Uniqueness
One active owner
A normalized handle, identity identifier, or wallet cannot silently belong to two active principals.
WEIHR registry · source of relationship
Bindings become trustworthy when they are explicit, unique, and recoverable.
The registry is the controlled record of which handle, identity, wallet, device, service, role, and policy references belong together. It rejects conflicting ownership rather than guessing from similar names.
Bidirectionality
Resolve both ways
Handle-to-identity and identity-to-handle results must agree, including the wallet binding used by account login.
Provenance
Know why it changed
Issuance, migration, suspension, recovery, replacement, and revocation need timestamps and an approved cause.
Lifecycle
Never erase continuity
Status changes preserve the record. Replacement identifiers point to their history rather than rewriting it.
Idempotence
Safe to retry
Repeating the same approved operation produces the same binding; a conflict fails without partial mutation.
Separation
Public reads, protected writes
Explanatory and approved resolution surfaces stay narrow. Registry mutation remains authenticated and audited.
Provisioning transaction
Validate
Check handle normalization, identity uniqueness, wallet checksum, and existing bindings.
Back up
Preserve the pre-mutation state and record the intended migration.
Commit
Write identity, ONS, wallet, and account references as one approved relationship.
Verify
Resolve both directions, authenticate, create a session, and confirm restart persistence.