What this attestation records
A legal-identity attestation is the organization's own on-chain declaration of its legal metadata (legal name, EIN, entity type). It is the second layer of Pattern 3's two-attestation epistemic model: the first layer is the Extol-issued onboarding-verification attestation that records what Extol observed during org onboarding; this second layer is the org's own claim about who it is.
Both layers are needed. The self-attestation alone is epistemically thin — any pubkey holder could sign a claim about any legal name. The onboarding-verification alone is Extol's observation without the org's own confirmation. Together they form the anchoring pair: the org's self-report matches, and is cross-referenced to, Extol's independent observation.
Signer and subject
Signer: the organization's root identity key (Options B/C/D per EXT-245).
Subject: the same root identity key (self-reference).
Payload fields
legal_name,ein,jurisdiction,entity_type— the org's own claimextol_onboarding_verification_reference— SHA-256 of the anchoring Layer 1 attestation's canonical bytes (Notary Spec §4.3 additive-reference convention)
Notary Spec provenance
source_type:1(self_reported) — honest about the epistemic thinnesswitnessing_depth:5(self_asserted)attestor_relationship:6(institution)confidence:10000— the org is authoritative about its own name from its own perspective
Downstream reader discipline
To render "verified organizational identity" a reader MUST walk both layers. This attestation names its anchor via extol_onboarding_verification_reference; the reader looks up that Layer 1 attestation, verifies its signature against Extol's KMS public key, verifies its subject matches this attestation's signer, and only then treats the org identity as anchored.
A self-attestation without a corresponding onboarding-verification is legitimate testimony but weak identity evidence.