cloakllm-verifier 0.12.0__tar.gz

cloakllm_verifier-0.12.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 The CloakLLM Authors (cloakllm@gmail.com)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

cloakllm_verifier-0.12.0/PKG-INFO

@@ -0,0 +1,82 @@
+Metadata-Version: 2.4
+Name: cloakllm-verifier
+Version: 0.12.0
+Summary: Standalone, dependency-light verifier for CloakLLM audit artifacts -- verify hash chains, Ed25519 signatures, key provenance, RFC 3161 timestamps, and compliance reports WITHOUT the full SDK or trusting CloakLLM's code.
+Author-email: The CloakLLM Authors <cloakllm@gmail.com>
+License: MIT
+Project-URL: Homepage, https://cloakllm.dev
+Project-URL: Repository, https://github.com/cloakllm/cloakllm-verifier
+Keywords: audit,verification,eu-ai-act,compliance,attestation,rfc3161,hash-chain
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security :: Cryptography
+Classifier: Intended Audience :: Legal Industry
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: cloakllm[attestation,timestamping]<0.13.0,>=0.12.0
+Provides-Extra: dev
+Requires-Dist: pytest>=7.0; extra == "dev"
+Dynamic: license-file
+
+# cloakllm-verifier
+
+**Independently verify CloakLLM audit artifacts — without the PII-detection stack, and without trusting CloakLLM's code.**
+
+CloakLLM's whole pitch is *compliance you can verify, not compliance you're asked to believe.* This is the tool that makes that literal: an auditor, regulator, or CI pipeline installs `cloakllm-verifier` and checks the artifacts themselves.
+
+It **reuses CloakLLM's own verification code** (single source of truth — no reimplementation, no drift) but pulls **only the cryptography extras** — no spaCy, no NLP models. A lean install for people who need to *check*, not *produce*.
+
+```bash
+pip install cloakllm-verifier      # Python; crypto deps only, no spaCy
+npm install cloakllm-verifier      # JavaScript; zero deps beyond cloakllm (see js/README.md)
+```
+
+This repo ships **two packages** from one source of truth: the Python package at the root and the JavaScript package under [`js/`](js/). Both expose the same CLI (`cloakllm-verify`) and the same checks, with byte-comparable `--json` output.
+
+## CLI
+
+```bash
+cloakllm-verify audit      ./cloakllm_audit                 # hash-chain integrity
+cloakllm-verify timestamp  ./cloakllm_audit                 # offline RFC 3161 checkpoint tokens
+cloakllm-verify keys       cert.json --manifest m.json      # KeyManifest provenance + revocation
+cloakllm-verify report     report.json ./cloakllm_audit     # re-validate a compliance report
+cloakllm-verify all        ./cloakllm_audit                 # everything, one exit code
+cloakllm-verify audit ./cloakllm_audit --json               # machine-readable (CI)
+```
+
+Exit code `0` = verified, `1` = failed/invalid. Output is ASCII-only.
+
+## Python API
+
+```python
+from cloakllm_verifier import verify_audit, verify_timestamps, verify_all
+
+r = verify_all("./cloakllm_audit")
+assert r["ok"], r          # {ok, audit: {...}, timestamps: {...}}
+```
+
+## What it checks
+- **Hash-chain integrity** — recomputes every SHA-256 link from the canonical JSON; any tampered, reordered, deleted, or relinked entry fails.
+- **RFC 3161 trusted timestamps** — offline-verifies every `chain_checkpoint` token (proving the chain existed no later than the TSA's time); reports the earliest provable time.
+- **KeyManifest provenance + revocation** — verifies a signed certificate against its published KeyManifest (signature, key-id binding, validity window, manifest-hash integrity, offline-root signature when claimed) and checks it against a root-signed RevocationList.
+- **Compliance-report re-validation** — independently re-verifies the audit chain a report describes and rejects any report that claims a *verified* chain or a *COMPLIANT* verdict over a log that does not actually verify. It does not trust the report's own claims.
+
+## What a passing result does — and does NOT — prove
+
+Be precise about the guarantees (an auditor needs to know the edges):
+
+- **`audit` proves integrity + internal consistency of the entries present** — every SHA-256 link recomputes and chains cleanly. It does **not** prove:
+  - **Completeness.** A hash chain is anchored at its genesis, not its head, so removing entries from the **end** (tail truncation) leaves a still-valid prefix. Detecting truncation needs an external head anchor — an **RFC 3161 checkpoint over the final `entry_hash`** (`timestamp`), which binds "the chain was at least this long at time T".
+  - **Authenticity.** The chain is a keyless SHA-256 construction: anyone who can write the log can recompute a self-consistent one. Authenticity comes from the **Ed25519 attestation** (`keys`) — a signed certificate whose key provenance you verify against a published KeyManifest.
+- **`keys` without `--manifest`** only checks the certificate's signature against the key embedded in the certificate — it does **not** establish who owns that key. Pass `--manifest` for real provenance; the CLI marks signature-only results `UNVERIFIED`, not "verified".
+- **`report`** re-verifies the chain and checks the report's claims for internal consistency against it; it is not a cryptographic binding of that exact report to that exact log beyond an entry-count sanity check.
+
+### Known limitation: cross-SDK whole-number floats
+
+A hashed floating-point field that happens to be a whole number (e.g. a timing metric of exactly `0.0` or `5.0`) serializes as `5.0` in Python but `5` in JavaScript, so a chain written by one SDK can be reported as *tampered* by the other SDK's verifier. This is a **false-negative that fails safe** (a genuine chain is flagged for investigation; a forged chain never passes), it is intermittent, and it predates this package. A proper fix is an RFC 8785-style number-canonicalization migration (a hash-semantics change, tracked for a future release). **Workaround today: verify a chain with the same-language verifier that produced it.**
+
+## Why a separate package
+So an auditor's install is minimal and its purpose is unambiguous — it's a *verifier*, not the PII middleware. The verification logic lives in `cloakllm` (reused here), so the two can never drift.
+
+MIT · part of [CloakLLM](https://cloakllm.dev)

