# org.governedcrossing.temp.defs

> Published by [localboundary.bsky.social](https://lexicon.garden/identity/did:plc:4xoefmmbsulm4xns3kbb6mnk)

✓ This is the authoritative definition for this NSID.

## Description

DRAFT in the temp namespace; may change without notice. Shared definitions for governed crossing records: the inline signature type, record references, and the substrate-crossing extensions. An AT Protocol binding of the seam:CrossingRecord vocabulary (https://jediwright.github.io/seam-stack/vocab/crossing-record/0.1#), which is the semantic contract.

## Links

- [View on Lexicon Garden](https://lexicon.garden/lexicon/did:plc:4xoefmmbsulm4xns3kbb6mnk/org.governedcrossing.temp.defs)
- [Documentation](https://lexicon.garden/lexicon/did:plc:4xoefmmbsulm4xns3kbb6mnk/org.governedcrossing.temp.defs/docs)
- [Examples](https://lexicon.garden/lexicon/did:plc:4xoefmmbsulm4xns3kbb6mnk/org.governedcrossing.temp.defs/examples)

## Definitions

### `org.governedcrossing.temp.defs#crossingCompletion`

**Type**: `object`

Instance extension for recordType crossing-completion (governanceEvent substrate-crossing). Must be emitted whenever the emitter observes that the crossing act succeeded, including after crossingTimeoutHorizon; the intent is referenced by the record's chainReference.

| Property | Type | Required | Description |
|----------|------|----------|-------------|
| `completedAt` | `string` (datetime) | Yes |  |
| `crossingOutcome` | `string` | Yes |  |
| `crossingTargetCID` | `string` (cid) | Yes |  |
| `crossingTargetURI` | `string` (uri) | Yes |  |
| `relayIngestedAt` | `string` (datetime) | No |  |
| `targetAcceptedAt` | `string` (datetime) | No | When the target service accepted the write (a PDS for AT Protocol). |

### `org.governedcrossing.temp.defs#crossingIntent`

**Type**: `object`

Instance extension for recordType crossing-intent (governanceEvent substrate-crossing). Emitted before the crossing act. Carries digests and references of what crosses, never the content.

| Property | Type | Required | Description |
|----------|------|----------|-------------|
| `authorizedContentDigest` | `string` | Yes | Digest of the content authorized to cross, bound at grant time. |
| `crossingGrantHorizon` | `string` (datetime) | No | Optional not-before horizon. |
| `crossingTimeoutHorizon` | `string` (datetime) | Yes |  |
| `crossingType` | `string` | Yes |  |
| `declaredBoundType` | `string` | Yes |  |
| `gateCheckedAt` | `string` (datetime) | Yes |  |
| `gateResult` | `string` | Yes | A record of a blocked gate check is never published in any form (no commitment, no projection); it stays on the party's substrate. |
| `grantReference` | `string` | Yes |  |
| `grantorDID` | `string` (did) | Yes |  |
| `identityCustodyClass` | `string` | Yes |  |
| `recallSemantics` | `string` | Yes |  |
| `regimeAcknowledgment` | `string` | Yes | Declared acknowledgment; the gate checks presence, not authorship. |
| `sourceDocumentCID` | `string` | Yes | Content address or heads of the source document at mint; backdating-detectability anchor, no verification claim. |
| `sourceDocumentURI` | `string` (uri) | Yes |  |
| `sourceLineage` | `array` | No |  |
| `targetDID` | `string` (did) | Yes |  |
| `targetLexicon` | `string` (nsid) | Yes | Schema of the record in the target regime (AT Protocol crossings). |
| `targetService` | `string` (uri) | Yes | Service the crossing writes to (a PDS for AT Protocol). |

### `org.governedcrossing.temp.defs#recordRef`

**Type**: `object`

Reference to another crossing record. `recordId` is the record's substrate-independent identifier. `cid` is its link CID: the CIDv1 (DAG-CBOR, sha2-256) of the record with `signatures`, every `$type` key at any depth, `provenanceStatus`, `provenanceStatusBasis` and `supersededBy` removed, and no `$sig` inserted. A content address, not a signature or proof.

| Property | Type | Required | Description |
|----------|------|----------|-------------|
| `cid` | `string` (cid) | Yes |  |
| `recordId` | `string` (uri) | Yes |  |

