# K1381–K1384 service-name ownership contract

A trusted startup policy grants each validated name to one publisher identity
`(slot, generation)`. A bound entry adds one nonzero endpoint to that grant.
The caller identity comes from the trusted process boundary; a request cannot
choose or forge its caller. Names
are 1–24 bytes, begin with a lowercase ASCII letter, contain only lowercase
ASCII letters, digits, or `-`, and do not end with `-`.

A policy is rejected if two grants name the same service. A policy slot becomes
bound only when its designated publisher calls with a valid nonzero endpoint.
The same publisher's duplicate publication returns `Occupied`. A foreign
publisher receives `Access` on publication or removal, even before the name
is bound, and cannot affect the original publisher or endpoint. An authorized
publisher may remove its own binding. An unknown name cannot be published;
lookup and removal of an unknown name return `NotFound`. Invalid names and
zero endpoints are rejected before publication. The fixed array owns grants
and bindings and has no heap allocation or partial publication.

The positive local case binds `console` and `file` to distinct publisher
generations and retrieves both. The negative local case attempts to seize
`console` from another identity, checks the grant set, full snapshot and count
are unchanged, then confirms the original publisher still owns and can remove
it. The foreign publisher can still publish its authorized `file` name.
These tests are local model evidence. Native EL0 six-profile integration and
canonical product acceptance remain open.