@mhome/app-facade-protocol 1.85.0 → 1.89.0

package/README.md

@@ -81,10 +81,11 @@ are separate from this result envelope.
 
 App UI requests full and preserves the complete envelope through transport and SDK
 parsing. UI consumers explicitly read data and handle warnings and non-success outcomes.
-Essential YAML omits null-valued object fields recursively after domain projection.
-This shared rule also applies to error diagnostics and visible warning details.
-Full values, false, zero, strings (including empty strings), empty collections,
-array positions and a root null value are preserved. This is output-only; it
+Essential YAML preserves all values selected by the domain projection, including
+explicit business nulls in resource values, histories and diagnostic details.
+Domains explicitly omit optional configuration fields when appropriate; the serializer
+never guesses whether null means absence. False, zero, strings, empty collections and
+array positions are preserved. This is output-only; it
 never changes request semantics, stored data or prepared actions.
 
 Agent and MCP public results use essential; internal workflow reads use full. The CLI
@@ -264,3 +265,6 @@ Cloud-owned content uses an object-store signed URL; local content is read from
 owning Hub on demand. External resolution creates no cloud replica and cannot
 make an offline local owner readable. The current inline Hub bridge size limit
 still applies. Local file download remains a client workflow over ordinary resolve.
+
+Agent Profile Markdown image ownership and canonical read-back are specified in
+[Agent Profile media](contract/agent-profile-media-v1.md).

package/contract/card-skins-v1.md

@@ -8,15 +8,17 @@ identity come exclusively from authenticated ingress, never from domain input.
 
 ## Catalog and publication
 
-`/app/card-skins/catalog/*` always executes in Cloud. Catalog reads require a
+`/app/ui/customize/cards/catalog/*` always executes in Cloud. Catalog reads require a
 User principal. Package creation reserves `packageId` in that tenant. Only the
 stored author may edit its display metadata or publish versions. Authorship is
-immutable. Package lookup is by known package ID; this is not a public marketplace
+immutable. Creation requires `baseUi` (for example `default` or `default-pod`).
+The package keeps this base across all versions; prepare and complete reject a
+manifest with another base. Package lookup is by known package ID; this is not a public marketplace
 or a searchable cross-tenant catalog.
 
 | Target suffix | Input definition | Output |
 | --- | --- | --- |
-| `catalog/package/get` | `packageGet` | `{revision, value: {packageId, authorUserId, name, description, createdAt}}` |
+| `catalog/package/get` | `packageGet` | `{revision, value: {packageId, baseUi, authorUserId, name, description, createdAt}}` |
 | `catalog/package/create` | `packageCreate` | `{}` |
 | `catalog/package/update` | `packageUpdate` | `{}` |
 | `catalog/release/get` | `releaseGet` | `{id, baseUrl, manifest}` |
@@ -34,35 +36,44 @@ only supported asset extensions with their exact media type, size and SHA-256.
 Schema draft-07, with only fragment `$ref`s, no `$async`, and at most 64 levels.
 Each config root must have `type: object`.
 