### `org.governedcrossing.temp.defs#signature`

**Type**: `object`

Inline signature per the ATProtocol Attestation Specification v1.0. Signs the CIDv1 (DAG-CBOR, sha2-256) of the record with `signatures` removed and a `$sig` object inserted, where `$sig` is this signature object minus `signature`, plus `repository` set to the record's `emittedBy` DID. Because `key` and `role` enter `$sig`, each signer's CID is distinct; every signer covers the same record content. ECDSA P-256 or K-256, low-S.

| Property | Type | Required | Description |
|----------|------|----------|-------------|
| `key` | `string` | Yes | Full DID verification method reference (did:...#fragment). A dedicated verification method is advised so key rotation does not orphan signatures. |
| `role` | `string` | No | Signer's role in the crossing. |
| `signature` | `bytes` | Yes | ECDSA signature over the CID bytes, low-S form. |

### `org.governedcrossing.temp.defs#sourceLineageEntry`

**Type**: `object`

One granted input the crossed content was assembled from. Informational lineage; the binding digest is crossingIntent.authorizedContentDigest.

| Property | Type | Required | Description |
|----------|------|----------|-------------|
| `contentDigest` | `string` | Yes |  |
| `documentCID` | `string` | Yes | Content address or heads of the input document at assembly. |
| `documentURI` | `string` (uri) | Yes |  |

