoff.

* kind · const "resync_required"

enum: "resync_required"

oneOf · oneOf[6] · object

Authorization-loss signal; cursor and data fields are forbidden.

* kind · const "unauthorized"

enum: "unauthorized"

* kind · string (enum)

enum: "delta" "catchup_complete" "checkpoint" "heartbeat" "dropped" "resync_required" "unauthorized"

cursor · $ref #/$defs/cursor_value · $ref #/$defs/cursor_value

Stream cursor (purpose='stream'). On `delta` / `catchup_complete` / `checkpoint` frames it points to the position covered by this frame; pass back as `after=` on the next subscribe call to resume. REQUIRED on `dropped` frames as the account-aggregate catch-up start for `GET /account/subscribe?after=<cursor>&catchup=true`. MUST be present on `delta` / `catchup_complete` / `checkpoint` / `dropped`; absent on `heartbeat` / `resync_required` / `unauthorized`. This one stays opaque even though each individual stream now has a total order: the account aggregate spans N independent streams so there is no scalar position to state in the clear, a cleartext position vector would let the caller infer private streams it cannot see from the gaps (zh/sync/client-sync.md §4), and the server-side handle also binds filter_digest and device so a changed filter cannot silently skip events. Single-stream reads do NOT use a cursor — see zh/sync/api-conventions.md §7.2.

realms · object

Per-Realm map on `delta` frames. Keys are `ak:realm:*`; values are that Realm's aggregate entry: per-stream window boundaries (streams[]), delivered commit rows (committed_events[]), projection state and account data. Membership state (`join` / `knock` / `leave` / `ban`) is carried by the events inside the Realm entry; pending Invite lifecycle remains a caller-private inbox projection and is not membership.

(^ak:realm:[A-Za-z0-9_-]{44}$) · $ref #/$defs/realm_sync_entry · $ref #/$defs/realm_sync_entry

to_device · $ref #/$defs/recipient_delivery_container · $ref #/$defs/recipient_delivery_container

To-device message batch on `delta` frames.

device_lists · $ref #/$defs/device_list_changes · $ref #/$defs/device_list_changes

Principal DID sets whose authoritative device list changed or left the caller's visibility scope on `delta` frames.

account_data · $ref #/$defs/account_data_container · $ref #/$defs/account_data_container

Account-scoped private data on `delta` frames, split by authority: holder-authored durable Events remain in events[], while registry-declared station_cas registers use the closed station_cas branch.

agent_draft_pending_intents · $ref #/$defs/agent_draft_pending_intent_container · $ref #/$defs/agent_draft_pending_intent_container

Dedicated controller-holder-private Agent draft pending-intent baseline/delta channel. It is authorized for an authenticated active device of the exact controller AccountId and is never an account-data, notification or to-device carrier.

notifications · $ref #/$defs/notification_container · $ref #/$defs/notification_container

Account-private notification projection deltas on `delta` frames. They are not Realm Events: the channel is authorized by the authenticated account context and is never filtered by the detail Realm window. Ordinary source-Event rows are additionally re-evaluated against the recipient's current read authorization on every frame, frozen baseline pages included.

partial · boolean

This frame contains at least one limited stream window (some streams[].limited is true). Missing older history is loaded on user demand through ak.self.committed_event.read.scan.v1 with before_position; partial does not describe account baseline completion.

priority · string

Optional server-side priority hint for the frame (UX scheduling).

reconnect_after_ms · integer

Optional server-directed minimum delay, in milliseconds, before opening another `ak.self.account.stream.subscribe.v1` stream for the same principal/device/filter scope. MAY appear only on `dropped` and `resync_required` frames. This is a stream reconnect hint, not a generic error retry field; it does not apply to unrelated API calls. Clients MUST wait at least this delay before reconnecting, and servers MUST reject earlier reconnect attempts with `429 rate_limited` plus `Retry-After`.

realm_list · $ref #/$defs/realm_list_page · $ref #/$defs/realm_list_page

realm_list_changes · $ref #/$defs/realm_list_changes · $ref #/$defs/realm_list_changes

baseline · $ref #/$defs/account_baseline_segment · $ref #/$defs/account_baseline_segment

realm_invalidations · array<$ref #/$defs/realm_invalidation>

items · $ref #/$defs/realm_invalidation · $ref #/$defs/realm_invalidation

allOf · allOf[1] · object

kind · string (enum)

enum: "catchup_complete" "checkpoint" "heartbeat" "dropped" "resync_required" "unauthorized"

anyOf · anyOf[1] · allOf[2]

allOf · allOf[0] · object · $ref ./committed-event-subscribe-frame.schema.json

Closed frame union emitted by ak.self.committed_event.stream.subscribe.v1 over NDJSON or an Arkret WebSocket channel.