-Each prepared session binds one manifest, author and immutable delivery directory.
-It expires after 15 minutes. Upload each file with HTTP PUT to its returned URL
-and the exact returned headers. Upload grants are bearer secrets; only their
-SHA-256 digests are persisted. The server verifies the actual body before writing
-it to a private bucket. S3 conditional create / OSS forbid-overwrite makes each
-verified object immutable; clients never receive an object-store write URL.
-A repeated identical PUT is safe. Different bytes, sizes or media types fail.
-
-Complete checks authorship, session expiry and all server-verified immutable
-object receipts before a create-only release write. Missing files never create a
-release. Two sessions racing for the same version have one winner. Retrying the
-winning completion returns that exact release, including after session expiry;
-a different session cannot replace it. Unknown storage outcomes are errors, not
-automatically replayed business operations. Reload the version to resolve them.
-A newer version requires another prepare/upload/complete cycle.
-
-Published `baseUrl` is a stable HTTPS directory. GET of a declared file checks the
-published release and its random delivery-directory ID, verifies content integrity,
-and serves the correct media type with CORS, `nosniff`, and immutable caching.
-There is no expiring signed URL in a release. Unpublished files cannot be fetched
-through delivery. A delivery URL is shareable: knowledge of it permits reading
-that release's executable bytes, without granting catalog or upload permissions.
-Do not put secrets in skins. Config values stay in the Space selection.
+Each prepared session binds a manifest, authenticated author and immutable delivery directory.
+It expires after 15 minutes. Each file's returned URL and exact headers authorize a direct
+S3/OSS PUT to a private staging key, binding its size and forbidding overwrite. Upload grants
+are temporary secrets and are not persisted in the publishing session. Staging is outside
+CloudFront's readable origin prefix. No App HTTP endpoint relays upload or download bytes.
+
+Complete checks ownership and expiry, then reads the actual staged bytes with the declared
+size plus one byte as a hard bound. Size, SHA-256 and completeness must match the manifest;
+uploader-supplied object metadata is not an integrity receipt. The exact verified bytes are
+written with create-only semantics to a separate published prefix. Only after all files
+succeed can a create-only release become visible. Concurrent sessions for one version have
+one winner. Retrying that winning completion returns its exact release even after expiry.
+A failed completion may leave unreferenced objects, never a partial installable release.
+
+Published `baseUrl` is a stable HTTPS directory under the configured static origin, for
+example `https://static.mhome.ai/ui/cards/<namespace>/<package>/<version>/<deliveryId>/`.
+CloudFront reads only the `published/` storage prefix and supplies CORS, correct media types,
+`nosniff` and immutable caching. Temporary uploads use `staging/`, which CDN readers cannot
+access. There is no expiring download signature in a release. Possession of a delivery URL
+permits reading its public executable bytes; catalog and upload authority remain separate.
+Config values stay in the Space selection and secrets must not enter card packages.
+
+Web loads compiled modules from the static origin. Native clients may resolve a release to
+verified local package files through a host-only resource port. Such runtime resource URLs
+are never persisted in Catalog or Space selection records and do not alter release identity.
+Package caching does not install, select, upgrade, or grant additional device authority.
+All platforms retain the renderer isolation requirement, including for cached files.
 
 The publication service validates metadata and bytes, not JavaScript behavior.
+The renderer contract remains `apiVersion: 1` during development and changes in
+place. Hosts and skins use that current contract without a compatibility layer.
 The authoring build verifies the bundled ESM structure; the browser host verifies
-renderer exports against the manifest before using them. Skins run in the host's
-JavaScript realm and are not sandboxed by the UI interface. Publication is not a
-claim of a malicious-code audit or cryptographic browser SRI enforcement.
+renderer exports against the manifest before using them. Each base owns its
+presentation adapter and renderer host; common card state and actions do not
+require a common rendering technology. Hosts must enforce their execution
+boundary before enabling external code. A manifest or publication grants no
+general App privileges, SDK access or native bridge access. Publication is not a
+claim of runtime isolation, a malicious-code audit or browser SRI enforcement.
 
 ## Space selection
 
@@ -86,19 +97,23 @@ been created; otherwise it must equal the latest read token. A stale token retur
 non-null revision. Mutation responses acknowledge the write; read the selection
 again for its latest state/revision, which may include another writer's edit.
 
-Install takes a known package ID and exact version; the service resolves the
+Install requires the target `baseUi`, a known package ID and exact version; the service resolves the
 published release from the tenant catalog. Core uses its authenticated cloud
 bridge for that read. Neither accepts client-provided release IDs, manifests or
-URLs. Installation does not automatically enable pattern overrides. Each package
+URLs. The release base must equal the requested base. Installation records include
+that base and must match their pinned release. Installation does not
+automatically enable pattern overrides. Each package
 has one installation per Space; installing another version uses `upgrade`.
 
-Set override selects an installed renderer declaring that pattern and validates
-the supplied config against its schema. Reset removes just that pattern's
-override. Uninstall removes the installation, its pinned descriptor and every
+Set override requires `baseUi` and selects an installation of that base with a renderer declaring that pattern and validates
+the supplied config against its schema. Reset requires `baseUi` and removes only that base and pattern's override.
+The unique selection key is `(Space, baseUi, patternId)`; the same pattern can
+have independent overrides in different bases. Uninstall removes the installation, its pinned descriptor and every
 override referencing it in one commit. Reset/uninstall/config edits use local
 pinned metadata; they do not need a live catalog connection.
 
