pramana-verify 0.0.1__tar.gz

pramana_verify-0.0.1/.gitignore

@@ -0,0 +1,15 @@
+.venv/
+__pycache__/
+*.pyc
+.pramana/
+.pytest_cache/
+web/node_modules/
+web/dist/
+# Secrets. The trailing slash this line used to have (`.env/`) matched only a
+# *directory* named .env, never the file — which is how .env ended up committed
+# in a1434d1 with a live Postgres password and S3 keys in it. Adding it here
+# does not remove it from history: those credentials must be rotated, and the
+# commit purged, separately.
+.env
+.env.*
+!.env.example

pramana_verify-0.0.1/PKG-INFO

@@ -0,0 +1,98 @@
+Metadata-Version: 2.5
+Name: pramana-verify
+Version: 0.0.1
+Summary: Independently verify a Pramana evidence bundle — offline, with no Pramana account.
+Project-URL: Homepage, https://www.reliai.in
+Project-URL: Documentation, https://www.reliai.in/docs/
+Author-email: Sahil Pandey <sahil@reliai.in>
+License-Expression: Apache-2.0
+Keywords: ai-agents,audit,compliance,ed25519,evidence,merkle
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: Legal Industry
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security :: Cryptography
+Classifier: Topic :: Software Development :: Testing
+Requires-Python: >=3.12
+Requires-Dist: cryptography>=42
+Description-Content-Type: text/markdown
+
+# pramana-verify
+
+Independently check that a Pramana evidence bundle has not been altered.
+
+Pramana records what an AI agent did. Every recorded event is fingerprinted with SHA-256 and
+chained to the one before it, the chain is summarised into a Merkle root, and that root is signed
+with Ed25519. This tool checks all of that, **on your machine, with no network access and no
+Pramana account.**
+
+It exists so that you do not have to trust Pramana, or the company whose agent produced the
+bundle, in order to believe the bundle.
+
+## Install
+
+```bash
+pip install pramana-verify
+```
+
+One dependency (`cryptography`). Nothing else from the Pramana platform is required or installed.
+
+## Use
+
+```bash
+pramana-verify bundle.json --pubkey <hex>
+```
+
+`--pubkey` takes either the public key as hex, or a path to a file containing it.
+
+**A passing bundle:**
+
+```
+OK — 428 event(s), merkle_root=3f9c1a...
+```
+
+**A bundle that has been altered:**
+
+```
+TAMPERED / INVALID:
+  - event 17 (ev-8c21): hash chain broken — prev_hash does not match event 16
+```
+
+Exit code is `0` when the bundle verifies and `1` when it does not, so this can be wired into an
+automated compliance check.
+
+## Getting the public key
+
+**Obtain the public key out of band** — from Pramana directly, from your own records, or from
+whoever you are auditing, through a channel separate from the bundle itself.
+
+This tool will never read a key from inside the bundle, deliberately. A bundle carrying its own
+verification key proves nothing: anyone who altered the contents could re-sign them with a key of
+their own and embed that instead.
+
+## What a passing result proves
+
+- **Nothing in the bundle has been changed since it was signed.** Not one character of a prompt, a
+  response, a tool argument, a timestamp or an ordering. Any edit breaks the hash chain, and the
+  tool names the event where it broke.
+- **The bundle was signed by the holder of the private key** matching the public key you supplied.
+
+## What it does not prove
+
+- **That the recording was complete or honest at the moment it was made.** Cryptography proves
+  nothing has been altered *since signing*. It cannot prove that what was captured was everything
+  that happened.
+- **That the agent behaved correctly.** This is a proof of record, not a judgement of conduct.
+
+Those two limits are inherent to any signed audit record, and stating them is part of using one
+properly.
+
+## Offline by design
+
+This tool makes no network calls of any kind. You can verify a bundle on an air-gapped machine,
+and you can verify a bundle years after it was produced, without Pramana existing.
+
+---
+
+More about the platform that produces these bundles: https://www.reliai.in

