Lexicon Garden

tech.lenooby09.kvcs.tag

A signed kvcs tag record. Pins a patch by its hex multihash and is itself addressed by the canonical-JSON digest of its tag payload, mirrored on disk as a SignedTag.

Repository @lenooby09.twinkers.online did:plc:xocoka6dmx74ciqskczoh6ci namespace authority
Details · record, key any
Kindrecord
Record keyany
Authoritykvcs.lenooby09.tech
Indexed
Compare Edit in builder → Fork →

Record

record · key any

Properties

digest

requiredstring

Lower-case hex BLAKE3 multihash of the canonical-JSON tag payload — equals the record's rkey. 128 chars covers the longest hashes in current use.

  • maxLength: 128

jws

requiredstring

Detached compact JWS over `tag`. 8192 chars covers Ed25519 / ES256 / ES256K compact-JWS sizes with a comfortable margin.

  • maxLength: 8192

name

requiredstring

Human-readable tag label (e.g. "v0.1.0"). Capped at 256 chars — kvcs tag labels are short identifiers similar to git tag names.

  • maxLength: 256

patchId

requiredstring

Hex multihash of the patch this tag pins. 128 chars covers the longest hashes in current use (BLAKE3, SHA-512, etc.).

  • maxLength: 128

tag

requiredstring

Canonical JSON of the Tag payload, bytewise identical to the JWS input. 16 KiB is well under goat's 20 KiB `large-string` lint threshold while still being generous for the small structured payloads kvcs emits today; future fields (e.g. signed annotations) still fit comfortably.

  • maxLength: 16384

taggerDid

requiredstring

DID of the signer, mirrored at the top level so listRecords summaries don't need to parse `tag`. Capped at 2048 chars to accommodate did:jwk values whose method-specific id embeds a base64url-encoded JWK.

  • maxLength: 2048

Similar lexicons

semantic match

Lexicons whose schemas describe something close to this one. Check them before publishing a new one that overlaps.

  • tech.lenooby09.kvcs.patch

    record

    A signed kvcs patch envelope, addressable on the author's atproto PDS. The rkey is the patch id in hex.

  • tech.lenooby09.kvcs.signingKey

    record

    An atproto identity (did:plc / did:web) endorses a local kvcs patch-signing key (did:key / did:jwk) by hosting this record on its PDS. Existence of the record over an OAuth-authenticated write proves the atproto DID consented to the binding; the inner JWS proves the local key consented in turn.

  • dev.keytrace.signature

    object

    A cryptographic signature attesting to a claim

  • tech.lenooby09.didgit.signatureProof

    record

    A cryptographic proof that a did-git object was signed by a specific DID. This provides key-rotation-independent verification by anchoring the proof to a PDS or signing event.

  • network.attested.signature

    object not from the namespace authority

    An inline attestation: an ECDSA signature over a canonical attestation CID, embedded directly in a record's `signatures` array. The CID is computed from the record (signatures stripped), this entry's metadata (cid/signature stripped, `repository` = authoring repo DID added) inserted as $sig, DAG-CBOR + SHA-256 + CIDv1 (dag-cbor codec). Signatures are low-S normalized; supported curves are P-256 and K-256 (did:key). This is the shared network.attested.* vocabulary any speaker can verify.