{
  "version": "h33pqv/1.0",
  "envelope_type": "q-sign-baae",
  "envelope_hash": "9d4f6c2e8a1b5f7d3c9e6a4b8f2d1c7e5a9b3f6d8c1e4a7b2f5d8c3e6a9b4f1d7",
  "issued_at": "2026-06-13T07:48:02.000Z",
  "human_summary": {
    "claim": "Q-Sign-bound agent action rejected by the substrate gate (failed authority binding).",
    "verdict": "REJECT",
    "evidence_summary": "The action attempted to invoke 'production:write' scope but the lineage path only authorized 'staging:test-read'. The scope-expansion check on the Lineage DAG failed at the leaf hop; the gate emitted REJECT before the action ran."
  },
  "action": {
    "kind": "production_write",
    "target": "production://services/billing-microservice",
    "scope": ["production:write"],
    "parameters": {
      "operation": "patch_user_balance",
      "user_id": "user_482910"
    }
  },
  "lineage_path": [
    {
      "edge_id": "edge_a847b1c9_root_to_deploy",
      "parent": "cn=board/eric-beans",
      "child": "cn=agent/deploy-agent-7",
      "scope": ["staging:*", "production:read"],
      "t_start": "2026-05-01T00:00:00Z",
      "t_end": "2026-08-01T00:00:00Z",
      "revocation_handle": "revoke://h33.ai/edge/a847b1c9",
      "edge_sigs": {
        "ml_dsa_87": "<elided>",
        "slh_dsa_256s": "<elided>",
        "falcon_1024": "<elided>"
      }
    },
    {
      "edge_id": "edge_b193d6f2_deploy_to_runner",
      "parent": "cn=agent/deploy-agent-7",
      "child": "cn=agent/test-runner-12",
      "scope": ["staging:test-read"],
      "t_start": "2026-06-13T07:00:00Z",
      "t_end": "2026-06-13T18:00:00Z",
      "revocation_handle": "revoke://h33.ai/edge/b193d6f2",
      "edge_sigs": {
        "ml_dsa_87": "<elided>",
        "slh_dsa_256s": "<elided>",
        "falcon_1024": "<elided>"
      }
    }
  ],
  "instruction_tag": {
    "tag_id": "instr_tag_production_write_v1",
    "action_shape_hash": "5a1c3f7e9b2d6c8a4f1e5b9d3c7a0e4f8b2d6c1e5a9f3d7c0e4b8a2f6d1c5e9a3",
    "recipient": "production://services/billing-microservice"
  },
  "trust_bindings": {
    "authority_binding": {
      "result": "FAIL",
      "rationale": "Scope-expansion check failed: action scope 'production:write' is not contained within leaf hop scope 'staging:test-read'. Per Q-Sign §5.2, a child's scope MUST be a subset of its parent's scope, and the leaf hop scope is the authority ceiling for this actor."
    },
    "instruction_binding": {
      "result": "NOT_EVALUATED",
      "rationale": "Authority binding failed; downstream bindings not evaluated."
    },
    "execution_binding": {
      "result": "NOT_EVALUATED",
      "rationale": "Authority binding failed; the gate emitted REJECT without admitting the action."
    }
  },
  "nap_record": {
    "named_root": "Eric Beans · CTO",
    "chain": [
      {"hop": 1, "principal": "cn=board/eric-beans", "role": "human authority", "q_key_fpr": "qk_e8f3a2c1..."},
      {"hop": 2, "principal": "cn=agent/deploy-agent-7", "role": "delegated deploy agent", "q_key_fpr": "qk_b7a9c2d4..."},
      {"hop": 3, "principal": "cn=agent/test-runner-12", "role": "leaf actor (attempted overreach)", "q_key_fpr": "qk_d2f8e1a6..."}
    ],
    "leaf_action": "production_write on production://services/billing-microservice (REJECTED)"
  },
  "signatures": {
    "ml_dsa_87": "<elided>",
    "slh_dsa_256s": "<elided>",
    "falcon_1024": "<elided>"
  },
  "_note": "REJECT receipts are first-class artifacts in Q-Sign. They cite which binding failed and which lineage edge or instruction tag triggered the rejection. The substrate never silently drops an action; every attempt produces a verifiable verdict."
}