MVP
Built- CPID minting with UUIDv7 and a published identifier syntax
- ES256 issuance with a four-tier key hierarchy and a JWKS endpoint
- Registry with live status resolution and revocation
- Policy engine returning permit, restrict or deny with named obligations
- Hash-chained evidence with recomputed digests and portable bundles
- Private portal with operator and reviewer separation
- Keys are held in software on the host, not in an HSM
- Nothing is enforced at a real gateway yet — decisions are advisory
- Single tenant, single issuer, no federation