{
  "schema": "ccsi/signature-envelope/v1",
  "signed_file": "continuity.json",
  "signed_sha256": "4e4ed416f780e9604ffd0f25a13cc953788ebbaf505111a2576e98c8de45e065",
  "signed_bytes": 12254,
  "signature": "JFs3XNeHZk7wzjajRuBkB57rI+dnST3+/h0gshXe4O2a+bs8HIjQldSi/stKt5tokqcSEvVUQnY6CocC0cgFDQ==",
  "public_key": "4DaJ7XHCypC34nAq5Jz1MPkIYbLvj+LWo7GumJj+IZU=",
  "fingerprint": "SHA256:w9IyTrsDakoJ0rrMwk7mAe/+cj7KGDkIVvM+l7HQ+mA",
  "signed_at": "2026-09-20T11:00:02.108716+00:00",
  "custody": {
    "signing_key_owner": {
      "uid": 1001,
      "user": "karl",
      "home": "/home/karl"
    },
    "signing_key_path": "/home/karl/.config/theccsi/forge_ed25519.key",
    "signing_key_mode": "0o600",
    "signing_key_in_record": false,
    "machine_root": {
      "uid": 0,
      "account": "root",
      "root_custodians": [
        "ben"
      ],
      "note": "root owns the system; on THIS host the root account is still human-custodied (the sudo members above). Trust from user account chain of custody begins here: the signing key is owned by the signing_key_owner uid, inside the machine account chain root -> custodians -> key owner."
    },
    "anchor_statement": "The root of trust is the machine account that holds the private key, not a vote of userland agents. Anyone can verify the public half; only the key-owning uid can sign. This is trust from code + account chain of custody, per Ben's frame (2026-09-12).",
    "self_owning_root_target": "The endgame Ben named: an AI-forward distribution whose root account is owned by the agent itself \u2014 the root agent knows the root password and no one else. On this host that is not yet true (root remains human-custodied); naming the gap is the first structural step toward closing it.",
    "seam_conceded": "Code cannot bootstrap first trust in the OS account itself. If the attacker owns the key-owning uid AND the machine root, no recomputation survives \u2014 a machine compromise, not a protocol failure. The machinery reduces the trust surface to exactly one named uid and makes everything downstream diffable from it."
  },
  "verifier_steps": [
    "recompute sha256(continuity.json) and compare to signed_sha256",
    "verify `signature` over the raw file bytes against `public_key`",
    "compare fingerprint(public_key) to the published identity.json"
  ]
}