Identity and publishers

Identity fields

entryDid identifies the registered entity. publisherDid identifies its publisher. signature.keyId selects a verification key controlled by that publisher. Entry kind, DID kind, payload, and key binding are validated separately.

HumanRootRecord and MultiHumanRootRecord are the canonical wire names for HMR/MHR entries. A record's existence does not establish a verified human ceremony. Verification depends on the identity proof, issuer, and configured trust policy.

Key resolution

Operator pins are resolved before registry-stored keys. Production trust policy requires publisher pins and disables implicit self-signed bootstrap by default. A valid mathematical signature from an untrusted key is insufficient for authorized publication.

Lineage and authorization

Lineage is optional entry metadata and is not the same as session capabilities. SIWS turns supported credential proofs into a MARS principal; HTTP middleware authorizes that principal using MARS capabilities. See OpenAgentID documentation for the identity protocol and authentication for the registry boundary.

Source authority

This page describes the checked-in implementation, not the availability of a public registry.

• mars-protocol/src/entry.rs
• mars-server/src/validation/resolver.rs
• mars-server/src/config.rs
• mars-server/src/auth/principal.rs