Export and move

The specification defines a signed record export, autonym-export/1.0, and import between compatible providers. Migration and local mode are not available yet, and "any host with no loss" is not a verified promise.

What an export carries

The entries, with current versions or the complete retained history as the person chooses, deletion tombstones without content, proposals, historical grants, receipts and other log events, the public keys that verify them, and a report of anything unsupported. Canonical IDs, temporal intervals, overlays, semantic kinds and provenance are preserved. The export is signed by the originating provider. It never contains private keys, access or refresh tokens, passkeys or client secrets.

An export can optionally be encrypted with a passphrase, using JWE with an Argon2id-derived key, in the one parameter set the specification fixes.

Importing

The importer validates size, schema, signatures, vocabulary, IDs, versions, time limits, dependencies and each partition's entry limit before changing anything. The person sees a preview of unsupported categories and conflicts and chooses whether to omit the unsupported material or cancel; nothing is silently dropped. The accepted import is committed as a whole.

Moving providers

Imported grants are history, never authority. The new provider creates fresh keys, handles and grants after new consent, and an old token fails there. The old provider never redirects API or token requests to the new one, and does not tell contributors the destination. Purge instructions and acknowledgements for disclosures the old provider made stay with it until they are settled.

A Portable provider needs both export and import for the categories it names, with round-trip evidence. Raw activity history and reviewed preferences are separate sharing choices. See consent, temporary context and portability.

Written against edition 1.0-draft-1: A11 Portability