{
  "version": "h33pqv/1.0",
  "envelope_type": "q-sign-baae",
  "envelope_hash": "8c1e5a2f9d3b7e0c4a6f8e2d1c5b9a3e7f4d8c2b6e1a5f9d3c7b0e4a8f2d6c1b5",
  "issued_at": "2026-06-13T07:42:18.000Z",
  "human_summary": {
    "claim": "Q-Sign-bound agent action permitted by the substrate gate.",
    "verdict": "PERMIT",
    "evidence_summary": "All three trust bindings (authority, instruction, execution) held. Lineage DAG path verified from root principal 'cn=board/eric-beans' through 'deploy-agent-7' to 'test-runner-12'; scope and time bounds contained on every hop. Q-Key triple verified under ML-DSA-87, SLH-DSA-256s, and FALCON-1024."
  },
  "action": {
    "kind": "test_run",
    "target": "staging://services/auth-microservice",
    "scope": ["staging:test-read"],
    "parameters": {
      "suite": "regression-q2-2026",
      "concurrency": 8
    }
  },
  "lineage_path": [
    {
      "edge_id": "edge_a847b1c9_root_to_deploy",
      "parent": "cn=board/eric-beans",
      "child": "cn=agent/deploy-agent-7",
      "scope": ["staging:*", "production:read"],
      "t_start": "2026-05-01T00:00:00Z",
      "t_end": "2026-08-01T00:00:00Z",
      "revocation_handle": "revoke://h33.ai/edge/a847b1c9",
      "edge_sigs": {
        "ml_dsa_87": "<base64-encoded ML-DSA-87 signature elided for example>",
        "slh_dsa_256s": "<base64-encoded SLH-DSA-256s signature elided for example>",
        "falcon_1024": "<base64-encoded FALCON-1024 signature elided for example>"
      }
    },
    {
      "edge_id": "edge_b193d6f2_deploy_to_runner",
      "parent": "cn=agent/deploy-agent-7",
      "child": "cn=agent/test-runner-12",
      "scope": ["staging:test-read"],
      "t_start": "2026-06-13T07:00:00Z",
      "t_end": "2026-06-13T18:00:00Z",
      "revocation_handle": "revoke://h33.ai/edge/b193d6f2",
      "edge_sigs": {
        "ml_dsa_87": "<base64-encoded ML-DSA-87 signature elided for example>",
        "slh_dsa_256s": "<base64-encoded SLH-DSA-256s signature elided for example>",
        "falcon_1024": "<base64-encoded FALCON-1024 signature elided for example>"
      }
    }
  ],
  "instruction_tag": {
    "tag_id": "instr_tag_test_run_v1",
    "action_shape_hash": "3b0c1e9f4a6e2c84d72b8c5f1a09e6b3d4f8c7a2e1b9d6c3f8a4e7b1c5d9f2a6",
    "recipient": "staging://services/auth-microservice"
  },
  "trust_bindings": {
    "authority_binding": {
      "result": "PASS",
      "rationale": "Lineage path resolves from root to actor with scope and time bounds satisfied on every hop."
    },
    "instruction_binding": {
      "result": "PASS",
      "rationale": "Instruction tag matches action shape; recipient is the declared target."
    },
    "execution_binding": {
      "result": "PASS",
      "rationale": "HATS gate Permit emitted; downstream receipt linked by envelope_hash."
    }
  },
  "nap_record": {
    "named_root": "Eric Beans · CTO",
    "chain": [
      {"hop": 1, "principal": "cn=board/eric-beans", "role": "human authority", "q_key_fpr": "qk_e8f3a2c1..."},
      {"hop": 2, "principal": "cn=agent/deploy-agent-7", "role": "delegated deploy agent", "q_key_fpr": "qk_b7a9c2d4..."},
      {"hop": 3, "principal": "cn=agent/test-runner-12", "role": "leaf actor", "q_key_fpr": "qk_d2f8e1a6..."}
    ],
    "leaf_action": "test_run on staging://services/auth-microservice"
  },
  "signatures": {
    "ml_dsa_87": "<base64-encoded ML-DSA-87 signature over canonical envelope minus signatures block>",
    "slh_dsa_256s": "<base64-encoded SLH-DSA-256s signature over canonical envelope minus signatures block>",
    "falcon_1024": "<base64-encoded FALCON-1024 signature over canonical envelope minus signatures block>"
  },
  "_note": "This example uses elided signature byte fields for illustration. Run /verify/ in a browser with a real Q-Sign-emitted receipt to see triple-family verification end to end."
}