{
  "canonical_cbor": "RFC 8949 4.2.1 core deterministic (length-first key order)",
  "envelope": "COSE_Sign1 (RFC 9052), EdDSA/Ed25519",
  "schema_id": "policy/1",
  "spec": "JouleClaw Policy Receipt v1",
  "test_key": {
    "cose_alg": "EdDSA (-8)",
    "ed25519_public_raw_hex": "03a107bff3ce10be1d70dd18e74bc09967e4d6309ba50d5f1ddc8664125531b8",
    "ed25519_seed_hex": "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
    "note": "TEST KEY ONLY. Same seed as JCR-1 conformance/test-keys.json.",
    "steward_kid": "did:keri:EJ9testStewardAID000000000000000"
  },
  "vector_count": 4,
  "vectors": [
    {
      "cose_sign1_hex": "d284582fa201270458296469643a6b6572693a454a397465737453746577617264414944303030303030303030303030303030a0590123aa6269646c706f6c726370742d30303031656167656e746e6469643a6b65793a7a416c70686166616374696f6ea3646b696e646a66696c6573797374656d646d6f646564726561646470617468732f776f726b73706163652f6e6f7465732e6d64677374657761726478296469643a6b6572693a454a397465737453746577617264414944303030303030303030303030303030686465636973696f6ea2646b696e6465616c6c6f776472756c656e726561642d776f726b737061636569636c6f7365645f617474323032362d30362d30325431323a30303a30305a69656e67696e655f696468656e67696e652d416a6a635f7265636569707468706f6c6963792f316e61756469745f73657175656e6365016e706f6c6963795f76657273696f6e015840eceb966d0bc3b90faa8ea33442a846712c66c995450125e1d71b709f24dea47e9fcabb1ad9b7eb110572ecf24b745b15dc20fb1399643167ee4d96d13ea4dc06",
      "description": "Allow — filesystem read of a workspace file under the read-workspace rule.",
      "n": 1,
      "receipt": {
        "action": {
          "kind": "filesystem",
          "mode": "read",
          "path": "/workspace/notes.md"
        },
        "agent": "did:key:zAlpha",
        "audit_sequence": 1,
        "closed_at": "2026-06-02T12:00:00Z",
        "decision": {
          "kind": "allow",
          "rule": "read-workspace"
        },
        "engine_id": "engine-A",
        "id": "polrcpt-0001",
        "jc_receipt": "policy/1",
        "policy_version": 1,
        "steward": "did:keri:EJ9testStewardAID000000000000000"
      },
      "signed_core_cbor_hex": "aa6269646c706f6c726370742d30303031656167656e746e6469643a6b65793a7a416c70686166616374696f6ea3646b696e646a66696c6573797374656d646d6f646564726561646470617468732f776f726b73706163652f6e6f7465732e6d64677374657761726478296469643a6b6572693a454a397465737453746577617264414944303030303030303030303030303030686465636973696f6ea2646b696e6465616c6c6f776472756c656e726561642d776f726b737061636569636c6f7365645f617474323032362d30362d30325431323a30303a30305a69656e67696e655f696468656e67696e652d416a6a635f7265636569707468706f6c6963792f316e61756469745f73657175656e6365016e706f6c6963795f76657273696f6e01"
    },
    {
      "cose_sign1_hex": "d284582fa201270458296469643a6b6572693a454a397465737453746577617264414944303030303030303030303030303030a059013aaa6269646c706f6c726370742d30303032656167656e746e6469643a6b65793a7a416c70686166616374696f6ea3646b696e646a66696c6573797374656d646d6f64656472656164647061746878192f776f726b73706163652f2e736563726574732f6b2e70656d677374657761726478296469643a6b6572693a454a397465737453746577617264414944303030303030303030303030303030686465636973696f6ea3646b696e646464656e796472756c656a6e6f2d7365637265747366726561736f6e6d6578706c696369745f64656e7969636c6f7365645f617474323032362d30362d30325431323a30303a30305a69656e67696e655f696468656e67696e652d416a6a635f7265636569707468706f6c6963792f316e61756469745f73657175656e6365026e706f6c6963795f76657273696f6e015840bf5f9b9e082420841e4d4d52c7abda59fcf8a6159eaa452b935c0b48d8be3b0b8c8441e4b477606352cb55c361fb9e9779697c5a846afd2c9b3040450f1c7a05",
      "description": "Explicit deny — filesystem read of a workspace secret shadowed by the no-secrets rule.",
      "n": 2,
      "receipt": {
        "action": {
          "kind": "filesystem",
          "mode": "read",
          "path": "/workspace/.secrets/k.pem"
        },
        "agent": "did:key:zAlpha",
        "audit_sequence": 2,
        "closed_at": "2026-06-02T12:00:00Z",
        "decision": {
          "kind": "deny",
          "reason": "explicit_deny",
          "rule": "no-secrets"
        },
        "engine_id": "engine-A",
        "id": "polrcpt-0002",
        "jc_receipt": "policy/1",
        "policy_version": 1,
        "steward": "did:keri:EJ9testStewardAID000000000000000"
      },
      "signed_core_cbor_hex": "aa6269646c706f6c726370742d30303032656167656e746e6469643a6b65793a7a416c70686166616374696f6ea3646b696e646a66696c6573797374656d646d6f64656472656164647061746878192f776f726b73706163652f2e736563726574732f6b2e70656d677374657761726478296469643a6b6572693a454a397465737453746577617264414944303030303030303030303030303030686465636973696f6ea3646b696e646464656e796472756c656a6e6f2d7365637265747366726561736f6e6d6578706c696369745f64656e7969636c6f7365645f617474323032362d30362d30325431323a30303a30305a69656e67696e655f696468656e67696e652d416a6a635f7265636569707468706f6c6963792f316e61756469745f73657175656e6365026e706f6c6963795f76657273696f6e01"