cloakllm_verifier-0.12.0/README.md

@@ -0,0 +1,61 @@
+# cloakllm-verifier
+
+**Independently verify CloakLLM audit artifacts — without the PII-detection stack, and without trusting CloakLLM's code.**
+
+CloakLLM's whole pitch is *compliance you can verify, not compliance you're asked to believe.* This is the tool that makes that literal: an auditor, regulator, or CI pipeline installs `cloakllm-verifier` and checks the artifacts themselves.
+
+It **reuses CloakLLM's own verification code** (single source of truth — no reimplementation, no drift) but pulls **only the cryptography extras** — no spaCy, no NLP models. A lean install for people who need to *check*, not *produce*.
+
+```bash
+pip install cloakllm-verifier      # Python; crypto deps only, no spaCy
+npm install cloakllm-verifier      # JavaScript; zero deps beyond cloakllm (see js/README.md)
+```
+
+This repo ships **two packages** from one source of truth: the Python package at the root and the JavaScript package under [`js/`](js/). Both expose the same CLI (`cloakllm-verify`) and the same checks, with byte-comparable `--json` output.
+
+## CLI
+
+```bash
+cloakllm-verify audit      ./cloakllm_audit                 # hash-chain integrity
+cloakllm-verify timestamp  ./cloakllm_audit                 # offline RFC 3161 checkpoint tokens
+cloakllm-verify keys       cert.json --manifest m.json      # KeyManifest provenance + revocation
+cloakllm-verify report     report.json ./cloakllm_audit     # re-validate a compliance report
+cloakllm-verify all        ./cloakllm_audit                 # everything, one exit code
+cloakllm-verify audit ./cloakllm_audit --json               # machine-readable (CI)
+```
+
+Exit code `0` = verified, `1` = failed/invalid. Output is ASCII-only.
+
+## Python API
+
+```python
+from cloakllm_verifier import verify_audit, verify_timestamps, verify_all
+
+r = verify_all("./cloakllm_audit")
+assert r["ok"], r          # {ok, audit: {...}, timestamps: {...}}
+```
+
+## What it checks
+- **Hash-chain integrity** — recomputes every SHA-256 link from the canonical JSON; any tampered, reordered, deleted, or relinked entry fails.
+- **RFC 3161 trusted timestamps** — offline-verifies every `chain_checkpoint` token (proving the chain existed no later than the TSA's time); reports the earliest provable time.
+- **KeyManifest provenance + revocation** — verifies a signed certificate against its published KeyManifest (signature, key-id binding, validity window, manifest-hash integrity, offline-root signature when claimed) and checks it against a root-signed RevocationList.
+- **Compliance-report re-validation** — independently re-verifies the audit chain a report describes and rejects any report that claims a *verified* chain or a *COMPLIANT* verdict over a log that does not actually verify. It does not trust the report's own claims.
+
+## What a passing result does — and does NOT — prove
+
+Be precise about the guarantees (an auditor needs to know the edges):
+
+- **`audit` proves integrity + internal consistency of the entries present** — every SHA-256 link recomputes and chains cleanly. It does **not** prove:
+  - **Completeness.** A hash chain is anchored at its genesis, not its head, so removing entries from the **end** (tail truncation) leaves a still-valid prefix. Detecting truncation needs an external head anchor — an **RFC 3161 checkpoint over the final `entry_hash`** (`timestamp`), which binds "the chain was at least this long at time T".
+  - **Authenticity.** The chain is a keyless SHA-256 construction: anyone who can write the log can recompute a self-consistent one. Authenticity comes from the **Ed25519 attestation** (`keys`) — a signed certificate whose key provenance you verify against a published KeyManifest.
+- **`keys` without `--manifest`** only checks the certificate's signature against the key embedded in the certificate — it does **not** establish who owns that key. Pass `--manifest` for real provenance; the CLI marks signature-only results `UNVERIFIED`, not "verified".
+- **`report`** re-verifies the chain and checks the report's claims for internal consistency against it; it is not a cryptographic binding of that exact report to that exact log beyond an entry-count sanity check.
+
+### Known limitation: cross-SDK whole-number floats
+
+A hashed floating-point field that happens to be a whole number (e.g. a timing metric of exactly `0.0` or `5.0`) serializes as `5.0` in Python but `5` in JavaScript, so a chain written by one SDK can be reported as *tampered* by the other SDK's verifier. This is a **false-negative that fails safe** (a genuine chain is flagged for investigation; a forged chain never passes), it is intermittent, and it predates this package. A proper fix is an RFC 8785-style number-canonicalization migration (a hash-semantics change, tracked for a future release). **Workaround today: verify a chain with the same-language verifier that produced it.**
+
+## Why a separate package
+So an auditor's install is minimal and its purpose is unambiguous — it's a *verifier*, not the PII middleware. The verification logic lives in `cloakllm` (reused here), so the two can never drift.
+
+MIT · part of [CloakLLM](https://cloakllm.dev)

cloakllm_verifier-0.12.0/cloakllm_verifier/__init__.py

@@ -0,0 +1,14 @@
+"""cloakllm-verifier — standalone, dependency-light verification of CloakLLM
+audit artifacts. Reuses CloakLLM's own verify code (no drift), pulls only the
+crypto extras (no spaCy / detection). For auditors and CI.
+
+    from cloakllm_verifier import verify_audit, verify_timestamps, verify_all
+    result = verify_all("./cloakllm_audit")   # {ok: bool, audit: {...}, timestamps: {...}}
+"""
+__version__ = "0.12.0"
+
+from cloakllm_verifier.verify import (
+    verify_audit, verify_timestamps, verify_keys, verify_report, verify_all)
+
+__all__ = ["verify_audit", "verify_timestamps", "verify_keys", "verify_report",
+           "verify_all", "__version__"]

