{
  "federation": "faithchain-neutral-ground",
  "registry": {
    "chainId": 34348,
    "chain": "faithchain",
    "address": "0xb4E116F5C6915a4f1e649E0877e4a0A7a1c1147b",
    "deployed": "2026-10-13",
    "deployTx": "script/DeployEstateProjectionRegistry.s.sol (Ring 0 packages/contracts)",
    "rpcEnv": "FEDERATION_RPC_URL",
    "source": "ring-0 deployments-faithchain.json (2026-10-13)"
  },
  "estates": [
    {
      "id": "imbnet",
      "chainId": 34348,
      "home": "https://www.impact-agent.me",
      "a2a": "https://a2a.impact-agent.io",
      "governance": "0x4457aadf6ADeB31bA8F166fafcC0d0579ECd1015",
      "governanceKind": "estate-agent",
      "governanceName": "imbnet.estate",
      "signer": "0xAdcd7257De9686061C0838154cA77790C79a9EfD",
      "signerKeyEnv": "IMBNET_PROJECTION_SIGNER",
      "delegationManager": "0x710cb1bF08C234Df397e0910331e0A29710EF4F7",
      "profileResolver": "0xB03F7C06ad3274F584AB72794406D639c02A45e1",
      "declaredOnChain": false
    },
    {
      "id": "faithnet",
      "chainId": 34348,
      "home": "https://www.faithnet.me",
      "a2a": "https://a2a.faithnet.io",
      "governance": null,
      "governanceKind": "none",
      "blocked": "no estate agent: `faithnet.estate` is unregistered and faithnet's people declare no `atl:estate`. Deploy the estate agent + register the name (ap-home scripts/add-estate-agent.mts, Ring 0 script/AddEstateName.s.sol), then set `governance` to its SA."
    }
  ],
  "towns": [
    {
      "id": "faithchain",
      "chainId": 34348,
      "status": "live",
      "repo": "agentictrustlabs/ap-town",
      "manifest": "https://raw.githubusercontent.com/agentictrustlabs/ap-town/master/towns/faithchain/town.yaml",
      "agent": "https://town.faithnet.io",
      "portal": "https://town.faithnet.io",
      "naming": "https://names.faithnet.io",
      "registry": "https://discovery-a2a.faithnet.io",
      "rpc": "https://rpc.faithnet.io"
    },
    {
      "id": "base-sepolia",
      "chainId": 84532,
      "status": "retired",
      "repo": "agentictrustlabs/ap-town",
      "manifest": "https://raw.githubusercontent.com/agentictrustlabs/ap-town/master/towns/base-sepolia/town.yaml",
      "note": "The impact demos' town (ap-town spec 429 §12.3). Its discovery list was decommissioned 2026-10-13; the manifest stays as the record of what stood there. Not probed, not queried for names."
    }
  ],
  "doors": [
    {
      "estate": "imbnet",
      "url": "https://door.ap-federation.faithnet.io",
      "target": "maya-fernandes.me",
      "since": "2026-10-14"
    }
  ],
  "kms": {
    "operator": "ap-federation",
    "operatorRole": "the AKCS operator (`akcs operator …` on the CVM via `az vm run-command`) — one holder today, the owner; a second holder is a posture item (spec 407 D10)",
    "repo": "agentictrustlabs/faithkms",
    "backend": "akcs",
    "host": "akcs-pilot.faithnet.io",
    "hostPlanned": "kms.faithnet.io",
    "probe": "https://akcs-pilot.faithnet.io/healthz",
    "attestation": null,
    "azureResources": [
      "/subscriptions/5a656e13-849d-4b56-9101-53f987cf971b/resourceGroups/RG-AKCS-PILOT-WESTUS/providers/Microsoft.Compute/virtualMachines/vm-akcs-pilot-0",
      "/subscriptions/5a656e13-849d-4b56-9101-53f987cf971b/resourceGroups/RG-AKCS-PILOT-WESTUS/providers/Microsoft.Compute/virtualMachines/vm-akcs-tunnel-pilot"
    ],
    "platformRoots": [
      {
        "provider": "azure-key-vault",
        "vault": "kv-akcs-pilot-vrw42jcwx4",
        "key": "akcs-platform-root-wrap",
        "state": "ACTIVE",
        "billable": true
      }
    ],
    "billableKeyBudget": 2,
    "evidence": {
      "checked": "2026-10-14",
      "logicalKeys": 433,
      "byProtection": {
        "CVM_WRAPPED": 433
      },
      "keyVaultCostMonthToDate": "5.00 USD — one Premium HSM-protected advanced key; key operations 0.00 USD",
      "note": "the Azure spend that month-to-date (323.85 USD) is compute, Bastion, Postgres, the registry and disks, not keys"
    },
    "protectionLevels": [
      "CVM_WRAPPED",
      "CVM_DERIVED"
    ],
    "costRule": "a couple of HSM root keys are the whole Azure spend; every agent key derives from them for free. AZURE_HSM_DIRECT is a billable Key Vault HSM key per key and is never bound by default — a caller that needs one names the estate that pays (billedTo).",
    "tenants": [
      {
        "tenant": "faithnet",
        "estate": "faithnet",
        "town": "faithchain",
        "backend": "akcs",
        "callers": [
          {
            "subject": "demo-a2a-faithnet",
            "worker": "demo-a2a-faithnet",
            "operations": [
              "*"
            ],
            "protectionLevels": [
              "CVM_WRAPPED"
            ]
          },
          {
            "subject": "skills-a2a-faithnet",
            "worker": "skills-a2a",
            "operations": [
              "key-public-key",
              "key-sign"
            ],
            "protectionLevels": [
              "CVM_WRAPPED"
            ]
          },
          {
            "subject": "field-a2a-faithnet",
            "worker": "field-a2a-faithnet",
            "operations": [
              "key-public-key",
              "key-sign"
            ],
            "protectionLevels": [
              "CVM_WRAPPED"
            ]
          },
          {
            "subject": "gather27-a2a-faithnet",
            "worker": "gather27-a2a-faithnet",
            "operations": [
              "key-public-key",