pramana_verify-0.0.1/README.md

@@ -0,0 +1,78 @@
+# pramana-verify
+
+Independently check that a Pramana evidence bundle has not been altered.
+
+Pramana records what an AI agent did. Every recorded event is fingerprinted with SHA-256 and
+chained to the one before it, the chain is summarised into a Merkle root, and that root is signed
+with Ed25519. This tool checks all of that, **on your machine, with no network access and no
+Pramana account.**
+
+It exists so that you do not have to trust Pramana, or the company whose agent produced the
+bundle, in order to believe the bundle.
+
+## Install
+
+```bash
+pip install pramana-verify
+```
+
+One dependency (`cryptography`). Nothing else from the Pramana platform is required or installed.
+
+## Use
+
+```bash
+pramana-verify bundle.json --pubkey <hex>
+```
+
+`--pubkey` takes either the public key as hex, or a path to a file containing it.
+
+**A passing bundle:**
+
+```
+OK — 428 event(s), merkle_root=3f9c1a...
+```
+
+**A bundle that has been altered:**
+
+```
+TAMPERED / INVALID:
+  - event 17 (ev-8c21): hash chain broken — prev_hash does not match event 16
+```
+
+Exit code is `0` when the bundle verifies and `1` when it does not, so this can be wired into an
+automated compliance check.
+
+## Getting the public key
+
+**Obtain the public key out of band** — from Pramana directly, from your own records, or from
+whoever you are auditing, through a channel separate from the bundle itself.
+
+This tool will never read a key from inside the bundle, deliberately. A bundle carrying its own
+verification key proves nothing: anyone who altered the contents could re-sign them with a key of
+their own and embed that instead.
+
+## What a passing result proves
+
+- **Nothing in the bundle has been changed since it was signed.** Not one character of a prompt, a
+  response, a tool argument, a timestamp or an ordering. Any edit breaks the hash chain, and the
+  tool names the event where it broke.
+- **The bundle was signed by the holder of the private key** matching the public key you supplied.
+
+## What it does not prove
+
+- **That the recording was complete or honest at the moment it was made.** Cryptography proves
+  nothing has been altered *since signing*. It cannot prove that what was captured was everything
+  that happened.
+- **That the agent behaved correctly.** This is a proof of record, not a judgement of conduct.
+
+Those two limits are inherent to any signed audit record, and stating them is part of using one
+properly.
+
+## Offline by design
+
+This tool makes no network calls of any kind. You can verify a bundle on an air-gapped machine,
+and you can verify a bundle years after it was produced, without Pramana existing.
+
+---
+
+More about the platform that produces these bundles: https://www.reliai.in

pramana_verify-0.0.1/pyproject.toml

@@ -0,0 +1,49 @@
+[project]
+name = "pramana-verify"
+version = "0.0.1"
+requires-python = ">=3.12"
+description = "Independently verify a Pramana evidence bundle — offline, with no Pramana account."
+readme = "README.md"
+license = "Apache-2.0"
+authors = [{ name = "Sahil Pandey", email = "sahil@reliai.in" }]
+keywords = ["audit", "evidence", "ai-agents", "merkle", "ed25519", "compliance"]
+classifiers = [
+  "Development Status :: 4 - Beta",
+  "Intended Audience :: Developers",
+  "Intended Audience :: Legal Industry",
+  "Programming Language :: Python :: 3.12",
+  "Programming Language :: Python :: 3.13",
+  "Topic :: Security :: Cryptography",
+  "Topic :: Software Development :: Testing",
+]
+
+# Deliberately just this: a regulator installs ONE small package to verify a
+# bundle offline (docs/plan.md M4 repo layout: "standalone, zero-dependency
+# verifier"). No pramana-core/pramana-proto/psycopg/boto3 — see canonical.py
+# and merkle.py, which duplicate (not import) the tiny pieces of algorithm
+# this needs, so this package never has to install the rest of the monorepo.
+dependencies = ["cryptography>=42"]
+
+[project.urls]
+Homepage = "https://www.reliai.in"
+Documentation = "https://www.reliai.in/docs/"
+
+[project.scripts]
+pramana-verify = "pramana_verify.cli:main"
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/pramana_verify"]
+
+[tool.hatch.metadata]
+allow-direct-references = true
+
+[dependency-groups]
+# All test-only: a cross-check that this package's vendored
+# canonicalize/merkle logic hasn't drifted from the "real" implementation,
+# and fixtures for building real bundles to verify against. None of this is
+# a runtime dependency of the shipped tool.
+dev = ["pytest", "pramana-core", "pramana-proto", "pramana-store", "pramana-evidence"]

