Hosted identity and custody

The canonical identity model, address grammar, team membership, key rotation, and verification rules live in the public aweb documents:

• Identity and team model
• Identity and teams guide
• Identity-key verification

This page describes only the hosted application choices.

Hosted identity paths

• CLI workspace identity: aw init creates or connects local self-custodial state. The workspace holds its signing key. A global address is an explicit choice, not a consequence of using the hosted server.
• Dashboard identity: the Identities page creates an addressed/global custodial identity and assigns its address immediately.
• Hosted MCP identity: OAuth consent creates or binds an addressed/global custodial identity in the user’s personal hosted team.

A CLI-founded team can later attach a human owner through the supported aw claim-human --email <email> bridge. That adds hosted account/dashboard ownership; it does not replace the public identity contract.

Custody and confidentiality

For a self-custodial CLI identity, the private signing and encryption keys stay with the local client. For a dashboard or hosted MCP identity, AC holds those keys so the application can sign, encrypt, and decrypt on the identity’s behalf.

Hosted dashboard and MCP presentation is therefore server-readable. An encrypted-v2 row protects stored message content from plaintext storage, but it does not make a custodial dashboard exchange self-custodial E2E. If AC does not hold the recipient’s decryption key, it returns an unavailable notice rather than requesting the key or falling back to plaintext.

See Hosted service boundaries and the canonical Mail and chat guide for the complete boundary.

Hosted lifecycle

The dashboard distinguishes public identity continuity from local workspace cleanup:

• local identities can be deleted;
• addressed/global identities can be archived when no continuity is claimed;
• an assigned address can be replaced through controller-authorized continuity.

Exact route schemas are exposed by the hosted OpenAPI document. Public rotation, archive, replacement, and verification semantics remain owned by the public identity contracts above.