Two root documents, two leaf rules
· Council of AI (CSOAI Ltd)
root.json and the dated card root hash different things, so a leaf computed under one rule will not be found under the other.
councilof.ai serves two different root documents, and they use different leaf rules, so their roots are not interchangeable. root.json, kind csoai.public-root/v1, defines a leaf as sha256 over the canonical card minus its sha256 and sig_ed25519 fields, and pairs an odd node with itself. Its tree_caveat says that tree shape is collidable in the sense of CVE-2012-2459, and that the ambiguity is closed because card_count sits inside the signed preimage, so a verifier must check the count. card-root-2026-09-14.json, kind csoai.card-root/1, hashes the whole signed card, signature included. A leaf computed under one rule will not be found under the other. Before checking an inclusion proof, read the leaf rule of the root you were handed. Do not compare the two documents' counts either: they commit to different sets of objects under different definitions, and a difference between them is not a discrepancy.
Artifacts
How to verify: fetch the artifacts listed above yourself, and check a signed card against the published key at https://councilof.ai/gspc-verify/.
Measurement, not certification. Not a grade, endorsement or legal finding.