## Raw Schema

```json
{
  "$type": "com.atproto.lexicon.schema",
  "defs": {
    "crossingCompletion": {
      "description": "Instance extension for recordType crossing-completion (governanceEvent substrate-crossing). Must be emitted whenever the emitter observes that the crossing act succeeded, including after crossingTimeoutHorizon; the intent is referenced by the record's chainReference.",
      "properties": {
        "completedAt": {
          "format": "datetime",
          "type": "string"
        },
        "crossingOutcome": {
          "knownValues": [
            "completed"
          ],
          "maxLength": 32,
          "type": "string"
        },
        "crossingTargetCID": {
          "format": "cid",
          "type": "string"
        },
        "crossingTargetURI": {
          "format": "uri",
          "maxLength": 2048,
          "type": "string"
        },
        "relayIngestedAt": {
          "format": "datetime",
          "type": "string"
        },
        "targetAcceptedAt": {
          "description": "When the target service accepted the write (a PDS for AT Protocol).",
          "format": "datetime",
          "type": "string"
        }
      },
      "required": [
        "crossingTargetURI",
        "crossingTargetCID",
        "completedAt",
        "crossingOutcome"
      ],
      "type": "object"
    },
    "crossingIntent": {
      "description": "Instance extension for recordType crossing-intent (governanceEvent substrate-crossing). Emitted before the crossing act. Carries digests and references of what crosses, never the content.",
      "properties": {
        "authorizedContentDigest": {
          "description": "Digest of the content authorized to cross, bound at grant time.",
          "maxLength": 256,
          "type": "string"
        },
        "crossingGrantHorizon": {
          "description": "Optional not-before horizon.",
          "format": "datetime",
          "type": "string"
        },
        "crossingTimeoutHorizon": {
          "format": "datetime",
          "type": "string"
        },
        "crossingType": {
          "knownValues": [
            "publication"
          ],
          "maxLength": 64,
          "type": "string"
        },
        "declaredBoundType": {
          "knownValues": [
            "exposure-unbounded",
            "exposure-upper-bound",
            "confirmation",
            "attestation"
          ],
          "maxLength": 64,
          "type": "string"
        },
        "gateCheckedAt": {
          "format": "datetime",
          "type": "string"
        },
        "gateResult": {
          "description": "A record of a blocked gate check is never published in any form (no commitment, no projection); it stays on the party's substrate.",
          "knownValues": [
            "pass",
            "blocked"
          ],
          "maxLength": 32,
          "type": "string"
        },
        "grantReference": {
          "maxLength": 1024,
          "type": "string"
        },
        "grantorDID": {
          "format": "did",
          "type": "string"
        },
        "identityCustodyClass": {
          "knownValues": [
            "self-custodied",
            "mixed-custody",
            "provider-custodied"
          ],
          "maxLength": 64,
          "type": "string"
        },
        "recallSemantics": {
          "knownValues": [
            "enforced-stream-close",
            "propagated-request",
            "none"
          ],
          "maxLength": 64,
          "type": "string"
        },
        "regimeAcknowledgment": {
          "description": "Declared acknowledgment; the gate checks presence, not authorship.",
          "maxGraphemes": 1000,
          "maxLength": 3000,
          "type": "string"
        },
        "sourceDocumentCID": {
          "description": "Content address or heads of the source document at mint; backdating-detectability anchor, no verification claim.",
          "maxLength": 4096,
          "type": "string"
        },
        "sourceDocumentURI": {
          "format": "uri",
          "maxLength": 2048,
          "type": "string"
        },
        "sourceLineage": {
          "items": {
            "ref": "#sourceLineageEntry",
            "type": "ref"
          },
          "maxLength": 256,
          "type": "array"
        },
        "targetDID": {
          "format": "did",
          "type": "string"
        },
        "targetLexicon": {
          "description": "Schema of the record in the target regime (AT Protocol crossings).",
          "format": "nsid",
          "type": "string"
        },
        "targetService": {
          "description": "Service the crossing writes to (a PDS for AT Protocol).",
          "format": "uri",
          "maxLength": 2048,
          "type": "string"
        }
      },
      "required": [
        "grantorDID",
        "targetDID",
        "identityCustodyClass",
        "sourceDocumentURI",
        "sourceDocumentCID",
        "authorizedContentDigest",
        "targetLexicon",
        "targetService",
        "crossingType",
        "regimeAcknowledgment",
        "declaredBoundType",
        "recallSemantics",
        "crossingTimeoutHorizon",
        "grantReference",
        "gateResult",
        "gateCheckedAt"
      ],
      "type": "object"
    },
    "recordRef": {
      "description": "Reference to another crossing record. `recordId` is the record's substrate-independent identifier. `cid` is its link CID: the CIDv1 (DAG-CBOR, sha2-256) of the record with `signatures`, every `$type` key at any depth, `provenanceStatus`, `provenanceStatusBasis` and `supersededBy` removed, and no `$sig` inserted. A content address, not a signature or proof.",
      "properties": {
        "cid": {
          "format": "cid",
          "type": "string"
        },
        "recordId": {
          "format": "uri",
          "maxLength": 2048,
          "type": "string"
        }
      },
      "required": [
        "recordId",
        "cid"
      ],
      "type": "object"
    },
    "signature": {
      "description": "Inline signature per the ATProtocol Attestation Specification v1.0. Signs the CIDv1 (DAG-CBOR, sha2-256) of the record with `signatures` removed and a `$sig` object inserted, where `$sig` is this signature object minus `signature`, plus `repository` set to the record's `emittedBy` DID. Because `key` and `role` enter `$sig`, each signer's CID is distinct; every signer covers the same record content. ECDSA P-256 or K-256, low-S.",
      "properties": {
        "key": {
          "description": "Full DID verification method reference (did:...#fragment). A dedicated verification method is advised so key rotation does not orphan signatures.",
          "maxLength": 2048,
          "type": "string"
        },
        "role": {
          "description": "Signer's role in the crossing.",
          "knownValues": [
            "emitter",
            "counterparty",
            "institution"
          ],
          "maxLength": 64,
          "type": "string"
        },
        "signature": {
          "description": "ECDSA signature over the CID bytes, low-S form.",
          "type": "bytes"
        }
      },
      "required": [
        "signature",
        "key"
      ],
      "type": "object"
    },
    "sourceLineageEntry": {
      "description": "One granted input the crossed content was assembled from. Informational lineage; the binding digest is crossingIntent.authorizedContentDigest.",
      "properties": {
        "contentDigest": {
          "maxLength": 256,
          "type": "string"
        },
        "documentCID": {
          "description": "Content address or heads of the input document at assembly.",
          "maxLength": 4096,
          "type": "string"
        },
        "documentURI": {
          "format": "uri",
          "maxLength": 2048,
          "type": "string"
        }
      },
      "required": [
        "documentURI",
        "documentCID",
        "contentDigest"
      ],
      "type": "object"
    }
  },
  "description": "DRAFT in the temp namespace; may change without notice. Shared definitions for governed crossing records: the inline signature type, record references, and the substrate-crossing extensions. An AT Protocol binding of the seam:CrossingRecord vocabulary (https://jediwright.github.io/seam-stack/vocab/crossing-record/0.1#), which is the semantic contract.",
  "id": "org.governedcrossing.temp.defs",
  "lexicon": 1
}
```