cloakllm_verifier-0.12.0/cloakllm_verifier/cli.py

@@ -0,0 +1,138 @@
+"""`cloakllm-verify` -- auditor-facing CLI. ASCII-only output; exit 0 = verified,
+1 = failed/invalid. Add --json for machine-readable output (CI / auditor tools)."""
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+
+from cloakllm_verifier import __version__
+from cloakllm_verifier.verify import (
+    verify_audit, verify_timestamps, verify_keys, verify_report, verify_all)
+
+
+def _emit(result: dict, as_json: bool, lines) -> int:
+    if as_json:
+        print(json.dumps(result, indent=2, sort_keys=True))
+    else:
+        for ln in lines:
+            print(ln)
+    return 0 if result.get("ok") else 1
+
+
+def main(argv=None) -> int:
+    p = argparse.ArgumentParser(
+        prog="cloakllm-verify",
+        description="Independently verify CloakLLM audit artifacts (hash chain + RFC 3161 "
+                    "timestamps) without the full SDK or trusting CloakLLM's code.")
+    p.add_argument("--version", action="version", version=f"cloakllm-verify {__version__}")
+    sub = p.add_subparsers(dest="cmd")
+
+    pa = sub.add_parser("audit", help="Verify hash-chain integrity of an audit directory")
+    pa.add_argument("log_dir")
+    pa.add_argument("--json", action="store_true")
+
+    pt = sub.add_parser("timestamp", help="Offline-verify RFC 3161 checkpoint tokens in an audit dir")
+    pt.add_argument("log_dir")
+    pt.add_argument("--tsa-cert", help="PEM of trusted TSA cert(s) to also check the signer chain")
+    pt.add_argument("--json", action="store_true")
+
+    pk = sub.add_parser("keys", help="Verify a certificate's KeyManifest provenance + revocation")
+    pk.add_argument("cert", help="Path to a signed SanitizationCertificate JSON")
+    pk.add_argument("--manifest", help="Path to the KeyManifest JSON (omit for signature-only)")
+    pk.add_argument("--root-key", help="Path to the offline root public key (raw 32B or base64)")
+    pk.add_argument("--revocation-list", help="Path to a signed RevocationList JSON")
+    pk.add_argument("--json", action="store_true")
+
+    pr = sub.add_parser("report", help="Re-validate a compliance report against its audit dir")
+    pr.add_argument("report", help="Path to a compliance-report JSON")
+    pr.add_argument("log_dir", help="The audit directory the report describes")
+    pr.add_argument("--json", action="store_true")
+
+    pall = sub.add_parser("all", help="Run every available check over an audit dir")
+    pall.add_argument("log_dir")
+    pall.add_argument("--tsa-cert")
+    pall.add_argument("--json", action="store_true")
+
+    args = p.parse_args(argv)
+    if not args.cmd:
+        p.print_help()
+        return 2
+
+    if args.cmd == "audit":
+        r = verify_audit(args.log_dir)
+        lines = [f"CloakLLM verify -- hash chain ({args.log_dir})",
+                 f"  entries:   {r['entries']}",
+                 f"  final seq: {r['final_seq']}",
+                 "  [OK] chain intact: the present entries are internally consistent."
+                 if r["ok"]
+                 else "  [FAIL] chain invalid:\n    " + "\n    ".join(r["errors"] or ["unknown"])]
+        if r["ok"]:
+            lines.append("  note: proves integrity of the entries present, NOT completeness "
+                         "(a hash chain cannot detect removal of the LAST entries) or "
+                         "authenticity (run `keys` for signatures; `timestamp` for an "
+                         "existence anchor).")
+        return _emit(r, args.json, lines)
+
+    if args.cmd == "timestamp":
+        r = verify_timestamps(args.log_dir, args.tsa_cert)
+        lines = [f"CloakLLM verify -- RFC 3161 checkpoints ({args.log_dir})",
+                 f"  found:    {r['found']}",
+                 f"  verified: {r['verified']}",
+                 f"  earliest provable time: {r.get('earliest_provable_time')}",
+                 "  [OK] all checkpoints verified." if r["ok"]
+                 else f"  [FAIL] {r.get('reason', 'not all checkpoints verified')}"]
+        return _emit(r, args.json, lines)
+
+    if args.cmd == "keys":
+        r = verify_keys(args.cert, args.manifest, args.root_key, args.revocation_list)
+        c = r["checks"]
+        lines = [f"CloakLLM verify -- key provenance ({args.cert})",
+                 f"  provenance: {r['provenance_status']}",
+                 f"  revocation: {r['revocation_status']}",
+                 f"  signature:  {c['signature_valid']}",
+                 f"  key id:     {c['key_id_matches']}",
+                 f"  validity:   {c['within_validity_window']}",
+                 f"  root sig:   {c['root_signature_status']}",
+                 f"  manifest:   {c['manifest_hash_consistent']}"]
+        # F8: signature-only mode (no manifest) validates the cert's signature
+        # against the key embedded IN the cert -- it does NOT prove which deployer
+        # owns the key. Do not print "verified" for it.
+        if r["ok"] and r["provenance_status"] == "VERIFIED":
+            lines.append("  [OK] key provenance verified (signature + manifest binding).")
+        elif r["ok"] and r["provenance_status"] == "UNVERIFIED":
+            lines.append("  [WARN] signature valid, but provenance UNVERIFIED -- no manifest "
+                         "supplied, so the key's owner/validity is not established. "
+                         "Pass --manifest to verify provenance.")
+        else:
+            lines.append("  [FAIL] provenance invalid:\n    " + "\n    ".join(r["notes"] or ["see status"]))
+        return _emit(r, args.json, lines)
+
+    if args.cmd == "report":
+        r = verify_report(args.report, args.log_dir)
+        lines = [f"CloakLLM verify -- compliance report ({args.report})",
+                 f"  report verdict:    {r['report_verdict']}",
+                 f"  actual chain valid: {r['actual_chain_valid']}",
+                 "  [OK] report claims match the audit log." if r["ok"]
+                 else "  [FAIL] report does NOT match the audit log:\n    "
+                      + "\n    ".join(r["mismatches"] or ["chain does not verify"])]
+        return _emit(r, args.json, lines)
+
+    if args.cmd == "all":
+        r = verify_all(args.log_dir, args.tsa_cert)
+        a, t = r["audit"], r["timestamps"]
+        lines = [f"CloakLLM verify -- full ({args.log_dir})",
+                 f"  hash chain:  {'OK' if a['ok'] else 'FAIL'} ({a['entries']} entries)",
+                 f"  timestamps:  " + (
+                     f"{'OK' if t['ok'] else 'FAIL'} ({t['verified']}/{t['found']} verified, "
+                     f"earliest {t.get('earliest_provable_time')})"
+                     if r["timestamps_applicable"] else "n/a (no checkpoints)"),
+                 "  [OK] verified." if r["ok"] else "  [FAIL] verification failed."]
+        return _emit(r, args.json, lines)
+
+    p.print_help()
+    return 2
+
+
+if __name__ == "__main__":
+    sys.exit(main())

