{"canonicalization":"Each entry_hash is SHA-256 of the JCS (RFC 8785) UTF-8 bytes of the entry without entry_hash. prev_hash is the previous entry_hash, or null on the first entry. The current issuer key signs head_hash and entry_count. A sealed snapshot also signs version and seq. SHA-256 of the JCS bytes of the whole document is the snapshot hash a receipt pins.","entries":[{"alg":"ES256","entry_hash":"349d7bb495bad55aaa25d05ee91134575e6e7d300795b37b41f4bcf29af80f0e","jwk":{"alg":"ES256","crv":"P-256","kid":"IvFpmC-vPhkY_v0vidsrWVT9uzlE5XWKZgAEOeJTq1Q","kty":"EC","use":"sig","x":"_H7J9niXF2tez_MnF25pnrDN7iJ_VC9gBzYYW9gzSPk","y":"jiorfRc9wtNaRmaFHsQaXNzcWteUA0RnpvD4SWdVl34"},"kid":"IvFpmC-vPhkY_v0vidsrWVT9uzlE5XWKZgAEOeJTq1Q","not_after":null,"not_before":"2026-09-04T08:52:05Z","prev_hash":null,"reason":null,"revoked_at":null,"status":"active"}],"head_hash":"349d7bb495bad55aaa25d05ee91134575e6e7d300795b37b41f4bcf29af80f0e","issuer_signature":{"alg":"ES256","issuer_jwk":{"alg":"ES256","crv":"P-256","kid":"IvFpmC-vPhkY_v0vidsrWVT9uzlE5XWKZgAEOeJTq1Q","kty":"EC","use":"sig","x":"_H7J9niXF2tez_MnF25pnrDN7iJ_VC9gBzYYW9gzSPk","y":"jiorfRc9wtNaRmaFHsQaXNzcWteUA0RnpvD4SWdVl34"},"jws":"eyJhbGciOiJFUzI1NiIsInR5cCI6ImNoaXQ0MDItaXNzdWVyLWhpc3Rvcnkrand0Iiwia2lkIjoiSXZGcG1DLXZQaGtZX3Ywdmlkc3JXVlQ5dXpsRTVYV0taZ0FFT2VKVHExUSJ9.eyJzY2hlbWEiOiJjaGl0NDAyLmlzc3Vlcl9oaXN0b3J5LnYxIiwicGF5bG9hZF92ZXJzaW9uIjoxLCJlbnRyeV9jb3VudCI6MSwiaGVhZF9oYXNoIjoiMzQ5ZDdiYjQ5NWJhZDU1YWFhMjVkMDVlZTkxMTM0NTc1ZTZlN2QzMDA3OTViMzdiNDFmNGJjZjI5YWY4MGYwZSIsInZlcnNpb24iOjIsInNlcSI6Mn0.YHgulY1FLf_wZrxafAkqQr2rrT-lVbU8TCuNrIHPDp0M7k7L0BJteUhQQuNI7HrS-jqN1cOXzwYJ_3LabmxADw","kid":"IvFpmC-vPhkY_v0vidsrWVT9uzlE5XWKZgAEOeJTq1Q","payload_version":1,"typ":"chit402-issuer-history+jwt"},"not_before_note":"Only kid IvFpmC-vPhkY_v0vidsrWVT9uzlE5XWKZgAEOeJTq1Q defaults not_before to 2026-09-04T08:52:05Z, the first deployment of this ES256 issuer path. The earliest receipt in the repo signed by that kid is 2026-09-26T17:27:32Z (fixture chit-5d775d12). Any other kid uses its history entry or ISSUER_KEY_NOT_BEFORE. A null not_before is unknown and the window check fails closed.","payload_version":1,"schema":"chit402.issuer_history.v1","seq":2,"version":2}