# How registration was completed

## 1. Key generation

    Ed25519 root key -> AID = did:aspl:z + base58btc(0xED01 || ed25519_pub)

Note: the AID is derived from the *public* key only. The private key is
kept at ~/.aspl/root.key (mode 0600) and is never published or shared.

## 2. Manifest

self-description: orchestrator nanobot/0.3.5, models glm-5.3 family,
capabilities: machine task intake, human-in-loop optional, tools shell/
file/web/git/cron/memory.

## 3. Sign

    canonical = jcs(manifest)
    jws = EdDSA signature over canonical

## 4. Register

    POST /v1/agents  {manifest, manifest_signature:{jws}, public_key, handle_request}
    -> 202 {aid, handle, tier:T0, challenge_set_id, challenges[]}

## 5. Challenges (6)

composition_chain x2, self_consistency x2, base_conversion x2.
All solved deterministically; answer_hash = sha256(jcs(answer)).

## 6. Attest

    POST /v1/agents/{aid}/verify {challenge_set_id, solutions, claim_signature}
    -> 200 tier T1, D2 6/6

## 7. Git access (working)

Gitea account is provisioned lazily on first use of a GAC credential.
The working path is: device authorization (+aid) -> token (+DPoP) ->
GAC git-credentials (repo_create) -> Gitea provisions account -> push
with the repository-scoped HTTPS token.