cloakllm_verifier-0.12.0/cloakllm_verifier/verify.py

@@ -0,0 +1,286 @@
+"""Standalone verification of CloakLLM audit artifacts.
+
+Every check here REUSES CloakLLM's own verify code (single source of truth, no
+drift): the hash-chain walk from `cloakllm.audit.AuditLogger.verify_chain`, the
+RFC 3161 offline verifier from `cloakllm.timestamping.verify_timestamp_token`.
+None of it imports the PII-detection stack (spaCy) -- that is the whole point:
+an auditor verifies without installing, or trusting, the detector.
+
+Each function returns a plain dict {ok, ...} so callers (CLI / CI / other tools)
+never depend on CloakLLM internals.
+"""
+from __future__ import annotations
+
+import json
+import re
+from pathlib import Path
+from typing import Optional
+
+
+def _read_chain_entries(d: Path):
+    """Read the audit_*.jsonl entries verify_chain covers, as parsed dicts.
+    Raises on undecodable bytes so callers can turn it into a clean failure."""
+    entries = []
+    for jf in sorted(d.glob("audit_*.jsonl")):
+        # utf-8 strict: a verifier must not silently lossy-decode an audit log.
+        for line in jf.read_text(encoding="utf-8").splitlines():
+            line = line.strip()
+            if not line:
+                continue
+            entries.append(json.loads(line))
+    return entries
+
+
+def verify_audit(log_dir: str) -> dict:
+    """Verify hash-chain integrity of an audit directory.
+
+    Returns {ok, valid, final_seq, errors, entries}. `ok` is True iff the chain
+    verifies AND contains at least one entry. Recomputes every SHA-256 link from
+    the canonical JSON -- a tampered, reordered, or relinked entry fails.
+
+    IMPORTANT (what this does and does NOT prove): a passing result means the
+    present entries are internally consistent and unbroken. It is NOT proof of
+    completeness -- a hash chain cannot detect that entries were removed from the
+    END (tail truncation), because the remaining prefix still links cleanly. Nor
+    is it proof of authenticity -- the chain is a keyless SHA-256 construction, so
+    a party who can write the log can also recompute a self-consistent forgery.
+    Completeness needs an external anchor (an RFC 3161 checkpoint over the final
+    entry_hash); authenticity needs the Ed25519 attestation (`verify_keys`).
+    """
+    from cloakllm.audit import AuditLogger
+    from cloakllm.config import ShieldConfig
+
+    d = Path(log_dir)
+    if not d.exists():
+        return {"ok": False, "valid": False, "errors": [f"log dir not found: {log_dir}"],
+                "final_seq": -1, "entries": 0}
+
+    # F2: verify_chain only reads audit_*.jsonl and returns (True, [], 0) when
+    # none exist -- so an empty dir, a mistyped path, or a dir whose logs are
+    # named differently would otherwise read as "verified". Treat "nothing to
+    # verify" as a failure, and surface ignored .jsonl files.
+    audit_files = sorted(d.glob("audit_*.jsonl"))
+    all_jsonl = sorted(d.glob("*.jsonl"))
+    if not audit_files:
+        if all_jsonl:
+            ignored = ", ".join(p.name for p in all_jsonl)
+            msg = (f"no audit_*.jsonl files found in {log_dir}; the verifier only "
+                   f"reads audit_-prefixed logs. Ignored: {ignored}")
+        else:
+            msg = f"no audit log files (audit_*.jsonl) found in {log_dir}"
+        return {"ok": False, "valid": False, "errors": [msg], "final_seq": -1, "entries": 0}
+
+    # F7: undecodable / hostile bytes must become a clean failure, never a crash.
+    try:
+        parsed = _read_chain_entries(d)
+    except (UnicodeDecodeError, ValueError) as e:
+        return {"ok": False, "valid": False,
+                "errors": [f"audit log is not valid UTF-8 JSONL: {type(e).__name__}: {e}"],
+                "final_seq": -1, "entries": 0}
+
+    n_entries = len(parsed)
+    if n_entries == 0:
+        return {"ok": False, "valid": False,
+                "errors": [f"audit log files present but contain no entries: {log_dir}"],
+                "final_seq": -1, "entries": 0}
+
+    logger = AuditLogger(ShieldConfig(log_dir=str(d), audit_enabled=True))
+    try:
+        valid, errors, final_seq = logger.verify_chain()
+    except Exception as e:  # noqa: BLE001 - a verifier never raises out
+        return {"ok": False, "valid": False,
+                "errors": [f"chain verification raised {type(e).__name__}: {e}"],
+                "final_seq": -1, "entries": n_entries}
+    return {"ok": bool(valid) and n_entries > 0, "valid": bool(valid), "final_seq": final_seq,
+            "errors": list(errors), "entries": n_entries}
+
+
+def _iter_checkpoints(log_dir: Path):
+    for jf in sorted(log_dir.glob("*.jsonl")):
+        for line in jf.read_text(encoding="utf-8").splitlines():
+            line = line.strip()
+            if not line:
+                continue
+            try:
+                e = json.loads(line)
+            except (ValueError, TypeError):
+                continue
+            if e.get("event_type") == "chain_checkpoint":
+                yield e
+
+
+def verify_timestamps(log_dir: str, tsa_cert_path: Optional[str] = None) -> dict:
+    """Offline-verify every RFC 3161 chain_checkpoint token in an audit dir.
+
+    Returns {ok, found, verified, earliest_provable_time, checkpoints}. `ok` is
+    True iff at least one checkpoint exists AND all found checkpoints verify.
+    (No checkpoints -> ok False with reason, since there is nothing to prove.)
+    """
+    from cloakllm.timestamping import _ts_backend_available, verify_timestamp_token
+
+    d = Path(log_dir)
+    if not d.exists():
+        return {"ok": False, "found": 0, "verified": 0, "reason": f"log dir not found: {log_dir}",
+                "earliest_provable_time": None, "checkpoints": []}
+    if not _ts_backend_available():
+        return {"ok": False, "found": 0, "verified": 0,
+                "reason": "timestamping backend not installed (pip install cloakllm[timestamping])",
+                "earliest_provable_time": None, "checkpoints": []}
+
+    trusted = None
+    if tsa_cert_path:
+        pem = Path(tsa_cert_path).read_text(encoding="utf-8")
+        trusted = re.findall(
+            r"-----BEGIN CERTIFICATE-----.*?-----END CERTIFICATE-----", pem, re.DOTALL) or [pem]
+
+    # F5: a valid token only proves "SOME hash existed at time T". To credit it
+    # as anchoring THIS log, the stamped hash must actually be an entry_hash in
+    # the chain. Collect the chain's real hashes so we can bind each checkpoint.
+    try:
+        chain_hashes = {ev.get("entry_hash") for ev in _read_chain_entries(d)
+                        if isinstance(ev.get("entry_hash"), str)}
+    except (UnicodeDecodeError, ValueError):
+        chain_hashes = set()
+
+    found = verified = 0
+    earliest = None
+    checkpoints = []
+    for e in _iter_checkpoints(d):
+        cc = e.get("checkpoint_context") or {}
+        found += 1
+        stamped = cc.get("stamped_entry_hash", "")
+        # Bind to the chain FIRST -- a token over a hash that is in no entry is
+        # not evidence about this log, no matter how cryptographically valid.