              "key-sign"
            ],
            "protectionLevels": [
              "CVM_WRAPPED"
            ]
          },
          {
            "subject": "gather27-a2a-churchglobal",
            "worker": "gather27-a2a-churchglobal",
            "operations": [
              "key-public-key",
              "key-sign"
            ],
            "protectionLevels": [
              "CVM_WRAPPED"
            ]
          },
          {
            "subject": "demo-bible-mcp-faithnet",
            "worker": "demo-bible-mcp-faithnet",
            "operations": [
              "key-public-key",
              "key-sign"
            ],
            "protectionLevels": [
              "CVM_WRAPPED"
            ]
          },
          {
            "subject": "scripture-validator",
            "operations": [
              "key-public-key",
              "key-sign"
            ],
            "protectionLevels": [
              "CVM_WRAPPED"
            ]
          },
          {
            "subject": "coach-a2a-faithnet",
            "worker": "coach-a2a-faithnet",
            "operations": [
              "key-public-key",
              "key-sign"
            ],
            "protectionLevels": [
              "CVM_WRAPPED"
            ]
          }
        ],
        "sharedCredential": true,
        "note": "demo-a2a-faithnet is bound with operations * — re-bind it per operation (runbook step 2) and disable it; gather27-churchglobal-faithnet is already DISABLED and not listed"
      },
      {
        "tenant": "impact",
        "estate": "impact",
        "town": "base-sepolia",
        "backend": "akcs",
        "callers": [
          {
            "subject": "engage-a2a-production",
            "operations": [
              "key-public-key",
              "key-sign"
            ],
            "protectionLevels": [
              "CVM_WRAPPED"
            ]
          },
          {
            "subject": "field-a2a-production",
            "operations": [
              "key-public-key",
              "key-sign"
            ],
            "protectionLevels": [
              "CVM_WRAPPED"
            ]
          },
          {
            "subject": "gather27-a2a-production",
            "operations": [
              "key-public-key",
              "key-sign"
            ],
            "protectionLevels": [
              "CVM_WRAPPED"
            ]
          }
        ],
        "note": "3 logical keys (service-agent delegates); the town is retired — disable or keep is the owner's call"
      },
      {
        "tenant": "imb",
        "estate": "imbnet",
        "town": "faithchain",
        "backend": "akcs",
        "callers": [
          {
            "subject": "imb-vault-2",
            "worker": "imb-vault",
            "operations": [
              "data-key-generate",
              "data-key-unwrap",
              "mac-generate",
              "key-create"
            ],
            "protectionLevels": [
              "CVM_WRAPPED",
              "CVM_DERIVED"
            ],
            "since": "2026-10-11"
          },
          {
            "subject": "imb-runtime-2",
            "worker": "imb-runtime",
            "operations": [
              "mac-generate"
            ],
            "protectionLevels": [
              "CVM_WRAPPED",
              "CVM_DERIVED"
            ],
            "since": "2026-10-11"
          }
        ],
        "note": "bound with --audiences urn:mcp:server:person --purposes '*' (one KEK purpose per person); the -2 subjects replaced imb-vault / imb-runtime, which are DISABLED on the CVM; 7 logical keys"
      }
    ],
    "conditions": [
      {
        "id": 1,
        "condition": "No shared caller credential — one least-privilege bind-caller per Worker per estate (closes spec 407 D10)",
        "status": "open",
        "detail": "imbnet met (two callers, 2026-10-11); faithnet's pilot credential is still shared across its Workers — close before a third estate binds"
      },
      {
        "id": 2,
        "condition": "One tenant per estate; a tenant is never shared and an estate never has two",
        "status": "met",
        "detail": "checked by scripts/check-federation.mts over this record"
      },
      {
        "id": 3,
        "condition": "CVM protection levels only; AZURE_HSM_DIRECT never bound without a named payer",
        "status": "met",
        "detail": "protectionLevels above; the check refuses a caller with AZURE_HSM_DIRECT and no billedTo"
      },
      {
        "id": 4,
        "condition": "The CVM attestation document is published at the operator host and linked from this record",
        "status": "open",
        "detail": "operator action — spec 440 A5 step 4"
      }
    ]
  },
  "naming": {
    "rootChain": 34348,
    "rootRegistry": "0x60E949D52660A9D4143ecB0fdA56c0457f20aED9",
    "universalResolver": "0xF343054e046A4145ccae499ECB28197394eE0798",
    "roots": [
      "me",
      "org",
      "team",
      "svc",
      "workspace",
      "treasury",
      "registry",
      "church",
      "circle",
      "household",
      "estate"
    ],
    "resolver": "https://ap-federation.faithnet.io/api/names",
    "note": "the priced roots' governor is naming.svc under the town clerk persona (ap-town spec 431) — the one trust position a shared root creates; spec 440 C7 names it, Ring 0 decides its council shape"
  },
  "registerErrors": [],
  "generatedBy": "ap-federation apps/site",
  "readOnly": true
}