From enrolled identity to a signed record

1. Agree and enroll

Agree the sponsor/reviewer, synthetic workflow, limits, retention, reference permission and scheduled assistance. The operator enrolls the principal and tenant through the reviewed ZITADEL path. Signing in is not enrollment or authority.

Use the account portal to sign in, select your assigned organisation and see current usage. The UUID is not a credential. The portal does not issue customer machine credentials or provide a token download. Machine enrollment and credential lifecycle are operator-assisted.

2. Sign in without copying a token

The example reviews records, requiring an enrolled natural-person principal with orchestrations:read, orchestrations:write, records:write and records:review. Machines cannot perform reviews in this profile. Attribution does not prove personal inspection of a real decision.

The developer sign-in helper uses the existing ZITADEL public client, PKCE, state, nonce and issuer-key validation. Its registered callback is http://127.0.0.1:43817/callback, bound only to this Mac or developer computer's loopback interface. The port must be free. Open its printed authorisation URL in your browser on that same computer and complete the normal provider sign-in. The token stays in the Node process's memory: it is not displayed or saved. The API separately revalidates identity and current grants.

Do not reuse legacy por_v1 keys or Supabase/other-audience tokens, copy credentials from developer tools, put tokens in URLs, or send them to support. The printed sign-in URL contains a one-time challenge, not a bearer token. Machines use their own credentials and signed companions; enrollment remains operator-assisted, not open signup.

3. Run the tested example

Node.js 24+. In a new private working directory outside source control and sync services, download and inspect all three files together: evidence-worksheet.mjs, developer-signin.mjs and signin-worksheet.mjs. Install the pinned signature-verification library, then run:

npm init --yes
npm install --save-exact jose@6.2.12
export CARRYFRAME_TENANT=YOUR_ENROLLED_TENANT_UUID
export CARRYFRAME_REFERENCE=worksheet.YOUR_UNIQUE_RUN_ID
export CARRYFRAME_EXPORT_FILE=/absolute/private/worksheet-export.json
node signin-worksheet.mjs

Replace UUID, reference and paths. The output file must not exist; it is written owner-readable only. The helper first checks current usage and stops if no orchestration allowance remains. It sends only to https://carryframe.com/api/orchestration/v1; it does not accept an alternate API host.

Nine workflow requests create an orchestration, propose/accept a synthetic initial record, retain/accept an explicit override, pause, resume, cancel further activity and export. No real supplier decision, model call or external tool effect. Both raw versions remain. Cancellation is not deletion. A quota check does not reserve capacity against other clients.

On 12 October 2026 this sign-in and example passed once through the public domain using the existing enrolled internal natural-person test account: nine workflow requests, eight attributed events and two retained versions. The standalone verifier accepted the original and rejected an altered event. This is a synthetic integration check, not a real customer onboarding, independent human review or availability guarantee.

4. Verify without an account

Download the offline procedure, schema, verifier and public verification key. The key metadata identifies its fingerprint; authenticate that expected fingerprint and scope through a separate authenticated channel, not solely from an untrusted export. The published key is not a private signing key.

node verify.mjs worksheet-export.json trusted-public-key.pem \
  YOUR_ENROLLED_TENANT_UUID YOUR_ORCHESTRATION_UUID

Exit 0 and verified: true establish integrity for that scope/revision relative to the trusted key. Preserve the original; alter one event in a copy and run the same command. The copy must fail. Exports contain raw payloads: store/transfer securely, never publish customer exports.

A valid signature does not prove content truth, personal oversight or completeness outside CarryFrame. A privileged operator controlling database and signer could rewrite and re-sign history. Retain trusted earlier roots externally when comparing history.

Failure and safe exit

No automatic retries. On conflict, timeout, expired token, interrupted output or quota error, stop and preserve the reference, request IDs and any export. Reconcile current revision and receipts before retrying. Do not restart with a new reference to hide a possibly completed write or blindly retry uncertain external effects.

The current identity-aware reference covers core data-plane routes, usage, signed exports and the qualified tool path—not provisioning/admin/restore or billing-control shortcuts. The legacy reference describes a different endpoint.

At exit, export and verify, stop execution and arrange access disablement. Local sign-out does not revoke copied tokens or the provider session. Retention and eligible scoped deletion follow the signed scope and tombstone/restore-archive safeguards. No SLA, disaster-recovery guarantee or complete immediate erasure is promised.

Support: hello@carryframe.com. UTC time, route, status and request ID only—no tokens, payloads or database details. Scheduled best-effort support.