oneOf · oneOf[0] · object

* kind · const "committed_event"

enum: "committed_event"

* payload · oneOf[2] · $ref ./service-operation-dtos.schema.json#/$defs/CommittedEventView

Caller-scoped, non-durable read representation pairing one RealmCommit with either the exact producer-signed Event or a minimal withheld marker. It has no independent identity, signature or persistence semantics and is never reducer input.

oneOf · oneOf[0] · …

recursion truncated at depth 8; see source schema for full shape

oneOf · oneOf[1] · …

recursion truncated at depth 8; see source schema for full shape

oneOf · oneOf[1] · object

* kind · const "epoch_rotation"

enum: "epoch_rotation"

* payload · $ref #/$defs/epoch_rotation_payload · $ref #/$defs/epoch_rotation_payload

oneOf · oneOf[2] · object

* kind · string (enum)

enum: "checkpoint" "catchup_complete"

oneOf · oneOf[3] · object

* kind · const "dropped"

enum: "dropped"

oneOf · oneOf[4] · object

* kind · const "resync_required"

enum: "resync_required"

oneOf · oneOf[5] · object

* kind · const "unauthorized"

enum: "unauthorized"

oneOf · oneOf[6] · object

* kind · const "heartbeat"

enum: "heartbeat"

oneOf · oneOf[7] · object

* kind · const "quarantined"

enum: "quarantined"

* payload · object

* realm_id · …

recursion truncated at depth 8; see source schema for full shape

* error_code · …

recursion truncated at depth 8; see source schema for full shape

* affected_stream_refs · …

recursion truncated at depth 8; see source schema for full shape

* kind · string (enum)

enum: "committed_event" "checkpoint" "heartbeat" "catchup_complete" "epoch_rotation" "dropped" "resync_required" "unauthorized" "quarantined"

realm_id · string · $ref ./common-ids.schema.json#/$defs/realm_id

Retyped ak.realm.create Event token. It therefore carries the same fixed current-v1 0x01/SHA-256 content-address identity and is not selected by Realm state.

pattern: ^ak:realm:[A-Za-z0-9_-]{44}$

cursor · string

pattern: ^ak:cursor:[A-Za-z0-9_-]{1,2028}$

payload · object

reconnect_after_ms · integer

allOf · allOf[1] · object

kind · string (enum)

enum: "checkpoint" "heartbeat" "catchup_complete" "epoch_rotation" "dropped" "resync_required" "unauthorized"

anyOf · anyOf[2] · object · $ref ./signal-stream-frame.schema.json#/$defs/heartbeat

* kind · const "heartbeat"

enum: "heartbeat"

anyOf · anyOf[3] · object · $ref ./signal-stream-frame.schema.json#/$defs/drain

* kind · const "drain"

enum: "drain"

reconnect_after_ms · integer

reason · string

anyOf · anyOf[4] · object · $ref ./signal-stream-frame.schema.json#/$defs/unauthorized

* kind · const "unauthorized"

enum: "unauthorized"

reason · string

oneOf · oneOf[1] · object · $ref #/$defs/connection_control

* kind · const "control"

enum: "control"

* frame_scope · const "connection"

enum: "connection"

* payload · object · $ref #/$defs/connection_drain_payload

* kind · const "drain"

enum: "drain"

* reconnect_after_ms · integer

* deadline · string (date-time) · format=date-time · $ref #/$defs/timestamp

Canonical Arkret-owned absolute instant. UTC Z form with exactly three millisecond digits. Whole seconds MUST use .000Z; offsets, missing/finer fractions, lowercase separators, leap seconds, and invalid Gregorian calendar dates are forbidden. Shape validation by this pattern is supplemented by semantic date validation.