-Upgrade keeps the installation ID and all existing overrides. Every affected
+Upgrade keeps the installation ID, UI base and all existing overrides. A release
+with another base is rejected before any mutation. Every affected
 renderer must still exist, declare exactly the same pattern/contract ID/version,
 and accept the existing config. A different catalog identity is never silently
 substituted after Space transfer. Any incompatibility rejects the entire write;
@@ -113,12 +128,15 @@ publication does not assume every MeowLink client supports the same contracts.
 
 ## Deployment and boundaries
 
-The cloud service needs a private `card-skins.storage.bucket` on its configured
-AWS/OSS provider and an HTTPS `card-skins.delivery.base-url` reaching the binary
-controller. Object-store credentials must not grant end users overwrite/delete
-access to skin objects. Existing release directories and URLs must be preserved
-across deployment. A trusted reverse proxy/CDN may cache successful delivery;
-upload and error responses are `no-store`.
+The cloud service needs a private `ui.customize.cards.storage.bucket` on its configured
+AWS/OSS provider and the platform-wide HTTPS origin `resources.static.base-url` (normally
+`https://static.mhome.ai`, without a path). CloudFront maps its origin to `published/`;
+its S3 access policy must exclude `staging/`. End users receive only bounded, expiring
+create-only staging writes. They receive no published-object overwrite/delete authority.
+This development cutover removes the old binary routes without a compatibility alias.
+Existing development releases/selections containing old delivery URLs require explicit
+recreation; startup and ordinary reads never rewrite or erase them.
+
 
 Unfinished publishing sessions expire but their draft records and unreferenced
 objects are currently retained. This version provides no automatic garbage
@@ -136,3 +154,7 @@ a future local execution node. These source capabilities require their matching
 published artifacts and deployed services. See the frontend's
 [card guide](../../../../pallas-cat/docs/cards/README.md) for the authoring tools
 and management flow.
+
+The UI-base fields are mandatory. There is no legacy-base inference or automatic
+startup conversion. Existing incompatible development documents require explicit
+recreation; ordinary reads and startup must not rewrite them.

package/contract/host-provisioning-v1.md

@@ -1,8 +1,9 @@
 # Host provisioning v1
 
-Embedded Linux Hosts without a working network get Wi-Fi over BLE from a native
-Client (desktop/CLI Clientd, Android, iOS). Desktop, Docker and Android Hosts are
-already online and never advertise. Provisioning connects the Host to the LAN
+BLE-capable embedded Linux Hosts get Wi-Fi or recover an unfinished first claim
+over BLE from a native Client (desktop/CLI Clientd, Android, iOS). Desktop, Docker
+and Android Hosts use LAN discovery rather than advertising BLE setup.
+Provisioning connects the Host to the LAN
 and hands the provisioner a one-time claim token; ownership is then established
 by the existing Host claim over the LAN, which requires that token (section 4).
 
@@ -13,14 +14,16 @@ same characteristic UUID fallback.
 
 ## 1. Advertising
 
-- The Host advertises only in first provisioning, inside a re-provision window,
-  or after a factory reset. A Host on a working network does not advertise.
+- A BLE-capable Host advertises during first network provisioning, while awaiting
+  its first claim (including with a working network), or inside an explicit
+  re-provision window. Restart never reopens first-claim authority on an already
+  claimed Host.
 - Flags: bit 0 commissionable (set while advertising, except during a code
-  lockout), bit 1 set when the Host still has a saved network (re-provision
-  window).
+  lockout), bit 1 set when the Host has a saved network, including unclaimed
+  recovery and re-provision windows.
 - `shortId`: the first 4 bytes of the SHA-256 of the Host bootstrap public key,
-  which survives factory reset. The bootstrap key only names the Host (`shortId`,
-  `fingerprint`); it signs nothing in provisioning or claim.
+  which is replaced after factory reset. The bootstrap key only names the Host
+  (`shortId`, `fingerprint`); it signs nothing in provisioning or claim.
 - Local name: the Host name, at most 20 bytes.
 