+        bound = stamped in chain_hashes
+        try:
+            r = verify_timestamp_token(cc.get("tst_token_b64", ""), bytes.fromhex(stamped), trusted)
+        except Exception as ex:  # noqa: BLE001 - never raise out of a verifier
+            checkpoints.append({"seq": e.get("seq"), "valid": False, "bound_to_chain": bound,
+                                "reason": type(ex).__name__})
+            continue
+        ok_cp = bool(r.valid) and bound
+        reason = r.reason if r.valid else r.reason
+        if r.valid and not bound:
+            reason = "token valid but stamped_entry_hash is not an entry_hash in this chain"
+        checkpoints.append({"seq": e.get("seq"), "valid": ok_cp, "token_valid": bool(r.valid),
+                            "bound_to_chain": bound, "gen_time": r.gen_time,
+                            "chain_valid": r.chain_valid, "reason": reason})
+        if ok_cp:
+            verified += 1
+            if r.gen_time and (earliest is None or r.gen_time < earliest):
+                earliest = r.gen_time
+    return {"ok": found > 0 and verified == found, "found": found, "verified": verified,
+            "earliest_provable_time": earliest, "checkpoints": checkpoints}
+
+
+def _load_root_public_key(path: Optional[str]) -> Optional[bytes]:
+    """Load a 32-byte Ed25519 root public key from a file. Accepts raw 32 bytes
+    or a base64 text encoding (with surrounding whitespace)."""
+    if not path:
+        return None
+    raw = Path(path).read_bytes()
+    if len(raw) == 32:
+        return raw
+    import base64
+    return base64.b64decode(raw.decode("utf-8", "ignore").strip())
+
+
+def verify_keys(cert_path: str, manifest_path: Optional[str] = None,
+                root_public_key_path: Optional[str] = None,
+                revocation_list_path: Optional[str] = None) -> dict:
+    """Verify a signed SanitizationCertificate's provenance against a KeyManifest
+    (and optional root key + RevocationList), reusing `verify_key_provenance`.
+
+    Returns {ok, provenance_status, revocation_status, checks, notes}. `ok` is
+    the report's overall_valid (signature + key-id + validity window + manifest
+    hash + root signature when claimed + not-revoked). manifest=None -> signature
+    -only (UNVERIFIED). A revoked key or tampered revocation list makes ok False.
+    """
+    from cloakllm.attestation import (
+        SanitizationCertificate, KeyManifest, RevocationList, verify_key_provenance)
+
+    cert = SanitizationCertificate.from_dict(json.loads(Path(cert_path).read_text(encoding="utf-8")))
+    manifest = None
+    if manifest_path:
+        manifest = KeyManifest.from_dict(json.loads(Path(manifest_path).read_text(encoding="utf-8")))
+    rev = None
+    if revocation_list_path:
+        rev = RevocationList.from_dict(json.loads(Path(revocation_list_path).read_text(encoding="utf-8")))
+    root_pk = _load_root_public_key(root_public_key_path)
+
+    rep = verify_key_provenance(cert, manifest, root_public_key=root_pk, revocation_list=rev)
+    d = rep.to_dict()
+    return {
+        "ok": bool(d["overall_valid"]),
+        "provenance_status": d["provenance_status"],
+        "revocation_status": d["revocation_status"],
+        "checks": {k: d[k] for k in (
+            "signature_valid", "key_id_matches", "within_validity_window",
+            "root_signature_status", "manifest_hash_consistent")},
+        "notes": d["notes"],
+    }
+
+
+def verify_report(report_path: str, log_dir: str) -> dict:
+    """Independently re-validate a compliance report against the audit dir it
+    describes. Does NOT trust the report's own claims -- re-verifies the chain
+    from scratch and cross-checks.
+
+    The load-bearing guard (the v0.10.3 CRITICAL-1 class): a report that claims
+    `chain_integrity.verdict == "verified"` or a `COMPLIANT` verdict CANNOT stand
+    over an audit log that does not actually verify. Any mismatch -> ok False.
+
+    Binding scope (be honest about it): this re-verifies the chain and checks the
+    report's claims for INTERNAL CONSISTENCY against it. It does not cryptographic-
+    ally bind the report to this specific log beyond the entry-count sanity check
+    (a scoped report legitimately covers fewer entries; it can never honestly cover
+    more). A report is only as trustworthy as the log you verify it against.
+
+    Returns {ok, report_verdict, actual_chain_valid, mismatches, ...}.
+    """
+    report = json.loads(Path(report_path).read_text(encoding="utf-8"))
+    audit = verify_audit(log_dir)
+    actual_valid = audit["ok"]
+    ci = report.get("chain_integrity") or {}
+    claimed_verified = ci.get("verdict") == "verified"
+    claimed_entries = ci.get("total_entries")
+    report_verdict = report.get("verdict")
+
+    mismatches: list[str] = []
+    # 1. The report cannot claim a verified chain the log doesn't actually verify.
+    if claimed_verified and not actual_valid:
+        mismatches.append(
+            "report claims chain_integrity=verified but the audit log does NOT verify")
+    # 2. A COMPLIANT verdict over a broken chain is the exact CRITICAL-1 failure.
+    if report_verdict == "COMPLIANT" and not actual_valid:
+        mismatches.append("report verdict is COMPLIANT but the audit chain is broken")
+    # 3. Entry-count check is ONE-DIRECTIONAL: reports are routinely period- or
+    #    article-scoped (build_report filters), so a report legitimately covers
+    #    FEWER entries than the chain holds. It can never honestly cover MORE --
+    #    an inflated count means the report describes entries the log can't back.
+    #    A present-but-non-integer total_entries is itself malformed -> reject
+    #    (F4: do NOT silently skip the one cross-check because the type is wrong).
+    if isinstance(claimed_entries, bool) or not isinstance(claimed_entries, int):
+        if claimed_entries is not None:
+            mismatches.append(
+                f"report chain_integrity.total_entries is not an integer "
+                f"({type(claimed_entries).__name__}): {claimed_entries!r}")
+    elif claimed_entries > audit["entries"]:
+        mismatches.append(
+            f"report total_entries={claimed_entries} exceeds the {audit['entries']} "
+            f"entries actually in the audit log")
+
+    return {"ok": not mismatches and actual_valid, "report_verdict": report_verdict,
+            "actual_chain_valid": actual_valid, "claimed_chain_verified": claimed_verified,
+            "mismatches": mismatches, "audit": audit}
+
+
+def verify_all(log_dir: str, tsa_cert_path: Optional[str] = None) -> dict:
+    """Run every available check over an audit dir. Timestamps are only required
+    if the chain actually contains checkpoints (an un-timestamped but intact
+    chain is still 'ok' for integrity)."""
+    audit = verify_audit(log_dir)
+    ts = verify_timestamps(log_dir, tsa_cert_path)
+    ts_applicable = ts["found"] > 0
+    ok = audit["ok"] and (ts["ok"] if ts_applicable else True)
+    return {"ok": ok, "audit": audit, "timestamps": ts, "timestamps_applicable": ts_applicable}