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

reason · string

oneOf · oneOf[5] · oneOf[2] · $ref #/$defs/error

oneOf · oneOf[0] · object · $ref #/$defs/channel_error

* kind · const "error"

enum: "error"

* frame_scope · const "channel"

enum: "channel"

* channel_id · string · $ref #/$defs/channel_id

pattern: ^[A-Za-z0-9._~-]{1,64}$

* error · object · $ref #/$defs/error_body

* code · string

Must resolve to a registered code in error-code-registry.json codes[]. This closed transport error body is not the HTTP RFC 9457 Problem Details.

pattern: ^[a-z][a-z0-9_]{0,127}$

* message · string

retry_after_ms · integer

oneOf · oneOf[1] · object · $ref #/$defs/connection_error

* kind · const "error"

enum: "error"

* frame_scope · const "connection"

enum: "connection"

* error · object · $ref #/$defs/error_body

* code · string

Must resolve to a registered code in error-code-registry.json codes[]. This closed transport error body is not the HTTP RFC 9457 Problem Details.

pattern: ^[a-z][a-z0-9_]{0,127}$

* message · string

retry_after_ms · integer

oneOf · oneOf[6] · object · $ref #/$defs/closed

* kind · const "closed"

enum: "closed"

* channel_id · string · $ref #/$defs/channel_id

pattern: ^[A-Za-z0-9._~-]{1,64}$

* reason · string (enum)

enum: "completed" "client_request" "error" "drain" "unauthorized"

oneOf · oneOf[7] · object · $ref #/$defs/ping

* kind · const "ping"

enum: "ping"

* ping_id · string

pattern: ^[A-Za-z0-9_-]{16,128}$

* sent_at · string (date-time) · format=date-time · $ref #/$defs/timestamp

Canonical Arkret-owned absolute instant. UTC Z form with exactly three millisecond digits. Whole seconds MUST use .000Z; offsets, missing/finer fractions, lowercase separators, leap seconds, and invalid Gregorian calendar dates are forbidden. Shape validation by this pattern is supplemented by semantic date validation.

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

oneOf · oneOf[8] · object · $ref #/$defs/reauth_required

* kind · const "reauth_required"

enum: "reauth_required"

* connection_id · string · $ref #/$defs/connection_id

pattern: ^[A-Za-z0-9_-]{22,128}$

* nonce · string · $ref #/$defs/nonce

pattern: ^[A-Za-z0-9_-]{22,128}$

* expires_at · string (date-time) · format=date-time · $ref #/$defs/timestamp

Canonical Arkret-owned absolute instant. UTC Z form with exactly three millisecond digits. Whole seconds MUST use .000Z; offsets, missing/finer fractions, lowercase separators, leap seconds, and invalid Gregorian calendar dates are forbidden. Shape validation by this pattern is supplemented by semantic date validation.

pattern: ^[0-9]{4}-(0[1-9]|1[0-2])-(0[1-9]|[12][0-9]|3[01])T([01][0-9]|2[0-3]):[0-5][0-9]:[0-5][0-9]\.[0-9]{3}Z$

* reason · const "grant_expiring"

enum: "grant_expiring"

oneOf · oneOf[1] · oneOf[4] · $ref #/$defs/client_frame

oneOf · oneOf[0] · object · $ref #/$defs/authenticate

* kind · const "authenticate"

enum: "authenticate"

* connection_id · string · $ref #/$defs/connection_id

pattern: ^[A-Za-z0-9_-]{22,128}$

* session_grant · string

pattern: ^[\u0021-\u007E]+$

* dpop_proof · string

pattern: ^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$

oneOf · oneOf[1] · oneOf[3] · $ref #/$defs/open

oneOf · oneOf[0] · object · $ref #/$defs/open_account

* kind · const "open"

enum: "open"

* channel_id · string · $ref #/$defs/channel_id

pattern: ^[A-Za-z0-9._~-]{1,64}$

* operation_id · const "ak.self.account.stream.subscribe.v1"

enum: "ak.self.account.stream.subscribe.v1"

* parameters · oneOf[2] · $ref #/$defs/account_open_parameters

oneOf · oneOf[0] · object · $ref ./account-subscribe-frame.schema.json#/$defs/account_subscribe_request

allOf · allOf[0] · ?

after · $ref #/$defs/cursor_value · $ref #/$defs/cursor_value

catchup · boolean

example: false

filter · object · $ref #/$defs/account_filter

An absent or empty realm_ids collection selects no Realm detail. Global account and Realm-summary changes remain subscribed. stream_refs belongs to selected Realms: absent keeps the bounded first screen, while present makes the selected set the window. Event-kind and Strand display filtering is client-side only and MUST NOT interrupt Commit continuity.

