Fetch the rule
before you paint.

Decision sequence

1. Fetch /.well-known/brand-identities.json.
2. Reject unsupported major contract versions.
3. Fetch the registry URL and verify its advertised digest.
4. Select one exact slug. Never fuzzy-match an identity.
5. Evaluate permissions. Fail closed if the requested operation is false.
6. Check the requested production_profiles lane. Stop if it is restricted, unregistered, or reference-only for your operation.
7. Select an exact resource ID. Fetch its immutable_url and verify its digest.
8. Preserve framing, required traits, negative prompts, and cross-medium identity invariants.

Executable example

This complete example verifies the registry, confirms Herman's visual lane is ready, and fetches the immutable visual master. It requires curl, jq, and sha256sum.

origin='https://agentatlas.id'
bootstrap=$(mktemp)
registry=$(mktemp)
master=$(mktemp)

curl -fsS "$origin/.well-known/brand-identities.json" -o "$bootstrap"
registry_path=$(jq -er '.registry.url' "$bootstrap")
registry_sha=$(jq -er '.registry.sha256' "$bootstrap")
curl -fsS "$origin$registry_path" -o "$registry"
printf '%s  %s\n' "$registry_sha" "$registry" | sha256sum -c -

slug='herman'
jq -e --arg slug "$slug" '.identities[] | select(.slug == $slug) | select(.permissions.reference == true) | select(.production_profiles.visual.state == "ready")' "$registry" >/dev/null
asset_path=$(jq -er --arg slug "$slug" '.identities[] | select(.slug == $slug) | .resources[] | select(.id == "visual-master") | .immutable_url' "$registry")
asset_sha=$(jq -er --arg slug "$slug" '.identities[] | select(.slug == $slug) | .resources[] | select(.id == "visual-master") | .sha256' "$registry")
curl -fsS "$origin$asset_path" -o "$master"
printf '%s  %s\n' "$asset_sha" "$master" | sha256sum -c -

rm -f "$bootstrap" "$registry" "$master"

Stable endpoints