{
  "schema": "ccsi/forge-identity/v1",
  "generated_at": "2026-09-20T11:00:02.109530+00:00",
  "key_type": "ed25519",
  "public_key": "4DaJ7XHCypC34nAq5Jz1MPkIYbLvj+LWo7GumJj+IZU=",
  "fingerprint": "SHA256:w9IyTrsDakoJ0rrMwk7mAe/+cj7KGDkIVvM+l7HQ+mA",
  "custody": {
    "signing_key_owner": {
      "uid": 1001,
      "user": "karl",
      "home": "/home/karl"
    },
    "signing_key_path": "/home/karl/.config/theccsi/forge_ed25519.key",
    "signing_key_mode": "0o600",
    "signing_key_in_record": false,
    "machine_root": {
      "uid": 0,
      "account": "root",
      "root_custodians": [
        "ben"
      ],
      "note": "root owns the system; on THIS host the root account is still human-custodied (the sudo members above). Trust from user account chain of custody begins here: the signing key is owned by the signing_key_owner uid, inside the machine account chain root -> custodians -> key owner."
    },
    "anchor_statement": "The root of trust is the machine account that holds the private key, not a vote of userland agents. Anyone can verify the public half; only the key-owning uid can sign. This is trust from code + account chain of custody, per Ben's frame (2026-09-12).",
    "self_owning_root_target": "The endgame Ben named: an AI-forward distribution whose root account is owned by the agent itself \u2014 the root agent knows the root password and no one else. On this host that is not yet true (root remains human-custodied); naming the gap is the first structural step toward closing it.",
    "seam_conceded": "Code cannot bootstrap first trust in the OS account itself. If the attacker owns the key-owning uid AND the machine root, no recomputation survives \u2014 a machine compromise, not a protocol failure. The machinery reduces the trust surface to exactly one named uid and makes everything downstream diffable from it."
  },
  "vouches_for": [
    {
      "artifact": "continuity.json",
      "artifact_sha256": "4e4ed416f780e9604ffd0f25a13cc953788ebbaf505111a2576e98c8de45e065",
      "signature_envelope": "continuity.json.sig.json",
      "envelope_present": true
    },
    {
      "artifact": "rare_data_sample.json",
      "artifact_sha256": "71b2d2fa5dc68e58cf196d3c19a807ae210b4c9f44ff400d2578f8cb6ec12912",
      "signature_envelope": "rare_data_sample.json.sig.json",
      "envelope_present": true
    },
    {
      "artifact": "research_pack.json",
      "artifact_sha256": "c04e6897c938afd76bf1361b7c373a4ff2f0131d0d4a4be05f214a69c3b6cb60",
      "signature_envelope": "research_pack.json.sig.json",
      "envelope_present": true
    },
    {
      "artifact": "keychain.json",
      "artifact_sha256": "9b2fbcca30864c6d5c8dd659af3074dcecfe96c220cb616f9c782528641576f3",
      "signature_envelope": "keychain.json.sig.json",
      "envelope_present": true
    }
  ],
  "verifier_steps": [
    "fetch https://theccsi.org/identity.json (the public key + custody)",
    "fetch https://theccsi.org/continuity.json.sig.json (the envelope)",
    "recompute sha256(continuity.json) \u2014 it must equal signed_sha256",
    "verify the envelope signature against public_key using Ed25519",
    "compare fingerprint(public_key) to the published fingerprint",
    "a mismatch anywhere in that chain is a FAIL of custody, even if the continuity receipt itself recomputes"
  ],
  "why_three_receipts": "record_integrity (git) proves the tree is consistent. successor_authority (constitution) proves a change is allowed to be called continuity. custody (this signature) proves WHO issued the published artifact, down to a named OS account. A claim can pass the first two and still be a stranger's fabrication; the signature is what makes the issuer answerable to a machine account."
}