realm_ids · array<$ref ./common-ids.schema.json#/$defs/realm_id>

items · string · $ref ./common-ids.schema.json#/$defs/realm_id

Retyped ak.realm.create Event token. It therefore carries the same fixed current-v1 0x01/SHA-256 content-address identity and is not selected by Realm state.

pattern: ^ak:realm:[A-Za-z0-9_-]{44}$

stream_refs · array<$ref ./realm-commit.schema.json#/$defs/stream_ref>

Optional explicit stream selection for the selected Realms, at most 64 per window. Entries MUST be unique, MUST each name a Realm present in realm_ids, and MUST each be a stream this caller is permitted to see; a member that is not is rejected rather than silently dropped. The Realm stream occupies one slot like any other entry when a group includes it, and a group that omits it is a valid selection. Omitted keeps the current behaviour: the server fills streams[] up to its own 64-entry ceiling and reports streams_limited. When present, the window is the selected set: the server advances the tail of exactly those streams, an omitted stream counts as not delivered rather than delivered-and-empty, and the cursor handle binds filter_digest to this selection, so switching groups needs a new filter and a new cursor while the position each group reached stays retrievable. Discovery of streams added or removed since the selection was made travels through ak.self.realm.read.streams.v1 or the visible discovery delta.

items · oneOf[3] · $ref ./realm-commit.schema.json#/$defs/stream_ref

Closed visibility-stream selector. Realm, each Circle and each Sidecar have independent continuous positions so hidden scopes do not leak through global gaps.

oneOf · oneOf[0] · …

recursion truncated at depth 8; see source schema for full shape

oneOf · oneOf[1] · …

recursion truncated at depth 8; see source schema for full shape

oneOf · oneOf[2] · …

recursion truncated at depth 8; see source schema for full shape

window_limit · integer

Per-VISIBLE-STREAM item ceiling after merging the request targets, same name and same meaning as the response-side realm_sync_entry.streams[].window_limit. For a frozen baseline window it is the cumulative ceiling across every segment of that window; for live delta it applies per frame. Byte budgets only decide segmentation and never lower it. It is deliberately not a per-Realm budget: a bucket-level quota would force the server to divide it across N streams, so one stream being marked limited could mean only that another stream consumed the budget.

example: 20

lazy_load_members · boolean

example: true

include_redundant_members · boolean

example: false

realm_list · $ref #/$defs/realm_list_request · $ref #/$defs/realm_list_request

replace_filter · boolean

example: false

oneOf · oneOf[1] · object

allOf · allOf[0] · ?

after · string · $ref #/$defs/cursor

pattern: ^ak:cursor:[A-Za-z0-9_-]{1,2028}$

catchup · boolean

filter · object · $ref #/$defs/account_filter

An absent or empty realm_ids collection selects no Realm detail. Global account and Realm-summary changes remain subscribed. stream_refs belongs to selected Realms: absent keeps the bounded first screen, while present makes the selected set the window. Event-kind and Strand display filtering is client-side only and MUST NOT interrupt Commit continuity.

realm_ids · array<$ref ./common-ids.schema.json#/$defs/realm_id>

items · string · $ref ./common-ids.schema.json#/$defs/realm_id

Retyped ak.realm.create Event token. It therefore carries the same fixed current-v1 0x01/SHA-256 content-address identity and is not selected by Realm state.

pattern: ^ak:realm:[A-Za-z0-9_-]{44}$

stream_refs · array<$ref ./realm-commit.schema.json#/$defs/stream_ref>

Optional explicit stream selection for the selected Realms, at most 64 per window. Entries MUST be unique, MUST each name a Realm present in realm_ids, and MUST each be a stream this caller is permitted to see; a member that is not is rejected rather than silently dropped. The Realm stream occupies one slot like any other entry when a group includes it, and a group that omits it is a valid selection. Omitted keeps the current behaviour: the server fills streams[] up to its own 64-entry ceiling and reports streams_limited. When present, the window is the selected set: the server advances the tail of exactly those streams, an omitted stream counts as not delivered rather than delivered-and-empty, and the cursor handle binds filter_digest to this selection, so switching groups needs a new filter and a new cursor while the position each group reached stays retrievable. Discovery of streams added or removed since the selection was made travels through ak.self.realm.read.streams.v1 or the visible discovery delta.

items · oneOf[3] · $ref ./realm-commit.schema.json#/$defs/stream_ref

Closed visibility-stream selector. Realm, each Circle and each Sidecar have independent continuous positions so hidden scopes do not leak through global gaps.

