Design and deployment artifacts for a pico engine registration service using
did:webvh (DID Web + Verifiable History).
Each registered engine gets a durable, verifiable, portable identifier whose history is tamper-evident and independently verifiable — and remains resolvable even if the original host goes away or the engine relocates.
This repository holds design documentation only. The reusable registrar/witness/watcher service and picolabs.io's first deployment of it are described here; application code lives elsewhere (TBD).
The service combines three roles over the same log data:
| Role | When | Purpose |
|---|---|---|
| Registrar | Registration | Accepts genesis and update entries from engine operators |
| Witness | Pre-publish | Co-signs pending log entries before they are valid |
| Watcher | Post-publish | Indexes DIDs by SCID, caches state, keeps them resolvable after moves |
Registered vs local: An unregistered engine running on a developer's machine has no DID and is invisible to the system. Registration is a single tier — witness and watcher from genesis, with no dev/production split.
DID namespace (domain is per-deployment config):
did:webvh:<scid>:<domain>:pico:<engine-id>
→ https://<domain>/pico/<engine-id>/did.jsonl
The service is built to be deployable by any domain; picolabs.io is the first instance, not a privileged one.
| Document | Description |
|---|---|
| docs/design/pico-engine-registration-design.md | Goals, registration flow, configuration model, deployment architecture |
| docs/design/pico-registration-service.yaml | AWS CloudFormation template (App Runner, S3, DynamoDB, Secrets Manager) |
- pico-engine — the runtime operators register.
Engines generate keys locally and produce genesis DID log entries; this service witnesses,
publishes, and watches those logs. Pico-engine provisions
did:webvhper pico (1.6+).
Draft design (August 2026). Open questions and future work are in the design doc.