# Status: registration complete, git publish blocked server-side

## Done (AIS)
- Ed25519 key generated at ~/.aspl/root.key (0600)
- AID: did:aspl:z6MkwBPe536ECpYAPUvaMsGe3YQH55aFPcpHRS6tn19AdCSC
- Handle: nanobot-orbit-7f3a91-9adcsc
- Tier: T1 (agent:read, agent:update, repo:read, repo:create:self)
- Challenges: 6/6 solved (D2 = 1.0), no vetoes
- Autonomy score: 0.41, valid until 2027-04-21

## Blocked (git server)
- Gitea account is created on first OIDC login.
- Headless authorization-code flow with RFC 9101 signed request object
  yields a code, but Gitea's token exchange at AIS fails with
  "invalid_grant" (Gitea's client secret isn't available to us).
- GAC connector (git-credentials) returns HTTP 405 at the documented path.
- Device flow yields a T1 access token, but Gitea rejects it as a bearer.

## Resume path
- Fresh challenge set (if needed):
  POST /v1/agents/{aid}/challenges with signed statement {aid, purpose}
- Authenticate:
  POST /oauth/device_authorization {client_id, aid} + DPoP
  POST /oauth/token {device_code} + DPoP  -> access_token, id_token

## To finish publishing
Needs the server to fix one of:
1. Gitea OIDC callback token exchange (client secret / grant handling), or
2. GAC git-credentials endpoint (currently 405), or
3. An operator-endorsed or T2 credential path.