{
  "schema_version": "0.1.0",
  "catalogue_status": "discovery_inventory",
  "authority": "Evidence-derived inventory; not a final implementation-governing SSOT. Preserve source modality and consult conflicts.json.",
  "category": "requests_apis_routes",
  "description": "Signing inputs, headers, verification, route families, authentication descriptions, and operation signatures.",
  "items": [
    {
      "id": "api.signing_input",
      "name": "CRE8-REQUEST-V1 signing input",
      "kind": "protocol_component",
      "description": "Fixed versioned byte input signed by Authentication private key; arbitrary serialized JSON must not be signed directly.",
      "modality": "firm_statement",
      "sources": [
        {
          "file": "docs/seed/API_Request_Format.txt",
          "lines": "1-18"
        }
      ],
      "fields": [
        "credential_id",
        "component_version",
        "method uppercase",
        "normalized path",
        "SHA-256 normalized query hash",
        "SHA-256 exact-body hash",
        "Unix timestamp",
        "random base64url nonce",
        "CRE8 API origin audience"
      ]
    },
    {
      "id": "api.headers",
      "name": "Suggested CRE8 headers",
      "kind": "protocol_component",
      "description": "Candidate request headers for credential, version, freshness, digest, and signatures.",
      "modality": "recommendation",
      "sources": [
        {
          "file": "docs/seed/API_Request_Format.txt",
          "lines": "20-28"
        }
      ],
      "headers": [
        "CRE8-Credential-ID",
        "CRE8-Component-Version",
        "CRE8-Timestamp",
        "CRE8-Nonce",
        "CRE8-Body-Digest",
        "CRE8-Auth-Signature",
        "CRE8-Purpose-Signature"
      ]
    },
    {
      "id": "api.verification",
      "name": "Server verification sequence",
      "kind": "protocol_flow",
      "description": "Strict parsing, component lookup/status, freshness/replay/digest/signature checks, authorization/limits, decision record, execution.",
      "modality": "firm_statement",
      "sources": [
        {
          "file": "docs/seed/API_Request_Format.txt",
          "lines": "30-44"
        }
      ],
      "steps": [
        "Parse with strict size limits",
        "Locate authentication public component",
        "Reject unknown/inactive versions",
        "Check timestamp window",
        "Atomically record nonce",
        "Reject replay",
        "Recalculate body digest",
        "Verify Authentication signature",
        "Verify purpose signature when required",
        "Evaluate effective permissions",
        "Apply limits",
        "Record authorization decision",
        "Execute"
      ]
    },
    {
      "id": "api.canonicalization",
      "name": "Signed document canonicalization",
      "kind": "protocol_component",
      "description": "Deterministic representation such as JCS is proposed for policy documents and authorship metadata.",
      "modality": "recommendation",
      "sources": [
        {
          "file": "docs/seed/API_Request_Format.txt",
          "lines": "46"
        }
      ]
    },
    {
      "id": "route.public",
      "name": "Public route surface",
      "kind": "route_family",
      "description": "Public routes listed as /, /health, /.well-known/jwks.json, /ui*, and authentication bootstrap routes.",
      "modality": "source_description",
      "sources": [
        {
          "file": "docs/seed/Composition_Dependencies.txt",
          "lines": "40-42"
        }
      ],
      "routes": [
        "/",
        "/health",
        "/.well-known/jwks.json",
        "/ui*",
        "auth bootstrap routes"
      ]
    },
    {
      "id": "route.gateway",
      "name": "Gateway route surface",
      "kind": "route_family",
      "description": "/api/* described as protected by key JWT, device header, and use-key constraints; conflicts with signed-request model.",
      "modality": "conflict",
      "sources": [
        {
          "file": "docs/seed/Composition_Dependencies.txt",
          "lines": "43"
        },
        {
          "file": "docs/seed/Description.txt",
          "lines": "24-34"
        }
      ],
      "routes": [
        "/api/*"
      ]
    },
    {
      "id": "route.console",
      "name": "Console route surface",
      "kind": "route_family",
      "description": "/console/api/* described as owner-JWT protected; conflicts with opaque hashed Owner session source.",
      "modality": "conflict",
      "sources": [
        {
          "file": "docs/seed/Composition_Dependencies.txt",
          "lines": "44"
        },
        {
          "file": "docs/seed/Sessions.txt",
          "lines": "1-3"
        }
      ],
      "routes": [
        "/console/api/*"
      ]
    },
    {
      "id": "api.signature_matrix",
      "name": "Signature requirements by operation",
      "kind": "protocol_matrix",
      "description": "Operation-specific Authentication, Delegation, Authorship, Box-encryption, Owner, and step-up combinations.",
      "modality": "source_description",
      "sources": [
        {
          "file": "docs/seed/Signature_Requirements_By_Operation.txt",
          "lines": "1-16"
        }
      ],
      "operations": [
        {
          "operation": "Read an authorized resource",
          "required_components_or_authority": "Authentication",
          "source_line": 3
        },
        {
          "operation": "Create an ordinary resource",
          "required_components_or_authority": "Authentication",
          "source_line": 4
        },
        {
          "operation": "Publish authored material",
          "required_components_or_authority": "Authentication + Authorship",
          "source_line": 5
        },
        {
          "operation": "Issue a signed credential",
          "required_components_or_authority": "Authentication + Authorship",
          "source_line": 6
        },
        {
          "operation": "Send an encrypted message",
          "required_components_or_authority": "Authentication; encryption occurs using recipient Box public key",
          "source_line": 7
        },
        {
          "operation": "Mint a child Key",
          "required_components_or_authority": "Authentication + Delegation",
          "source_line": 8
        },
        {
          "operation": "Assign child permissions",
          "required_components_or_authority": "Authentication + Delegation",
          "source_line": 9
        },
        {
          "operation": "Expand child permissions",
          "required_components_or_authority": "Authentication + Delegation, possibly Owner approval",
          "source_line": 10
        },
        {
          "operation": "Rotate the authentication component",
          "required_components_or_authority": "Delegation or Owner",
          "source_line": 11
        },
        {
          "operation": "Rotate the authorship component",
          "required_components_or_authority": "Authentication + Delegation, or Owner",
          "source_line": 12
        },
        {
          "operation": "Rotate the delegation component",
          "required_components_or_authority": "Owner approval recommended",
          "source_line": 13
        },
        {
          "operation": "Revoke a child",
          "required_components_or_authority": "Authentication + Delegation",
          "source_line": 14
        },
        {
          "operation": "Revoke a subtree",
          "required_components_or_authority": "Authentication + Delegation plus elevated policy or Owner",
          "source_line": 15
        },
        {
          "operation": "Owner action",
          "required_components_or_authority": "Owner session plus step-up when required",
          "source_line": 16
        }
      ]
    }
  ]
}