    },
    {
      "cose_sign1_hex": "d284582fa201270458296469643a6b6572693a454a397465737453746577617264414944303030303030303030303030303030a059012caa6269646c706f6c726370742d30303033656167656e746d6469643a6b65793a7a4265746166616374696f6ea464686f73746f6170692e6578616d706c652e636f6d646b696e64676e6574776f726b64706f72741901bb666d6574686f6467636f6e6e656374677374657761726478296469643a6b6572693a454a397465737453746577617264414944303030303030303030303030303030686465636973696f6ea2646b696e646464656e7966726561736f6e716e6f5f6d61746368696e675f616c6c6f7769636c6f7365645f617474323032362d30362d30325431323a30303a30305a69656e67696e655f696468656e67696e652d416a6a635f7265636569707468706f6c6963792f316e61756469745f73657175656e6365036e706f6c6963795f76657273696f6e015840b5213757816427cd20b67d6e9d5e5e7ca4332683105b2947a0959df6f0f39e33e6d2608114d5d87ece8825332a0b0f80909d8e7fe5e0990a44c5f4e0ab49d600",
      "description": "No-matching-allow (deny-by-default) — network connect against an empty policy.",
      "n": 3,
      "receipt": {
        "action": {
          "host": "api.example.com",
          "kind": "network",
          "method": "connect",
          "port": 443
        },
        "agent": "did:key:zBeta",
        "audit_sequence": 3,
        "closed_at": "2026-06-02T12:00:00Z",
        "decision": {
          "kind": "deny",
          "reason": "no_matching_allow"
        },
        "engine_id": "engine-A",
        "id": "polrcpt-0003",
        "jc_receipt": "policy/1",
        "policy_version": 1,
        "steward": "did:keri:EJ9testStewardAID000000000000000"
      },
      "signed_core_cbor_hex": "aa6269646c706f6c726370742d30303033656167656e746d6469643a6b65793a7a4265746166616374696f6ea464686f73746f6170692e6578616d706c652e636f6d646b696e64676e6574776f726b64706f72741901bb666d6574686f6467636f6e6e656374677374657761726478296469643a6b6572693a454a397465737453746577617264414944303030303030303030303030303030686465636973696f6ea2646b696e646464656e7966726561736f6e716e6f5f6d61746368696e675f616c6c6f7769636c6f7365645f617474323032362d30362d30325431323a30303a30305a69656e67696e655f696468656e67696e652d416a6a635f7265636569707468706f6c6963792f316e61756469745f73657175656e6365036e706f6c6963795f76657273696f6e01"
    },
    {
      "cose_sign1_hex": "d284582fa201270458296469643a6b6572693a454a397465737453746577617264414944303030303030303030303030303030a0590173ab6269646c706f6c726370742d30303034656167656e746e6469643a6b65793a7a416c70686166616374696f6ea3646b696e646a66696c6573797374656d646d6f646564726561646470617468732f776f726b73706163652f6e6f7465732e6d64677374657761726478296469643a6b6572693a454a397465737453746577617264414944303030303030303030303030303030686465636973696f6ea2646b696e6465616c6c6f776472756c656e726561642d776f726b737061636569636c6f7365645f617474323032362d30362d30325431323a30303a30305a69656e67696e655f696468656e67696e652d416a6a635f7265636569707468706f6c6963792f316d706f6c6963795f6469676573747840616234653464376135393034376235333464306362643238333235306430353961323966353232393761333264373631363962366134383432653866346563396e61756469745f73657175656e6365046e706f6c6963795f76657273696f6e015840f8f76d5c857176584653f1335f7668ee8495d86606ce1dad3c8a9abddfeb25f13306c29d6e9a0de659100346f1023c7d6dd398e0a06875f15574ccd2157f490d",
      "description": "Policy-bound allow — same decision as vector 1, with the digest of the rules that produced it. Vectors 1-3 omit the field and keep the signed core they shipped with.",
      "n": 4,
      "receipt": {
        "action": {
          "kind": "filesystem",
          "mode": "read",
          "path": "/workspace/notes.md"
        },
        "agent": "did:key:zAlpha",
        "audit_sequence": 4,
        "closed_at": "2026-06-02T12:00:00Z",
        "decision": {
          "kind": "allow",
          "rule": "read-workspace"
        },
        "engine_id": "engine-A",
        "id": "polrcpt-0004",
        "jc_receipt": "policy/1",
        "policy_digest": "ab4e4d7a59047b534d0cbd283250d059a29f52297a32d76169b6a4842e8f4ec9",
        "policy_version": 1,
        "steward": "did:keri:EJ9testStewardAID000000000000000"
      },
      "signed_core_cbor_hex": "ab6269646c706f6c726370742d30303034656167656e746e6469643a6b65793a7a416c70686166616374696f6ea3646b696e646a66696c6573797374656d646d6f646564726561646470617468732f776f726b73706163652f6e6f7465732e6d64677374657761726478296469643a6b6572693a454a397465737453746577617264414944303030303030303030303030303030686465636973696f6ea2646b696e6465616c6c6f776472756c656e726561642d776f726b737061636569636c6f7365645f617474323032362d30362d30325431323a30303a30305a69656e67696e655f696468656e67696e652d416a6a635f7265636569707468706f6c6963792f316d706f6c6963795f6469676573747840616234653464376135393034376235333464306362643238333235306430353961323966353232393761333264373631363962366134383432653866346563396e61756469745f73657175656e6365046e706f6c6963795f76657273696f6e01"
    }
  ]
}