pramana_verify-0.0.1/src/pramana_verify/canonical.py

@@ -0,0 +1,41 @@
+"""Vendored, not imported: must match pramana_core.hashing.canonical_json_bytes
+and pramana_core.merkle.merkle_root byte-for-byte, or a legitimate bundle
+would fail to verify. Cross-checked in tests/test_matches_pramana_core.py —
+that test is this file's real spec.
+
+Duplicated on purpose (docs/plan.md M4): this package ships standalone, with
+no dependency on the rest of the monorepo.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import math
+from typing import Any
+
+
+class NonFiniteValueError(ValueError):
+    pass
+
+
+def _reject_non_finite(obj: Any) -> Any:
+    if isinstance(obj, float) and not math.isfinite(obj):
+        raise NonFiniteValueError(f"non-finite float in canonicalized payload: {obj!r}")
+    if isinstance(obj, dict):
+        for k, v in obj.items():
+            _reject_non_finite(k)
+            _reject_non_finite(v)
+    elif isinstance(obj, (list, tuple)):
+        for v in obj:
+            _reject_non_finite(v)
+    return obj
+
+
+def canonical_json_bytes(obj: Any) -> bytes:
+    _reject_non_finite(obj)
+    return json.dumps(obj, sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode("utf-8")
+
+
+def sha256_hex(data: bytes) -> str:
+    return hashlib.sha256(data).hexdigest()

pramana_verify-0.0.1/src/pramana_verify/cli.py

@@ -0,0 +1,48 @@
+"""`pramana-verify bundle.json --pubkey <hex-or-file>` (docs/LLD.md §8e).
+No network, no Pramana platform install needed — see the package docstring
+in canonical.py for why this tool has no dependency on the rest of the repo.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+from pathlib import Path
+
+from pramana_verify.verifier import verify_bundle
+
+
+def _load_pubkey_hex(value: str) -> str:
+    path = Path(value)
+    if path.exists():
+        return path.read_text().strip()
+    return value.strip()
+
+
+def main(argv: list[str] | None = None) -> None:
+    parser = argparse.ArgumentParser(prog="pramana-verify")
+    parser.add_argument("bundle", help="path to an evidence bundle JSON file")
+    parser.add_argument(
+        "--pubkey",
+        required=True,
+        help="the platform's public key (hex), or a path to a file containing it — "
+        "obtained out-of-band, never trusted from inside the bundle",
+    )
+    args = parser.parse_args(argv)
+
+    bundle = json.loads(Path(args.bundle).read_text())
+    result = verify_bundle(bundle, _load_pubkey_hex(args.pubkey))
+
+    if result.ok:
+        print(f"OK — {len(bundle.get('events', []))} event(s), merkle_root={bundle.get('merkle_root')}")
+        return
+
+    print("TAMPERED / INVALID:", file=sys.stderr)
+    for err in result.errors:
+        print(f"  - {err}", file=sys.stderr)
+    raise SystemExit(1)
+
+
+if __name__ == "__main__":
+    main()

pramana_verify-0.0.1/src/pramana_verify/merkle.py

@@ -0,0 +1,32 @@
+"""Vendored copy of pramana_core.merkle — see canonical.py's module
+docstring for why. Cross-checked in tests/test_matches_pramana_core.py.
+"""
+
+from __future__ import annotations
+
+import hashlib
+
+
+def _leaf_hash(data: bytes) -> bytes:
+    return hashlib.sha256(b"\x00" + data).digest()
+
+
+def _node_hash(left: bytes, right: bytes) -> bytes:
+    return hashlib.sha256(b"\x01" + left + right).digest()
+
+
+def _mth(leaves: list[bytes]) -> bytes:
+    n = len(leaves)
+    if n == 0:
+        return hashlib.sha256(b"").digest()
+    if n == 1:
+        return leaves[0]
+    k = 1
+    while k * 2 < n:
+        k *= 2
+    return _node_hash(_mth(leaves[:k]), _mth(leaves[k:]))
+
+
+def merkle_root(leaf_hashes_hex: list[str]) -> str:
+    leaves = [_leaf_hash(bytes.fromhex(h)) for h in leaf_hashes_hex]
+    return _mth(leaves).hex()