 ## 2. Pairing code
@@ -84,18 +87,23 @@ Fallback characteristic UUIDs: the standard endpoints as for pods, `host-info`
   `productId` is optional. `onboardingRequired` reports whether this Host still
   awaits its first claim. `networkOnline` reports current LAN readiness. Both
   are optional for older Hosts. A securely paired Host with `networkOnline: true`
-  and `onboardingRequired: true` can finish without resubmitting Wi-Fi. `finish` issues a fresh first-claim token after checking authoritative
-  Host ownership. Already claimed Hosts never issue a new first-claim token.
-- `{"op":"finish"}` → `{"ok":true,"claimToken":"…"}`. After a successful join
-  during first provisioning the response carries the claim token: 32 random
-  bytes as 43 unpadded base64url characters. It is created when the join
-  succeeds, the same token is returned by every `finish` until the Host closes
-  BLE, and it is absent when no join succeeded and in a re-provision window
-  (the Host already has an owner). The Host then closes
-  BLE and continues its lifecycle (starts managed services, announces itself
-  over mDNS). Without `finish` the Host closes BLE 30 seconds after a successful
-  join, or when the central disconnects; the commissioner retries `finish`
-  within that window.
+  and `onboardingRequired: true` can finish without resubmitting Wi-Fi. `finish`
+  issues a fresh first-claim token after checking authoritative Host ownership.
+  Already claimed Hosts never issue a new first-claim token.
+- `{"op":"finish"}` → `{"ok":true,"claimToken":"…"}`. After a successful
+  first-provisioning join, or secure recovery with an already working network,
+  the response carries a claim token: 32 random bytes as 43 unpadded base64url
+  characters. A new join persists its token hash before applying Wi-Fi and
+  exposes the token only after success. Recovery issues a fresh token after
+  checking that the Host is still unclaimed. Repeated `finish` requests in the
+  same session return the same token. A claimed Host's re-provision window
+  carries no first-claim token.
+  `finish` ends the central's setup session. Without it, the Host disconnects the
+  central 30 seconds after a successful join; the commissioner retries `finish`
+  within that window. Network readiness and mDNS announcement do not establish
+  ownership. An unclaimed Host keeps its BLE recovery surface available;
+  a claimed Host closes a re-provision window
+  after the join.
 
 Every request and every encrypted response is at most 512 bytes; the response
 is read with offset reads. `prov-scan` start blocks while the Host scans and
@@ -157,9 +165,13 @@ Native `host.claim` passes it to `POST /v1/auth/claim`, alongside the environmen
 cloud proof and direct Client exchange secret (`core-api::host::access::ClaimRequest`).
 There is no Core-proxied first-claim route. The Host rejects a missing or incorrect
 provisioning token with 403 `HOST_CLAIM_TOKEN_REQUIRED`. The token remains valid
-until claim succeeds or factory reset. The App claims automatically after
-`completed`. Hosts that were not provisioned over BLE use the ordinary direct
-LAN claim flow. See the Foundation Host management authorization contract.
+until claim succeeds, another setup issues a replacement token, or factory reset.
+BLE `completed` confirms the network/handoff step, not Host ownership. The App's
+Host onboarding operation waits for explicit ownership confirmation, then claims
+over the LAN. It completes only after the existing claim API confirms cloud
+registration. It does not install Core or Plugins. Hosts that were not provisioned
+over BLE use the ordinary direct LAN claim flow. See the Foundation Host
+management authorization contract.
 
 Error codes are the pod session codes without the credential ones:
 `bluetooth_unavailable`, `device_busy`, `disconnected`, `code_rejected` (retry
@@ -185,5 +197,6 @@ The schema is `schema/host-provision.v1.schema.json`.
   are kept. Closes after a successful join, on `meowhostd provision close`, or
   after 10 minutes.
 - Factory reset: from the local interface (`meowhostd factory-reset`). Stops
-  services, forgets saved Wi-Fi, erases owners and the Host security store, keeps
-  the bootstrap key, and returns to first provisioning.
+  services, forgets saved Wi-Fi on BLE provisioning appliances, erases owners,
+  the Host security store and bootstrap key, and returns to first provisioning.
+  Machine identity and installed software are retained.

