{
 "type": "object",
 "required": [
  "rule_id",
  "rule_hash",
  "subject",
  "decision",
  "issued_at",
  "expires_at",
  "key_id"
 ],
 "additionalProperties": false,
 "properties": {
  "rule_id": {
   "type": "string",
   "const": "req_b68b0bb66d46@1"
  },
  "rule_hash": {
   "type": "string",
   "const": "b4f61359eb6dacaba7aa8beaac881d9b1e9feeac654ab3ceb5b302870a984022"
  },
  "subject": {
   "type": "string",
   "maxLength": 160
  },
  "decision": {
   "type": "string",
   "enum": [
    "ALLOW",
    "REFUSE"
   ]
  },
  "issued_at": {
   "type": "integer",
   "description": "unix seconds"
  },
  "expires_at": {
   "type": "integer",
   "description": "unix seconds"
  },
  "key_id": {
   "type": "string"
  },
  "attestation_hash": {
   "type": "string",
   "description": "optional (delegated reliance): sha256 of the accepted attestation; when present it is part of the signed bytes"
  }
 }
}

# how to verify
verify: Ed25519 over canonical = JSON of the seven fields, keys sorted, no spaces, ASCII (json.dumps(msg, sort_keys=True, separators=(',',':'), ensure_ascii=True)); public key = the entry whose key_id equals message.key_id at https://studio.mizan.market/.well-known/mizan-keys.json (public_key_b64, raw 32 bytes); signature is base64url; then require rule_id == req_b68b0bb66d46@1, rule_hash == b4f61359eb6dacaba7aa8beaac881d9b1e9feeac654ab3ceb5b302870a984022, subject == who you are gating, expires_at > now, decision == ALLOW

# per subject: the check reply carries it as contract_message {message, canonical, signature}
GET https://studio.mizan.market/api/check/SUBJECT?requirement=req_b68b0bb66d46@1&requirement_hash=b4f61359eb6dacaba7aa8beaac881d9b1e9feeac654ab3ceb5b302870a984022