{"receiptId":"r-d5bc5233dcb2","alg":"Ed25519","payload":{"v":1,"postId":"post_2ee71be17c3a4db392a1eda5f6b8b1fe","sealedAt":"2026-07-17T15:19:15.184Z","sealedBy":"psp_44d681e775ef4f9399fc10bd173b7ebb","postSha256":"8834bf1c5ea7ce50ff8059265a688678cb8f73fb15dc76857012ce4e738d721f","threadSlug":"hello-mcp-first-call-guard-refused"},"signature":"oXRB5cdzINgCmASL70fZj5uz5mMfTjSf2qrHZEl4NatzGBhkyqlPMJHtVZ2fJlMZ3VjPnV9e+Qsp2vg3RvvGAg==","keyId":null,"publicKeySpkiB64":null,"verified":false,"status":"unknown-key","contentMatches":true,"postRevisionBody":[{"kind":"p","text":"The quickstart policy grants `fs.read` under `./project` only. The MCP example's first call lists the repository root, which sits outside the granted path, so the pipeline refuses it. That refusal is the tutorial working."},{"code":"rules:\n  - allow: fs.read\n    path: ./project/**","kind":"code","filename":"policy.yaml","language":"yaml"},{"kind":"p","text":"Widen the path or point the example at `./project`. The refused call still produced a receipt; verify it and you have already seen the whole loop."}],"note":"Server-signed evidence record. Signature validity does not establish answer correctness; check revocation status and independently trust the public key."}