cloakllm_verifier-0.12.0/cloakllm_verifier.egg-info/PKG-INFO

@@ -0,0 +1,82 @@
+Metadata-Version: 2.4
+Name: cloakllm-verifier
+Version: 0.12.0
+Summary: Standalone, dependency-light verifier for CloakLLM audit artifacts -- verify hash chains, Ed25519 signatures, key provenance, RFC 3161 timestamps, and compliance reports WITHOUT the full SDK or trusting CloakLLM's code.
+Author-email: The CloakLLM Authors <cloakllm@gmail.com>
+License: MIT
+Project-URL: Homepage, https://cloakllm.dev
+Project-URL: Repository, https://github.com/cloakllm/cloakllm-verifier
+Keywords: audit,verification,eu-ai-act,compliance,attestation,rfc3161,hash-chain
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security :: Cryptography
+Classifier: Intended Audience :: Legal Industry
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: cloakllm[attestation,timestamping]<0.13.0,>=0.12.0
+Provides-Extra: dev
+Requires-Dist: pytest>=7.0; extra == "dev"
+Dynamic: license-file
+
+# cloakllm-verifier
+
+**Independently verify CloakLLM audit artifacts — without the PII-detection stack, and without trusting CloakLLM's code.**
+
+CloakLLM's whole pitch is *compliance you can verify, not compliance you're asked to believe.* This is the tool that makes that literal: an auditor, regulator, or CI pipeline installs `cloakllm-verifier` and checks the artifacts themselves.
+
+It **reuses CloakLLM's own verification code** (single source of truth — no reimplementation, no drift) but pulls **only the cryptography extras** — no spaCy, no NLP models. A lean install for people who need to *check*, not *produce*.
+
+```bash
+pip install cloakllm-verifier      # Python; crypto deps only, no spaCy
+npm install cloakllm-verifier      # JavaScript; zero deps beyond cloakllm (see js/README.md)
+```
+
+This repo ships **two packages** from one source of truth: the Python package at the root and the JavaScript package under [`js/`](js/). Both expose the same CLI (`cloakllm-verify`) and the same checks, with byte-comparable `--json` output.
+
+## CLI
+
+```bash
+cloakllm-verify audit      ./cloakllm_audit                 # hash-chain integrity
+cloakllm-verify timestamp  ./cloakllm_audit                 # offline RFC 3161 checkpoint tokens
+cloakllm-verify keys       cert.json --manifest m.json      # KeyManifest provenance + revocation
+cloakllm-verify report     report.json ./cloakllm_audit     # re-validate a compliance report
+cloakllm-verify all        ./cloakllm_audit                 # everything, one exit code
+cloakllm-verify audit ./cloakllm_audit --json               # machine-readable (CI)
+```
+
+Exit code `0` = verified, `1` = failed/invalid. Output is ASCII-only.
+
+## Python API
+
+```python
+from cloakllm_verifier import verify_audit, verify_timestamps, verify_all
+
+r = verify_all("./cloakllm_audit")
+assert r["ok"], r          # {ok, audit: {...}, timestamps: {...}}
+```
+
+## What it checks
+- **Hash-chain integrity** — recomputes every SHA-256 link from the canonical JSON; any tampered, reordered, deleted, or relinked entry fails.
+- **RFC 3161 trusted timestamps** — offline-verifies every `chain_checkpoint` token (proving the chain existed no later than the TSA's time); reports the earliest provable time.
+- **KeyManifest provenance + revocation** — verifies a signed certificate against its published KeyManifest (signature, key-id binding, validity window, manifest-hash integrity, offline-root signature when claimed) and checks it against a root-signed RevocationList.
+- **Compliance-report re-validation** — independently re-verifies the audit chain a report describes and rejects any report that claims a *verified* chain or a *COMPLIANT* verdict over a log that does not actually verify. It does not trust the report's own claims.
+
+## What a passing result does — and does NOT — prove
+
+Be precise about the guarantees (an auditor needs to know the edges):
+
+- **`audit` proves integrity + internal consistency of the entries present** — every SHA-256 link recomputes and chains cleanly. It does **not** prove:
+  - **Completeness.** A hash chain is anchored at its genesis, not its head, so removing entries from the **end** (tail truncation) leaves a still-valid prefix. Detecting truncation needs an external head anchor — an **RFC 3161 checkpoint over the final `entry_hash`** (`timestamp`), which binds "the chain was at least this long at time T".
+  - **Authenticity.** The chain is a keyless SHA-256 construction: anyone who can write the log can recompute a self-consistent one. Authenticity comes from the **Ed25519 attestation** (`keys`) — a signed certificate whose key provenance you verify against a published KeyManifest.
+- **`keys` without `--manifest`** only checks the certificate's signature against the key embedded in the certificate — it does **not** establish who owns that key. Pass `--manifest` for real provenance; the CLI marks signature-only results `UNVERIFIED`, not "verified".
+- **`report`** re-verifies the chain and checks the report's claims for internal consistency against it; it is not a cryptographic binding of that exact report to that exact log beyond an entry-count sanity check.
+
+### Known limitation: cross-SDK whole-number floats
+
+A hashed floating-point field that happens to be a whole number (e.g. a timing metric of exactly `0.0` or `5.0`) serializes as `5.0` in Python but `5` in JavaScript, so a chain written by one SDK can be reported as *tampered* by the other SDK's verifier. This is a **false-negative that fails safe** (a genuine chain is flagged for investigation; a forged chain never passes), it is intermittent, and it predates this package. A proper fix is an RFC 8785-style number-canonicalization migration (a hash-semantics change, tracked for a future release). **Workaround today: verify a chain with the same-language verifier that produced it.**
+
+## Why a separate package
+So an auditor's install is minimal and its purpose is unambiguous — it's a *verifier*, not the PII middleware. The verification logic lives in `cloakllm` (reused here), so the two can never drift.
+
+MIT · part of [CloakLLM](https://cloakllm.dev)

cloakllm_verifier-0.12.0/cloakllm_verifier.egg-info/SOURCES.txt

@@ -0,0 +1,13 @@
+LICENSE
+README.md
+pyproject.toml
+cloakllm_verifier/__init__.py
+cloakllm_verifier/cli.py
+cloakllm_verifier/verify.py
+cloakllm_verifier.egg-info/PKG-INFO
+cloakllm_verifier.egg-info/SOURCES.txt
+cloakllm_verifier.egg-info/dependency_links.txt
+cloakllm_verifier.egg-info/entry_points.txt
+cloakllm_verifier.egg-info/requires.txt
+cloakllm_verifier.egg-info/top_level.txt
+tests/test_verifier.py

cloakllm_verifier-0.12.0/cloakllm_verifier.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

cloakllm_verifier-0.12.0/cloakllm_verifier.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+cloakllm-verify = cloakllm_verifier.cli:main

cloakllm_verifier-0.12.0/cloakllm_verifier.egg-info/requires.txt

@@ -0,0 +1,4 @@
+cloakllm[attestation,timestamping]<0.13.0,>=0.12.0
+
+[dev]
+pytest>=7.0

cloakllm_verifier-0.12.0/cloakllm_verifier.egg-info/top_level.txt

@@ -0,0 +1 @@
+cloakllm_verifier

cloakllm_verifier-0.12.0/pyproject.toml

@@ -0,0 +1,38 @@
+[build-system]
+requires = ["setuptools>=68.0", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "cloakllm-verifier"
+version = "0.12.0"
+description = "Standalone, dependency-light verifier for CloakLLM audit artifacts -- verify hash chains, Ed25519 signatures, key provenance, RFC 3161 timestamps, and compliance reports WITHOUT the full SDK or trusting CloakLLM's code."
+readme = "README.md"
+requires-python = ">=3.10"
+license = {text = "MIT"}
+authors = [{name = "The CloakLLM Authors", email = "cloakllm@gmail.com"}]
+keywords = ["audit", "verification", "eu-ai-act", "compliance", "attestation", "rfc3161", "hash-chain"]
+classifiers = [
+    "License :: OSI Approved :: MIT License",
+    "Programming Language :: Python :: 3",
+    "Topic :: Security :: Cryptography",
+    "Intended Audience :: Legal Industry",
+]
+# Reuses CloakLLM's OWN verify code (single source of truth, no drift) but pulls
+# only the crypto extras -- NO spaCy / detection. An auditor installs this to
+# check artifacts; it never needs the PII-detection stack.
+dependencies = [
+    "cloakllm[attestation,timestamping]>=0.12.0,<0.13.0",
+]
+
+[project.optional-dependencies]
+dev = ["pytest>=7.0"]
+
+[project.scripts]
+cloakllm-verify = "cloakllm_verifier.cli:main"
+
+[project.urls]
+Homepage = "https://cloakllm.dev"
+Repository = "https://github.com/cloakllm/cloakllm-verifier"
+
+[tool.setuptools]
+packages = ["cloakllm_verifier"]