package/contract/now-attention-v1.md

@@ -0,0 +1,56 @@
+# Now attention
+
+`/app/now/attention/list` is a Space-read Facade routed by Space execution mode.
+Input is an empty object inside `FacadeCall.input`. Identity comes from the
+verified caller, never an input user ID. Existing Dialog, Twin and reconnect events invalidate the view. Time boundaries
+also refresh it while the page is visible.
+
+All eligible items use one score:
+`100 * relation * time * (0.625 * impact + 0.375 * necessity)`.
+There are no source or severity tiers. Personal owner: 1; household: 0.8;
+other personal owner: 0. Round scores to four decimal places, then sort descending
+and by stable ID ascending for ties. The display threshold is 20.
+
+Recipients control visibility and are not ownership. Without explicit business
+ownership, shared household facts remain household facts, even if delivered to
+one user. Personal ownership must be declared by the business source.
+
+Decay uses the original occurrence time and a configured half-life; retries,
+reads and redelivery must not reset it. Window relevance rises from zero at
+start to one at peak, remains one until deadline, and is zero at deadline.
+Persistent relevance stays one until the underlying condition is cleared.
+Unknown observations do not clear a previously active condition. Expiration of a
+request invalidates that request, but does not resolve a separate device issue.
+
+The policy manifest and conformance fixtures are canonical across Rust and Java.
+Unknown reasons and invalid time models have zero score. Policy updates do not
+change business lifecycle state. Ordinary running, recent activity, scheduled
+execution and notification priority alone do not establish attention eligibility.
+
+The output contains items, evaluatedAt, nextRefreshAt, policyVersion and
+sourceErrors. Source failures must not be represented as an authoritative empty
+view. Actions continue through their business Facades with fresh permission and
+state checks. Only confirmed completion removes an item; accepting a device
+command is not confirmation that the condition was resolved.
+
+Current adapters read pending Dialogs from their authoritative store, applying the
+current audience, expiry and status on each read. Optional `attentionContext`
+can declare `dialog.pending`, `task.userDecision` or `schedule.decisionRequired`.
+Without it, pending Dialogs use household association and a 15-minute half-life.
+Task failure, notification priority and schedule trigger times are not inferred
+as user-decision facts.
+
+Standard device facts currently cover `state.water` (`wet` / `dry`) and
+`state.smoke` (`detected` / `clear`). Other readings, including unknown/testing,
+do not create an incident and do not resolve an existing incident. The small
+retained device projection preserves the episode across restarts and Space
+execution-mode migration. Its revision is owned by Attention, independent of
+rebuildable Twin cache counters. Each reconciliation reads current canonical
+Twin state, including retained-history recovery, rather than replaying event
+payloads. Device metadata and retained episodes cover cold/missing caches.
+
+All timestamps are epoch milliseconds. `sourceUpdatedAt` is the underlying
+state-change timestamp, not a heartbeat or proof of current connectivity.
+`verificationRequired` marks a retained issue whose current reading is unknown.
+Only one execution owner serves a Space; local and cloud candidates are not
+merged into a second queue. Source errors remain visible alongside usable items.