oneOf · oneOf[0] · …

recursion truncated at depth 8; see source schema for full shape

oneOf · oneOf[1] · …

recursion truncated at depth 8; see source schema for full shape

oneOf · oneOf[2] · …

recursion truncated at depth 8; see source schema for full shape

window_limit · integer

Per-VISIBLE-STREAM item ceiling after merging the request targets, same name and same meaning as the response-side realm_sync_entry.streams[].window_limit. For a frozen baseline window it is the cumulative ceiling across every segment of that window; for live delta it applies per frame. Byte budgets only decide segmentation and never lower it. It is deliberately not a per-Realm budget: a bucket-level quota would force the server to divide it across N streams, so one stream being marked limited could mean only that another stream consumed the budget.

example: 20

lazy_load_members · boolean

example: true

include_redundant_members · boolean

example: false

* wait_for · string · $ref #/$defs/cursor

pattern: ^ak:cursor:[A-Za-z0-9_-]{1,2028}$

realm_list · object · $ref ./account-subscribe-frame.schema.json#/$defs/realm_list_request

after · $ref #/$defs/cursor_value · $ref #/$defs/cursor_value

limit · integer

example: 20

replace_filter · boolean

example: false

oneOf · oneOf[1] · object · $ref #/$defs/open_events

* kind · const "open"

enum: "open"

* channel_id · string · $ref #/$defs/channel_id

pattern: ^[A-Za-z0-9._~-]{1,64}$

* operation_id · const "ak.self.committed_event.stream.subscribe.v1"

enum: "ak.self.committed_event.stream.subscribe.v1"

* parameters · object · $ref #/$defs/events_open_parameters

anyOf · anyOf[0] · ?

anyOf · anyOf[1] · ?

realm_ids · array<$ref ./common-ids.schema.json#/$defs/realm_id>

items · string · $ref ./common-ids.schema.json#/$defs/realm_id

Retyped ak.realm.create Event token. It therefore carries the same fixed current-v1 0x01/SHA-256 content-address identity and is not selected by Realm state.

pattern: ^ak:realm:[A-Za-z0-9_-]{44}$

actor_ids · array<$ref ./common-ids.schema.json#/$defs/actor_id>

items · oneOf[2] · $ref ./common-ids.schema.json#/$defs/actor_id

Complete protocol identity for an Event author or Realm member: account carries the exact AccountId for every Station-hosted principal; service identifies a service acting as itself. The discriminator is validated against accepted registration and admission evidence; it never authorizes itself. Account and service are distinct, and no comparison may fall back to a bare principal_id. Agent and integration classification, provisioning, controller binding and credential authorization are independently verified facts, not identity variants. Account actors at different Stations MUST NOT share or inherit authority merely because their principal_id, DID controller or signing key matches, including membership, capability, RealmCommit-signing and recovery authority.

oneOf · oneOf[0] · object

* kind · const "account"

enum: "account"

* account_id · $ref #/$defs/account_id · $ref #/$defs/account_id

oneOf · oneOf[1] · object

* kind · const "service"

enum: "service"

* service_id · $ref #/$defs/did_core_id · $ref #/$defs/did_core_id

after · string · $ref #/$defs/cursor

pattern: ^ak:cursor:[A-Za-z0-9_-]{1,2028}$

catchup · boolean

oneOf · oneOf[2] · object · $ref #/$defs/open_signal

* kind · const "open"

enum: "open"

* channel_id · string · $ref #/$defs/channel_id

pattern: ^[A-Za-z0-9._~-]{1,64}$

* operation_id · const "ak.self.signal.stream.subscribe.v1"

enum: "ak.self.signal.stream.subscribe.v1"

* parameters · object · $ref #/$defs/signal_open_parameters

oneOf · oneOf[2] · object · $ref #/$defs/close

* kind · const "close"

enum: "close"

* channel_id · string · $ref #/$defs/channel_id

pattern: ^[A-Za-z0-9._~-]{1,64}$

* reason · string (enum)

enum: "client_request" "transport_switch"

oneOf · oneOf[3] · object · $ref #/$defs/pong

* kind · const "pong"

enum: "pong"

* ping_id · string

pattern: ^[A-Za-z0-9_-]{16,128}$

Source

• registry row: spec/v1/artifacts/registry/schema-registry.json
• schema document: spec/v1/artifacts/schemas/websocket-frame.schema.json