{
  "version": "corpid-roadmap/1",
  "purpose": "Help a corporation construct and maintain company-owned digital authority. Rootz provides guidance, discovery, validation and routing; the corporation owns the identity, evidence and keys.",
  "principles": [
    "Rootz is not the issuer or central registry of corporate truth.",
    "A missing item is a gap, not a failed identity.",
    "Evidence depth is earned by observation and verification, never by UI selection.",
    "Source correspondence is evidence and should be retained separately from the attached artifact.",
    "Private keys, seed phrases and recovery secrets never belong in CorpID.",
    "A completed CorpID should remain usable if Rootz disappears.",
    "Humans and AI partners follow the same roadmap and evidence rules."
  ],
  "stages": [
    {
      "id": "legal-existence",
      "label": "Legal existence",
      "expected": [
        "certificate-of-incorporation-or-formation",
        "articles-of-incorporation-association-or-organization",
        "bylaws-or-operating-agreement",
        "state-or-national-registry-record",
        "registered-agent-record",
        "ein-or-tax-identity-artifact"
      ]
    },
    {
      "id": "names-identifiers",
      "label": "Corporate names and identifiers",
      "expected": [
        "dba-or-assumed-name-filing",
        "dba-source-correspondence",
        "ein-source-correspondence-if-available",
        "duns-if-applicable",
        "lei-if-applicable",
        "domain-and-dns-control",
        "corporate-digital-name"
      ]
    },
    {
      "id": "root-governance",
      "label": "Root control and governance",
      "expected": [
        "public-authority-account",
        "safe-hardware-or-hsm-control-model",
        "approval-threshold",
        "succession-and-recovery-process",
        "corporate-digital-authority-policy",
        "board-or-member-adoption-evidence"
      ]
    },
    {
      "id": "infrastructure-delegation",
      "label": "Infrastructure and delegated authority",
      "expected": [
        "enterprise-pki-root-if-used",
        "microsoft-google-aws-okta-bindings-as-used",
        "epistery-binding-if-used",
        "authorized-people-machines-workloads-and-ai-agents",
        "authorization-and-revocation-history"
      ]
    },
    {
      "id": "publish",
      "label": "Company-owned publication",
      "expected": [
        "company-hosted-well-known-corpid",
        "authority-policy-uri-and-hash",
        "public-root-control-state",
        "delegation-and-revocation-discovery",
        "independent-verification-path"
      ]
    }
  ],
  "evidence_bundle": {
    "retain": [
      "artifact-hash",
      "company-owned-artifact-uri",
      "source-message-hash-if-any",
      "source-sender-and-received-time-if-any",
      "attachment-hash-if-any",
      "origin-method",
      "origin-evidence",
      "issuer",
      "claim",
      "depth",
      "observed-at",
      "as-of-time-if-different",
      "expiry-if-any",
      "notes"
    ],
    "rule": "Do not infer stronger origin or authority than the retained evidence supports.",
    "vocabulary": {
      "note": "One vocabulary for every kind of evidence. acquisition and strength are ordinal; factors is a set; method is not ordinal.",
      "acquisition": [
        "gap",
        "asserted",
        "referenced",
        "observed",
        "signed-message",
        "provider-issued",
        "contract-verified-message"
      ],
      "strength": [
        "self-asserted",
        "examined",
        "issuer-attested",
        "issuer-signed"
      ],
      "factors": [
        "document",
        "biometric",
        "device-bound",
        "activation-factor"
      ],
      "multifactor": "derived from factors (two or more), never asserted",
      "federal_vdc": "issuer-signed with factors device-bound and activation-factor (US, 2026-09-08)"
    }
  },
  "ai_task_contract": {
    "instruction": "For each expected item, find the best available evidence, preserve original bytes and source context when authorized, record gaps explicitly, and return a structured evidence bundle. Never request private key material.",
    "preference_order": [
      "government-or-issuer-origin artifact",
      "original delivery correspondence",
      "company-owned data room or record",
      "counsel or provider copy",
      "company-uploaded copy"
    ]
  },
  "router": {
    "goal": "One common Rootz CorpID MCP/HTTP surface routes many independently owned CorpIDs.",
    "conceptual_tools": [
      "corpid_resolve",
      "corpid_roadmap",
      "corpid_expected_evidence",
      "corpid_check_registry",
      "corpid_check_dns",
      "corpid_verify_email_origin",
      "corpid_hash_artifact",
      "corpid_verify_signature",
      "corpid_check_root_control",
      "corpid_check_provider_binding",
      "corpid_read_authority",
      "corpid_check_delegation",
      "corpid_check_revocation",
      "corpid_build_evidence_record"
    ]
  },
  "reference_test_entities": [
    {
      "name": "Rootz Corp.",
      "purpose": "current reference specimen and rich email/data-room evidence"
    },
    {
      "name": "White Horse Hill, LLC",
      "purpose": "private LLC onboarding shape"
    },
    {
      "name": "Rivetz",
      "purpose": "older historical corporate identity and legacy evidence shape"
    }
  ]
}