Přeskočit obsah

Federation Service Endorsement v1

Source schema: doc/schemas/federation-service-endorsement.v1.schema.json

Signed federation-level vouch that a service node is official for one capability in one federation. This artifact is the official-status proof; capability-passport.v1 remains the scope/advertisement artifact. The endorsement names the sovereign subject explicitly through endorser_subject_ref so verifiers know which active federation-root subject and custody policy to evaluate. Runtime verification checks signatures, active identity.sovereign_subject_refs[], participant/org custody semantics, expiry, revocation, and local endorsement-multiplicity policy.

Governing Basis

Project Lineage

Requirements

Stories

Fields

Field Required Shape Description
schema yes const: federation-service-endorsement.v1 Schema discriminator. MUST be exactly federation-service-endorsement.v1.
endorsement_id yes string Stable identifier for this endorsement. Revocation records target this value.
federation_id yes string Federation selector whose active federation-root is used to resolve endorser_subject_ref.
node_id yes string Service node being endorsed. MUST match the capability registration / service being consumed.
capability_id yes string Capability for which this node is federation-official, e.g. seed-directory, offer-catalog, or network-ledger.
endorser_subject_ref yes string Sovereign subject from the active federation root that vouches for the service. Participant subjects require their own key as the sole signer; org subjects require the signer set to satisfy that org's federation-root custody policy.
issued_at yes string RFC 3339 issuance timestamp. Diagnostic; expiry and revocation determine validity.
expires_at yes string RFC 3339 expiry timestamp. Verifiers MUST reject endorsements at or after this time.
policy_ref no string Optional policy document governing this endorsement. Informational unless a local verifier policy binds it.
revocation_ref no string Optional revocation feed reference where endorsement revocations are expected to appear.
signatures yes array One or more Ed25519 signatures over the canonical endorsement payload with signatures omitted. Runtime verification enforces unique signing keys and participant/org custody thresholds.

Definitions

Definition Shape Description
Signature object
## Field Semantics

schema

  • Required: yes
  • Shape: const: federation-service-endorsement.v1

Schema discriminator. MUST be exactly federation-service-endorsement.v1.

endorsement_id

  • Required: yes
  • Shape: string

Stable identifier for this endorsement. Revocation records target this value.

federation_id

  • Required: yes
  • Shape: string

Federation selector whose active federation-root is used to resolve endorser_subject_ref.

node_id

  • Required: yes
  • Shape: string

Service node being endorsed. MUST match the capability registration / service being consumed.

capability_id

  • Required: yes
  • Shape: string

Capability for which this node is federation-official, e.g. seed-directory, offer-catalog, or network-ledger.

endorser_subject_ref

  • Required: yes
  • Shape: string

Sovereign subject from the active federation root that vouches for the service. Participant subjects require their own key as the sole signer; org subjects require the signer set to satisfy that org's federation-root custody policy.

issued_at

  • Required: yes
  • Shape: string

RFC 3339 issuance timestamp. Diagnostic; expiry and revocation determine validity.

expires_at

  • Required: yes
  • Shape: string

RFC 3339 expiry timestamp. Verifiers MUST reject endorsements at or after this time.

policy_ref

  • Required: no
  • Shape: string

Optional policy document governing this endorsement. Informational unless a local verifier policy binds it.

revocation_ref

  • Required: no
  • Shape: string

Optional revocation feed reference where endorsement revocations are expected to appear.

signatures

  • Required: yes
  • Shape: array

One or more Ed25519 signatures over the canonical endorsement payload with signatures omitted. Runtime verification enforces unique signing keys and participant/org custody thresholds.

Definition Semantics

$defs.Signature

  • Shape: object