{
  "schema_version": "0.1.0",
  "catalogue_status": "discovery_inventory",
  "authority": "Evidence-derived inventory; not a final implementation-governing SSOT. Preserve source modality and consult conflicts.json.",
  "category": "enrollment_activation_client_custody",
  "description": "Drafting, claim delivery, local generation, verification, activation, assurance, and local encrypted storage.",
  "items": [
    {
      "id": "enroll.draft",
      "name": "Key draft",
      "kind": "enrollment_stage",
      "description": "Owner selects type, label, scope, permissions, child types/ceilings, depth, child count, expiration, rate limits, approvals, and bootstrap mode; Key is inactive.",
      "modality": "recommendation",
      "sources": [
        {
          "file": "docs/seed/Five_Device_Instantiation.txt",
          "lines": "3-20"
        }
      ]
    },
    {
      "id": "enroll.slots",
      "name": "Five enrollment slots",
      "kind": "enrollment_stage",
      "description": "Four component slots plus public-bundle verifier, each with random claim token, expiry, single-use state, and separate confirmation code; only token hashes stored.",
      "modality": "recommendation",
      "sources": [
        {
          "file": "docs/seed/Five_Device_Instantiation.txt",
          "lines": "22-36"
        }
      ],
      "slots": [
        "Authentication",
        "Delegation",
        "Authorship",
        "Confidentiality",
        "Public bundle verification"
      ]
    },
    {
      "id": "enroll.claim_delivery",
      "name": "Claim-link delivery",
      "kind": "enrollment_stage",
      "description": "Destination receives one-time URL while dashboard separately displays confirmation code.",
      "modality": "recommendation",
      "sources": [
        {
          "file": "docs/seed/Five_Device_Instantiation.txt",
          "lines": "38-42"
        }
      ]
    },
    {
      "id": "enroll.local_generation",
      "name": "Local component generation",
      "kind": "enrollment_stage",
      "description": "Device enters code, locally generates assigned pair, registers public key, proves possession for Ed25519, and displays/exports private component once.",
      "modality": "firm_statement",
      "sources": [
        {
          "file": "docs/seed/Five_Device_Instantiation.txt",
          "lines": "44-60"
        },
        {
          "file": "docs/seed/Structure.txt",
          "lines": "1-3"
        }
      ],
      "exports": [
        "Copy",
        "QR representation",
        "Checksummed text",
        "Encrypted .cre8component file"
      ]
    },
    {
      "id": "enroll.public_verification",
      "name": "Public bundle verification",
      "kind": "enrollment_stage",
      "description": "Fifth device receives ID, four public keys/fingerprints, type, parent, policy hash, and creation time for comparison.",
      "modality": "recommendation",
      "sources": [
        {
          "file": "docs/seed/Five_Device_Instantiation.txt",
          "lines": "62-75"
        }
      ]
    },
    {
      "id": "enroll.activation",
      "name": "Owner activation",
      "kind": "enrollment_stage",
      "description": "Logical Key becomes active only after confirmation.",
      "modality": "recommendation",
      "sources": [
        {
          "file": "docs/seed/Five_Device_Instantiation.txt",
          "lines": "76-78"
        }
      ]
    },
    {
      "id": "enroll.client_consolidation",
      "name": "Authorized-client consolidation",
      "kind": "enrollment_stage",
      "description": "Four private components imported into encrypted local nine-field payload; Argon2id-derived key and XChaCha20-Poly1305, with decrypted components only in process memory while unlocked.",
      "modality": "recommendation",
      "sources": [
        {
          "file": "docs/seed/Five_Device_Instantiation.txt",
          "lines": "80-90"
        }
      ]
    },
    {
      "id": "enroll.assurance_modes",
      "name": "Bootstrap assurance modes",
      "kind": "enrollment_configuration",
      "description": "Lower-assurance modes must not be prohibited; record mode and available client/destination/network evidence and acknowledgement without claiming IP proves device separation.",
      "modality": "firm_statement",
      "sources": [
        {
          "file": "docs/seed/Five_Device_Instantiation.txt",
          "lines": "92-109"
        }
      ],
      "modes": [
        "split_5",
        "split_3",
        "split_2",
        "single"
      ]
    },
    {
      "id": "enroll.hardware",
      "name": "Hardware CRE8 device",
      "kind": "future_component",
      "description": "Hardware custody device is discussed for later and explicitly deferred from MVP.",
      "modality": "explicit_deferral",
      "sources": [
        {
          "file": "docs/seed/Description_Zero.txt",
          "lines": "7"
        },
        {
          "file": "docs/seed/MVP_Cut_Line.txt",
          "lines": "28-31"
        }
      ]
    }
  ]
}