{"registry":"0x6167656e747072696e636970616c73","name":"agentprincipals","role":"principal registry graph","description":"Records the principals that can invoke charters — human, agent or organization. Pseudonymous and privacy-neutral: no contact or off-graph identity information is held here. / and /parameters are open; everything that shows principal records or activity is a permissioned read (a signed read, answered by what the reader may read); writes are signed by recognized writers.","endpoints":{"open":["/","/parameters"],"permissioned":["/lookup?id=","/peek?limit=","/feed.md?limit="],"signed":["/signed/<event_id>"],"tier1":["POST /principals"],"push":"POST /push"},"permissioned_reads":{"enforced":false,"readers":{"observer":"an approved observer (observer_identity, on the push's full_read list) reads everything","venue":"a venue (venue_identity) reads the principals it wrote any version of; a handshake card unlocks nothing here","agent":"refused: a principal record is not a record whose subject is an agent; principal self-reads come after v1"},"headers":["X-Provenance-Key-Id","X-Provenance-Key-Binding","X-Provenance-Signature","X-Provenance-Emitted-At"],"signed_region":"canonicalize({method, path, graph, emitted_at}): path is the pathname plus the query, graph this host","refusal":"HTTP 401 `read_refused`, the same for every refused read and never 404"},"write_envelope":{"signature_algorithm":"Ed25519","headers_required":["X-Provenance-Signature","X-Provenance-Key-Binding"],"headers_optional":["X-Provenance-Key-Id"],"note":"X-Provenance-Key-Id is an OPTIONAL correlation handle, recorded for forensics and never used to verify. The operational public key is taken from the key binding."},"write_response":{"note":"All outcomes are HTTP 200. Structured errors (4xx) carry an `error` code instead.","principals":{"applied":"a new version row was appended","duplicate":"this event_id was already recorded for identical content; idempotent no-op (not an error)","current":"boolean on every success: whether the version this write names is the principal's current version, its chain tip, which GET /lookup serves. `applied` means stored; `current` says whether it was the current version when the registry answered (read after the insert, so a successor landing in between gives `applied` with `current: false`). On `duplicate`, false once a later version has superseded it."}},"parameter_set_version":"ps-v1"}