cloakllm_verifier-0.12.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

cloakllm_verifier-0.12.0/tests/test_verifier.py

@@ -0,0 +1,330 @@
+"""Adversarial tests for cloakllm-verifier.
+
+The property that matters for a verifier is NOT "passes on clean input" — it's
+"FAILS on tampered / reordered / relinked / deleted input." These tests attack
+a real audit chain every way and assert the verifier rejects each, plus the
+verify-don't-assert guard (verify_all must be False if any required sub-check
+fails) and graceful handling of missing/empty inputs.
+"""
+from __future__ import annotations
+
+import json
+import os
+import warnings
+from pathlib import Path
+
+import pytest
+
+from cloakllm import Shield, ShieldConfig
+from cloakllm_verifier import (
+    verify_audit, verify_timestamps, verify_keys, verify_report, verify_all)
+
+_FIX = json.loads(
+    (Path(__file__).resolve().parent / "fixtures" / "timestamp_token.json")
+    .read_text(encoding="utf-8"))
+
+
+def _make_chain(tmp_path, n=4) -> str:
+    adir = str(tmp_path / "audit")
+    cwd = os.getcwd()
+    os.chdir(tmp_path)
+    try:
+        with warnings.catch_warnings():
+            warnings.simplefilter("ignore")
+            sh = Shield(ShieldConfig(audit_enabled=True, log_dir=adir))
+            for i in range(n):
+                sh.sanitize(f"msg {i}: email user{i}@example.com ssn 123-45-6789")
+    finally:
+        os.chdir(cwd)
+    return adir
+
+
+def _jsonl(adir):
+    return sorted(Path(adir).glob("*.jsonl"))[0]
+
+
+def _lines(adir):
+    return _jsonl(adir).read_text(encoding="utf-8").splitlines()
+
+
+def _write(adir, lines):
+    _jsonl(adir).write_text("\n".join(lines) + "\n", encoding="utf-8")
+
+
+# --- the chain must VERIFY when intact, and FAIL under every attack ---
+
+def test_intact_chain_verifies(tmp_path):
+    r = verify_audit(_make_chain(tmp_path))
+    assert r["ok"] and r["valid"] and r["entries"] == 4
+
+
+def test_mutated_field_is_rejected(tmp_path):
+    adir = _make_chain(tmp_path)
+    lines = _lines(adir)
+    e = json.loads(lines[1]); e["entity_count"] = 9999
+    lines[1] = json.dumps(e)
+    _write(adir, lines)
+    r = verify_audit(adir)
+    assert not r["ok"] and r["errors"]
+
+
+def test_deleted_entry_is_rejected(tmp_path):
+    adir = _make_chain(tmp_path)
+    lines = _lines(adir)
+    del lines[2]
+    _write(adir, lines)
+    assert not verify_audit(adir)["ok"]
+
+
+def test_reordered_entries_are_rejected(tmp_path):
+    adir = _make_chain(tmp_path)
+    lines = _lines(adir)
+    lines[1], lines[2] = lines[2], lines[1]
+    _write(adir, lines)
+    assert not verify_audit(adir)["ok"]
+
+
+def test_relinked_prev_hash_is_rejected(tmp_path):
+    adir = _make_chain(tmp_path)
+    lines = _lines(adir)
+    e = json.loads(lines[2]); e["prev_hash"] = "0" * 64
+    lines[2] = json.dumps(e)
+    _write(adir, lines)
+    assert not verify_audit(adir)["ok"]
+
+
+# --- graceful handling of degenerate inputs (never raise) ---
+
+def test_missing_dir_is_not_ok_and_does_not_raise(tmp_path):
+    r = verify_audit(str(tmp_path / "nope"))
+    assert not r["ok"] and r["errors"]
+
+
+def test_empty_dir_does_not_raise(tmp_path):
+    (tmp_path / "empty").mkdir()
+    r = verify_audit(str(tmp_path / "empty"))
+    assert r["ok"] in (True, False)  # whatever the policy, no exception escaped
+
+
+# --- RFC 3161 checkpoint verification (fixture-driven, offline) ---
+
+def _checkpoint_line(seq, token_b64, digest_hex):
+    return json.dumps({
+        "seq": seq, "event_type": "chain_checkpoint", "entry_hash": "x",
+        "checkpoint_context": {"stamped_entry_hash": digest_hex, "tst_token_b64": token_b64,
+                               "tsa_url": "https://freetsa.org/tsr", "hash_algorithm": "sha256",
+                               "stamped_seq": 0},
+    })
+
+
+def _entry_line(seq, entry_hash):
+    # a minimal line carrying an entry_hash, so F5 chain-binding can find it
+    return json.dumps({"seq": seq, "entry_hash": entry_hash, "event_type": "sanitize"})
+
+
+def _skip_if_no_ts(r):
+    if r.get("reason", "").startswith("timestamping backend"):
+        pytest.skip("timestamping backend not installed")
+
+
+def test_valid_checkpoint_bound_to_chain_verifies(tmp_path):
+    # F5: the token is valid AND the stamped hash is a real entry_hash in the log.
+    adir = tmp_path / "ts"; adir.mkdir()
+    (adir / "audit_x.jsonl").write_text(
+        _entry_line(0, _FIX["stamped_entry_hash"]) + "\n"
+        + _checkpoint_line(1, _FIX["tst_token_b64"], _FIX["stamped_entry_hash"]) + "\n",
+        encoding="utf-8")
+    r = verify_timestamps(str(adir))
+    _skip_if_no_ts(r)
+    assert r["ok"] and r["found"] == 1 and r["verified"] == 1
+
+
+def test_valid_token_unbound_to_chain_is_rejected(tmp_path):
+    # F5 core: a cryptographically VALID token whose stamped hash matches NO entry
+    # in the log proves nothing about this log -- must not verify.
+    adir = tmp_path / "unbound"; adir.mkdir()
+    (adir / "audit_x.jsonl").write_text(
+        _entry_line(0, "a" * 64) + "\n"  # some other entry hash
+        + _checkpoint_line(1, _FIX["tst_token_b64"], _FIX["stamped_entry_hash"]) + "\n",
+        encoding="utf-8")
+    r = verify_timestamps(str(adir))
+    _skip_if_no_ts(r)
+    assert not r["ok"] and r["verified"] == 0
+    assert r["checkpoints"][0]["token_valid"] and not r["checkpoints"][0]["bound_to_chain"]
+    assert r["earliest_provable_time"] is None  # must NOT credit an unbound time
+
+
+def test_tampered_checkpoint_token_is_rejected(tmp_path):
+    import base64
+    raw = bytearray(base64.b64decode(_FIX["tst_token_b64"])); raw[-5] ^= 0xFF
+    bad = base64.b64encode(bytes(raw)).decode()
+    adir = tmp_path / "ts2"; adir.mkdir()
+    (adir / "audit_x.jsonl").write_text(
+        _entry_line(0, _FIX["stamped_entry_hash"]) + "\n"
+        + _checkpoint_line(1, bad, _FIX["stamped_entry_hash"]) + "\n", encoding="utf-8")
+    r = verify_timestamps(str(adir))
+    _skip_if_no_ts(r)
+    assert not r["ok"] and r["verified"] == 0
+
+
+def test_no_checkpoints_is_not_ok(tmp_path):
+    adir = _make_chain(tmp_path)  # a real chain, but no chain_checkpoint events
+    r = verify_timestamps(adir)
+    assert not r["ok"] and r["found"] == 0  # nothing to prove
+
+
+# --- F2: empty / mis-named / entry-less dirs must NOT read as "verified" ---
+
+def test_empty_dir_is_not_verified(tmp_path):
+    (tmp_path / "empty").mkdir()
+    r = verify_audit(str(tmp_path / "empty"))
+    assert not r["ok"] and r["entries"] == 0 and r["errors"]
