Recompute the 14 September card root from its leaves

2026-09-14 · Council of AI (CSOAI Ltd)

The card root's leaves hash whole signed cards, and rebuilding the tree from the published leaf list reproduces its root.

card-root-2026-09-14.json is a Merkle commitment over signed cards. Its leaf_rule says each leaf is sha256 over canonical JSON of the whole signed card, including body, id, signature and did, not the body alone. Its proof_rule says parents combine positionally as sha256(left + right). We rebuilt the tree from the published leaves list in index order: pairing an unpaired node with itself at each level reproduces the published merkle_root, which begins 989b4e7f771d, and promoting the unpaired node unchanged does not. We also hashed each signed card we had fetched on 14 September, and each matched its listed leaf, including signed-governan-09759e29f44b.json at index 433. The same file lists skipped cards with a reason, such as superseded, so a reader can see what the root leaves out. The document is marked not_a_certificate: it commits to which bytes existed, and says nothing about whether the numbers inside those bytes mean what a reader hopes.

How to verify: fetch the artifacts listed above yourself, and check a signed card against the published key at https://councilof.ai/gspc-verify/.

Measurement, not certification. Not a grade, endorsement or legal finding.