{
  "schema_version": "0.1.0",
  "catalogue_status": "discovery_inventory",
  "authority": "Evidence-derived inventory; not a final implementation-governing SSOT. Preserve source modality and consult conflicts.json.",
  "category": "keys_cryptography",
  "description": "Logical Keys, identifiers, cryptographic components, algorithms, purposes, prohibitions, and custody.",
  "items": [
    {
      "id": "key.logical",
      "name": "Logical CRE8 Key",
      "kind": "security_principal",
      "description": "Logical principal comprising a public Credential ID plus four purpose-separated keypairs.",
      "modality": "source_description",
      "sources": [
        {
          "file": "docs/seed/Credential_Payload.txt",
          "lines": "1-3"
        },
        {
          "file": "docs/seed/Description_Zero.txt",
          "lines": "10"
        }
      ],
      "subcomponents": [
        "Credential ID",
        "Authentication keypair",
        "Delegation keypair",
        "Authorship keypair",
        "Confidentiality/Box keypair"
      ]
    },
    {
      "id": "key.credential_id",
      "name": "Credential ID",
      "kind": "public_identifier",
      "description": "Random immutable public identifier used to locate the logical Key, versions, public keys, status, policy, lineage, and historical signatures; never a bearer secret.",
      "modality": "explicit_immutable",
      "sources": [
        {
          "file": "docs/seed/Credential_Payload.txt",
          "lines": "145-163"
        }
      ],
      "example": "cre8_k_7PK1BHZ4..."
    },
    {
      "id": "key.authentication",
      "name": "Authentication keypair",
      "kind": "cryptographic_component",
      "description": "Ed25519 K_auth pair for request signing and possession proof; binds method, path, body digest, timestamp, nonce, and Credential ID. Cannot mint, change permission, author-sign, or decrypt.",
      "modality": "source_description",
      "sources": [
        {
          "file": "docs/seed/Credential_Payload.txt",
          "lines": "5-23"
        }
      ],
      "algorithm": "Ed25519",
      "fields": [
        "K_auth_private",
        "K_auth_public"
      ]
    },
    {
      "id": "key.delegation",
      "name": "Delegation keypair",
      "kind": "cryptographic_component",
      "description": "Ed25519 K_delegate pair for child minting, permissions, reductions, rotation, suspension/revocation requests; alone cannot perform ordinary operations, publish, or decrypt.",
      "modality": "source_description",
      "sources": [
        {
          "file": "docs/seed/Credential_Payload.txt",
          "lines": "40-58"
        }
      ],
      "algorithm": "Ed25519",
      "fields": [
        "K_delegate_private",
        "K_delegate_public"
      ]
    },
    {
      "id": "key.authorship",
      "name": "Authorship keypair",
      "kind": "cryptographic_component",
      "description": "Ed25519 K_author pair for signed objects, credentials/statements, versions, amendments, co-signatures, and provenance.",
      "modality": "source_description",
      "sources": [
        {
          "file": "docs/seed/Credential_Payload.txt",
          "lines": "75-93"
        }
      ],
      "algorithm": "Ed25519",
      "fields": [
        "K_author_private",
        "K_author_public"
      ]
    },
    {
      "id": "key.box",
      "name": "Confidentiality/Box keypair",
      "kind": "cryptographic_component",
      "description": "X25519 K_box pair for encrypted messages/shares/keyring packages and shared secrets; cannot authenticate, sign, mint, or change policy.",
      "modality": "source_description",
      "sources": [
        {
          "file": "docs/seed/Credential_Payload.txt",
          "lines": "110-128"
        }
      ],
      "algorithm": "X25519",
      "fields": [
        "K_box_private",
        "K_box_public"
      ]
    },
    {
      "id": "key.bundle",
      "name": "Nine-field credential bundle",
      "kind": "client_payload",
      "description": "Credential ID and eight private/public component values; legacy field naming conflicts with purpose-oriented K_auth/K_delegate/K_author/K_box names.",
      "modality": "source_description",
      "sources": [
        {
          "file": "docs/seed/Description.txt",
          "lines": "55-65"
        }
      ],
      "legacy_fields": [
        "credential_id",
        "assertion_private_key",
        "assertion_public_key",
        "delegation_private_key",
        "delegation_public_key",
        "access_private_key",
        "access_public_key",
        "control_private_key",
        "control_public_key"
      ]
    },
    {
      "id": "key.private_custody",
      "name": "Client private-key custody",
      "kind": "security_boundary",
      "description": "Server should never persist CRE8/long-lived Author private keys; client custody and component-limited blast radius are central.",
      "modality": "explicit_immutable",
      "sources": [
        {
          "file": "docs/seed/Description_Zero.txt",
          "lines": "79-94"
        },
        {
          "file": "docs/seed/Structure.txt",
          "lines": "1-3"
        }
      ]
    }
  ]
}