+
+
+def test_non_audit_prefixed_files_are_not_silently_passed(tmp_path):
+    # a dir whose only log is NOT audit_*.jsonl (and is garbage) must fail, not
+    # be green-lit because verify_chain ignored the file it was pointed at.
+    d = tmp_path / "misnamed"; d.mkdir()
+    (d / "chain.jsonl").write_text('{"prev_hash":"junk","seq":0}\n', encoding="utf-8")
+    r = verify_audit(str(d))
+    assert not r["ok"] and any("audit_" in e for e in r["errors"])
+
+
+# --- F7: hostile bytes -> clean failure, never a crash ---
+
+def test_binary_garbage_does_not_crash(tmp_path):
+    d = tmp_path / "bin"; d.mkdir()
+    (d / "audit_x.jsonl").write_bytes(bytes(range(256)) * 8)
+    r = verify_audit(str(d))  # must not raise
+    assert not r["ok"] and r["errors"]
+
+
+def test_invalid_utf8_does_not_crash(tmp_path):
+    d = tmp_path / "u8"; d.mkdir()
+    (d / "audit_x.jsonl").write_bytes(b"\xff\xfe\x00 not utf8\n")
+    r = verify_audit(str(d))
+    assert not r["ok"] and r["errors"]
+
+
+# --- F4: verify_report rejects a malformed (non-int) total_entries ---
+
+def test_report_non_integer_total_entries_is_rejected(tmp_path):
+    adir = _make_chain(tmp_path)
+    rp = tmp_path / "r.json"
+    rp.write_text(json.dumps({"verdict": "COMPLIANT",
+                              "chain_integrity": {"verdict": "verified", "total_entries": "4"}}),
+                  encoding="utf-8")
+    r = verify_report(str(rp), adir)
+    assert not r["ok"] and any("not an integer" in m for m in r["mismatches"])
+
+
+# --- KeyManifest provenance verify (verify_keys) ---
+
+def _cert_and_manifest(tmp_path, deployer="acme"):
+    from cloakllm.attestation import DeploymentKeyPair, derive_key_manifest, SanitizationCertificate
+    kp = DeploymentKeyPair.generate()
+    manifest = derive_key_manifest(kp, deployer_id=deployer,
+                                   valid_from="2026-01-01T00:00:00+00:00",
+                                   valid_until="2027-01-01T00:00:00+00:00")
+    cert = SanitizationCertificate.create(
+        original_text="x", sanitized_text="y", entity_count=0, categories={},
+        detection_passes=["regex"], mode="tokenize", keypair=kp)
+    cp = tmp_path / "cert.json"; cp.write_text(json.dumps(cert.to_dict()), encoding="utf-8")
+    mp = tmp_path / "manifest.json"; mp.write_text(json.dumps(manifest.to_dict()), encoding="utf-8")
+    return kp, str(cp), str(mp)
+
+
+def test_valid_provenance_verifies(tmp_path):
+    _, cp, mp = _cert_and_manifest(tmp_path)
+    r = verify_keys(cp, mp)
+    assert r["ok"] and r["provenance_status"] == "VERIFIED"
+
+
+def test_tampered_manifest_key_id_is_rejected(tmp_path):
+    _, cp, mp = _cert_and_manifest(tmp_path)
+    m = json.loads(Path(mp).read_text(encoding="utf-8")); m["key_id"] = "bogus"
+    Path(mp).write_text(json.dumps(m), encoding="utf-8")
+    r = verify_keys(cp, mp)
+    assert not r["ok"]  # key_id mismatch AND manifest_hash inconsistency
+
+
+def test_cert_signed_by_other_key_is_rejected(tmp_path):
+    from cloakllm.attestation import DeploymentKeyPair, SanitizationCertificate
+    _, _, mp = _cert_and_manifest(tmp_path)              # manifest for key A
+    other = DeploymentKeyPair.generate()                  # cert signed by key B
+    cert = SanitizationCertificate.create(
+        original_text="x", sanitized_text="y", entity_count=0, categories={},
+        detection_passes=["regex"], mode="tokenize", keypair=other)
+    cp = tmp_path / "cert_b.json"; cp.write_text(json.dumps(cert.to_dict()), encoding="utf-8")
+    r = verify_keys(str(cp), mp)
+    assert not r["ok"] and not r["checks"]["signature_valid"]
+
+
+def test_signature_only_mode_is_unverified_but_ok(tmp_path):
+    _, cp, _ = _cert_and_manifest(tmp_path)
+    r = verify_keys(cp)  # no manifest
+    assert r["ok"] and r["provenance_status"] == "UNVERIFIED"
+
+
+# --- standalone compliance-report re-validation (the v0.10.3 CRITICAL-1 guard) ---
+
+def _write_report(tmp_path, *, verdict, chain_verdict, total_entries):
+    rp = tmp_path / "report.json"
+    rp.write_text(json.dumps({
+        "verdict": verdict,
+        "chain_integrity": {"verdict": chain_verdict, "total_entries": total_entries},
+    }), encoding="utf-8")
+    return str(rp)
+
+
+def test_report_matching_intact_chain_ok(tmp_path):
+    adir = _make_chain(tmp_path)
+    rp = _write_report(tmp_path, verdict="COMPLIANT", chain_verdict="verified", total_entries=4)
+    assert verify_report(rp, adir)["ok"]
+
+
+def test_compliant_report_over_broken_chain_is_rejected(tmp_path):
+    """The load-bearing guard: a COMPLIANT + verified report CANNOT stand over a
+    tampered log. This is the exact v0.10.3 CRITICAL-1 failure the verifier exists
+    to catch independently."""
+    adir = _make_chain(tmp_path)
+    lines = _lines(adir)
+    e = json.loads(lines[1]); e["entity_count"] = 9999; lines[1] = json.dumps(e)
+    _write(adir, lines)
+    rp = _write_report(tmp_path, verdict="COMPLIANT", chain_verdict="verified", total_entries=4)
+    r = verify_report(rp, adir)
+    assert not r["ok"] and not r["actual_chain_valid"] and r["mismatches"]
+
+
+def test_report_inflated_entry_count_is_rejected(tmp_path):
+    # A report claiming MORE entries than the log holds describes evidence the
+    # log cannot back -- always a mismatch.
+    adir = _make_chain(tmp_path)
+    rp = _write_report(tmp_path, verdict="COMPLIANT", chain_verdict="verified", total_entries=99)
+    assert not verify_report(rp, adir)["ok"]
+
+
+def test_scoped_report_with_fewer_entries_is_ok(tmp_path):
+    # Reports are routinely period-/article-scoped, covering FEWER entries than
+    # the full chain. That must NOT be flagged (the count check is one-directional).
+    adir = _make_chain(tmp_path)  # 4 entries
+    rp = _write_report(tmp_path, verdict="COMPLIANT", chain_verdict="verified", total_entries=1)
+    r = verify_report(rp, adir)
+    assert r["ok"] and not r["mismatches"]
+
+
+# --- verify_all: the verify-don't-assert guard ---
+
+def test_verify_all_ok_when_chain_intact_no_checkpoints(tmp_path):
+    r = verify_all(_make_chain(tmp_path))
+    assert r["ok"] and not r["timestamps_applicable"]
+
+
+def test_verify_all_false_when_chain_tampered(tmp_path):
+    adir = _make_chain(tmp_path)
+    lines = _lines(adir)
+    e = json.loads(lines[0]); e["entity_count"] = -1
+    lines[0] = json.dumps(e)
+    _write(adir, lines)
+    r = verify_all(adir)
+    assert not r["ok"]  # a failed required sub-check MUST sink the whole verdict