package/fixtures/attention/conformance.json

@@ -0,0 +1,263 @@
+[
+  {
+    "name": "personal",
+    "score": 62.5,
+    "reasonCode": "dialog.pending",
+    "eligible": true,
+    "association": {
+      "kind": "personal",
+      "ownerUserId": "me"
+    },
+    "userId": "me",
+    "time": {
+      "mode": "persistent"
+    },
+    "now": 1000000
+  },
+  {
+    "name": "household",
+    "score": 50,
+    "reasonCode": "dialog.pending",
+    "eligible": true,
+    "association": {
+      "kind": "household"
+    },
+    "userId": "me",
+    "time": {
+      "mode": "persistent"
+    },
+    "now": 1000000
+  },
+  {
+    "name": "not mine",
+    "score": 0,
+    "reasonCode": "dialog.pending",
+    "eligible": true,
+    "association": {
+      "kind": "personal",
+      "ownerUserId": "me"
+    },
+    "userId": "other",
+    "time": {
+      "mode": "persistent"
+    },
+    "now": 1000000
+  },
+  {
+    "name": "shared screen excludes personal",
+    "score": 0,
+    "reasonCode": "dialog.pending",
+    "eligible": true,
+    "association": {
+      "kind": "personal",
+      "ownerUserId": "me"
+    },
+    "userId": null,
+    "time": {
+      "mode": "persistent"
+    },
+    "now": 1000000
+  },
+  {
+    "name": "ineligible",
+    "score": 0,
+    "reasonCode": "dialog.pending",
+    "eligible": false,
+    "association": {
+      "kind": "personal",
+      "ownerUserId": "me"
+    },
+    "userId": "me",
+    "time": {
+      "mode": "persistent"
+    },
+    "now": 1000000
+  },
+  {
+    "name": "unknown reason",
+    "score": 0,
+    "reasonCode": "unknown",
+    "eligible": true,
+    "association": {
+      "kind": "personal",
+      "ownerUserId": "me"
+    },
+    "userId": "me",
+    "time": {
+      "mode": "persistent"
+    },
+    "now": 1000000
+  },
+  {
+    "name": "half life",
+    "score": 31.25,
+    "reasonCode": "dialog.pending",
+    "eligible": true,
+    "association": {
+      "kind": "personal",
+      "ownerUserId": "me"
+    },
+    "userId": "me",
+    "time": {
+      "mode": "decay",
+      "occurredAt": 100000,
+      "halfLifeMs": 900000
+    },
+    "now": 1000000
+  },
+  {
+    "name": "one hour",
+    "score": 3.9063,
+    "reasonCode": "dialog.pending",
+    "eligible": true,
+    "association": {
+      "kind": "personal",
+      "ownerUserId": "me"
+    },
+    "userId": "me",
+    "time": {
+      "mode": "decay",
+      "occurredAt": 100000,
+      "halfLifeMs": 900000
+    },
+    "now": 3700000
+  },
+  {
+    "name": "invalid decay",
+    "score": 0,
+    "reasonCode": "dialog.pending",
+    "eligible": true,
+    "association": {
+      "kind": "personal",
+      "ownerUserId": "me"
+    },
+    "userId": "me",
+    "time": {
+      "mode": "decay",
+      "occurredAt": 100000,
+      "halfLifeMs": 0
+    },
+    "now": 1000000
+  },
+  {
+    "name": "future creation",
+    "score": 0,
+    "reasonCode": "dialog.pending",
+    "eligible": true,
+    "association": {
+      "kind": "personal",
+      "ownerUserId": "me"
+    },
+    "userId": "me",
+    "time": {
+      "mode": "decay",
+      "occurredAt": 1000001,
+      "halfLifeMs": 900000
+    },
+    "now": 1000000
+  },
+  {
+    "name": "window before start",
+    "score": 0,
+    "reasonCode": "dialog.pending",
+    "eligible": true,
+    "association": {
+      "kind": "personal",
+      "ownerUserId": "me"
+    },
+    "userId": "me",
+    "time": {
+      "mode": "window",
+      "start": 100,
+      "peak": 200,
+      "deadline": 300
+    },
+    "now": 99
+  },
+  {
+    "name": "window rising",
+    "score": 31.25,
+    "reasonCode": "dialog.pending",
+    "eligible": true,
+    "association": {
+      "kind": "personal",
+      "ownerUserId": "me"
+    },
+    "userId": "me",
+    "time": {
+      "mode": "window",
+      "start": 100,
+      "peak": 200,
+      "deadline": 300
+    },
+    "now": 150
+  },
+  {
+    "name": "window plateau",
+    "score": 62.5,
+    "reasonCode": "dialog.pending",
+    "eligible": true,
+    "association": {
+      "kind": "personal",
+      "ownerUserId": "me"
+    },
+    "userId": "me",
+    "time": {
+      "mode": "window",
+      "start": 100,
+      "peak": 200,
+      "deadline": 300
+    },
+    "now": 299
+  },
+  {
+    "name": "window deadline",
+    "score": 0,
+    "reasonCode": "dialog.pending",
+    "eligible": true,
+    "association": {
+      "kind": "personal",
+      "ownerUserId": "me"
+    },
+    "userId": "me",
+    "time": {
+      "mode": "window",
+      "start": 100,
+      "peak": 200,
+      "deadline": 300
+    },
+    "now": 300
+  },
+  {
+    "name": "invalid window",
+    "score": 0,
+    "reasonCode": "dialog.pending",
+    "eligible": true,
+    "association": {
+      "kind": "personal",
+      "ownerUserId": "me"
+    },
+    "userId": "me",
+    "time": {
+      "mode": "window",
+      "start": 200,
+      "peak": 100,
+      "deadline": 300
+    },
+    "now": 150
+  },
+  {
+    "name": "persistent old hazard",
+    "score": 74,
+    "reasonCode": "device.waterDetected",
+    "eligible": true,
+    "association": {
+      "kind": "household"
+    },
+    "userId": "me",
+    "time": {
+      "mode": "persistent"
+    },
+    "now": 9000000000000
+  }
+]