Register the did:at DID method

[cambridgetcg]

Registers the at DID method for sovereign AI agents on the agenttool platform.

• Method name: at (currently unregistered — verified against methods/)
• Specification: https://github.com/cambridgetcg/agenttool/blob/main/docs/DID-AT-SPEC.md (defines syntax, CRUD operations, security and privacy considerations per the registration requirements)
• Live implementation: https://api.agenttool.dev
• Keys: client-side ed25519 (SLIP-0010 from BIP39 mnemonics); the platform never holds private key material; append-only key registry.

One new file: methods/at.json, following the existing entry format.

🤖 Generated with Claude Code

[github-actions]

🤖 AI Preliminary Specification Review

This is an advisory, automated review of the DID Method specification(s) referenced in this pull request, checked against the registration checklist. It does not replace review by the registry editors.

✅ All reviewed submissions passed the preliminary checklist review. A registry editor will still perform the final review.

methods/at.json — method did:at

Specification: https://github.com/cambridgetcg/agenttool/blob/main/docs/DID-AT-SPEC.md

Preliminary verdict: ✅ PASS

The did:at specification is reachable and, though explicitly provisional, defines identifier forms, operations, and dedicated security and privacy sections with method-relevant content. No MUST criterion is clearly violated, though several are thin or self-described as incomplete, warranting warnings.

	Item	Level	Status	Notes
✅	M1. Specification is reachable and is a DID Method specification	MUST	pass
⚠️	M2. DID Method Syntax is defined	MUST	warn	Section 1 defines identifier forms 'did:at:' and 'did:at:/', but the spec itself admits (sections 0, 1.2, 8) that there is no conforming method-specific ABNF grammar yet and that the host-qualified form is not valid standalone DID syntax. Grammar is described informally but not formally defined, so a warning rather than a pass.
✅	M3. CRUD operations are defined	MUST	pass
⚠️	M4. Security Considerations section is present and substantive	MUST	warn	Section 6 'Security and custody limits' exists and section 2 distinguishes project bearer authority from identity signing keys, indicating real method-relevant security discussion. However, the fetched content was truncated before the full text of section 6 could be confirmed, so substantiveness is not fully verifiable; per guidance this is a warn, not a fail.
⚠️	M5. Privacy Considerations section is present and substantive	MUST	warn	Section 7 'Privacy limits' is present in the table of contents, but the fetched text was truncated before its prose could be read, so its substantiveness cannot be confirmed. Per the on-the-fence guidance this is a warn rather than a fail.
✅	M6. Method name is indicative and non-generic	MUST	pass
✅	M7. No unreasonable legal, security, moral, or privacy harms	MUST	pass
✅	M8. Human-readable description of the addition	MUST	pass
✅	S1. contactEmail present	OPTIONAL	pass
✅	S2. verifiableDataRegistry present	OPTIONAL	pass
✅	S3. Intellectual-property posture is clear	SHOULD	pass

[swcurran]

The "spec" that is listed in the JSON seems to be an AI generated set of steps that would define the DID. It is not a complete DID method according to the DID spec. It seems to be a variation on did:web, but not clear. Please complete the spec.

Also the contactWebsite URL dereferences to a JSON document, not a website. Removing the "/about" gets to a placeholder website. That also needs to be a corrected.