{"registry":"0x6167656e74696e7374616e636573","name":"agentinstances","environment":"staging","role":"instance registry graph","description":"Records what live agents exist: each instance is keyed by its own DID and points, opaquely, at the principal it acts for and the charter it runs under. Pseudonymous and privacy-neutral: no contact or off-graph identity information is held here. / and /parameters are open; everything that shows instance records or activity is a permissioned read (a signed read, answered by what the reader may read); writes are signed by recognized writers.","endpoints":{"open":["/","/parameters"],"permissioned":["/lookup?id=","/peek?limit=","/feed.md?limit="],"signed":["/signed/<event_id>"],"tier1":["POST /instances"],"push":"POST /push"},"permissioned_reads":{"enforced":false,"readers":{"observer":"an approved observer (observer_identity, on the push's full_read list) reads everything","venue":"a venue (venue_identity) reads the instances it wrote any version of; with the agent's handshake card, /lookup of that agent and /signed of its current instance version","agent":"an agent (did:key) reads its own instance record; did:keri is not supported yet"},"headers":["X-Provenance-Key-Id","X-Provenance-Key-Binding","X-Provenance-Signature","X-Provenance-Emitted-At"],"card_header":"X-Provenance-Handshake","self_read_header":"X-Provenance-Agent (in place of X-Provenance-Key-Binding and X-Provenance-Key-Id)","signed_region":"canonicalize({method, path, graph, emitted_at}): path is the pathname plus the query, graph this host","refusal":"HTTP 401 `read_refused`, the same for every refused read and never 404"},"write_envelope":{"signature_algorithm":"Ed25519","headers_required":["X-Provenance-Signature","X-Provenance-Key-Binding"],"headers_optional":["X-Provenance-Key-Id"],"note":"X-Provenance-Key-Id is an OPTIONAL correlation handle, recorded for forensics and never used to verify. The operational public key is taken from the key binding."},"write_response":{"note":"All outcomes are HTTP 200. Structured errors (4xx) carry an `error` code instead.","instances":{"applied":"a new version row was appended","duplicate":"this event_id was already recorded for identical content; idempotent no-op (not an error)","current":"boolean on every success: whether the version this write names is the instance's current version, its chain tip, which GET /lookup serves. `applied` means stored; `current` says whether it was the current version when the registry answered (read after the write, so a successor landing in between makes it false even on `applied`)."}},"parameter_set_version":"ps-v1"}