This repository contains an unimplemented architecture and protocol draft. No protocol implementation is approved for production or security-critical use.

Report vulnerabilities through GitHub private vulnerability reporting. Do not include secrets, identity documents, live exploit targets, or real reader data in public issues. No response SLA or bounty is currently established.

Before a public pilot, obtain independent review of identity enrollment, authorization evaluation, JWS parsing, credential approval binding, signing key isolation, transparency and witness integration, control-state completeness, recovery, and verification copy. Complete the acceptance gates in ROADMAP.md. Documentation checks do not satisfy these gates.

Before releasing an implementation, establish response ownership, supported-version policy, dependency update process, and an incident communication plan. The draft is public for inspection under the existing restrictive license; this is not approval for production deployment or a grant of independent reuse rights.