pramana_verify-0.0.1/src/pramana_verify/verifier.py

@@ -0,0 +1,114 @@
+"""Offline evidence-bundle verification (docs/plan.md M4;
+docs/PROJECT_SCOPE.md §6: "editing any stored event breaks the hash chain
+and `verify` CLI detects it").
+
+Trust model: the caller supplies the platform's public key explicitly. A key
+embedded *inside* the bundle is never used for verification — only the
+caller's own, out-of-band key counts (docs/LLD.md §6: "a regulator can
+verify independently").
+"""
+
+from __future__ import annotations
+
+import hashlib
+from dataclasses import dataclass, field
+from typing import Any
+
+from cryptography.exceptions import InvalidSignature
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
+
+from pramana_verify.canonical import NonFiniteValueError, canonical_json_bytes
+from pramana_verify.merkle import merkle_root
+
+
+@dataclass
+class VerificationResult:
+    ok: bool
+    errors: list[str] = field(default_factory=list)
+
+    def __bool__(self) -> bool:
+        return self.ok
+
+
+def _event_this_hash(event: dict[str, Any], prev_hash: str) -> str:
+    """Must match pramana_core.chain.event_fields_for_hash + sha256_hex
+    exactly — this is the other half of that contract, verified independently.
+    """
+    fields = dict(event)
+    fields.pop("this_hash", None)
+    fields["prev_hash"] = prev_hash
+    return hashlib.sha256(canonical_json_bytes(fields)).hexdigest()
+
+
+def verify_bundle(bundle: dict[str, Any], trusted_public_key_hex: str) -> VerificationResult:
+    errors: list[str] = []
+    events = bundle.get("events", [])
+
+    if not events:
+        return VerificationResult(ok=False, errors=["bundle has no events"])
+
+    # 1. Internal hash chain: each event's own content must hash to its
+    #    declared this_hash, and each event's prev_hash must match the
+    #    previous event's this_hash — catches edits and reordering alike.
+    prev_hash = events[0].get("prev_hash", "")
+    for i, event in enumerate(events):
+        label = f"event #{i} (seq={event.get('logical_seq')}, id={event.get('event_id')})"
+        if i > 0 and event.get("prev_hash", "") != prev_hash:
+            errors.append(f"{label}: prev_hash does not match the preceding event's this_hash")
+        if _event_this_hash(event, event.get("prev_hash", "")) != event.get("this_hash"):
+            errors.append(f"{label}: this_hash does not match its own content — this event was tampered with")
+        prev_hash = event.get("this_hash", "")
+
+    # 2. The merkle root over the (possibly-tampered) declared this_hashes
+    #    must match what was signed.
+    if merkle_root([e.get("this_hash", "") for e in events]) != bundle.get("merkle_root"):
+        errors.append("merkle_root does not match the events in this bundle")
+
+    # 3. Payload integrity. `payload_ref` is the SHA-256 of the blob's
+    #    canonical bytes, and step 1 already covers payload_ref via the event
+    #    hash — but nothing above ever reads the blob *content*, so rewriting a
+    #    recorded prompt or response inside `blobs` while leaving its ref
+    #    alone would otherwise verify completely clean. That is the one edit an
+    #    auditor cares most about catching, so recompute every blob's hash and
+    #    require every referenced payload to actually be present.
+    blobs = bundle.get("blobs", {})
+    if not isinstance(blobs, dict):
+        errors.append("blobs is not an object")
+        blobs = {}
+    for ref, payload in blobs.items():
+        try:
+            actual = hashlib.sha256(canonical_json_bytes(payload)).hexdigest()
+        except NonFiniteValueError as e:
+            errors.append(f"payload {ref[:12]}...: not canonicalizable ({e})")
+            continue
+        if actual != ref:
+            errors.append(
+                f"payload {ref[:12]}...: content does not hash to its reference — "
+                "this recorded prompt or response was tampered with"
+            )
+    for i, event in enumerate(events):
+        ref = event.get("payload_ref", "")
+        if ref and ref not in blobs:
+            errors.append(
+                f"event #{i} (seq={event.get('logical_seq')}, id={event.get('event_id')}): "
+                f"payload_ref {ref[:12]}... has no payload in this bundle"
+            )
+
+    # 4. Signature over the bundle header, checked against the
+    #    caller-supplied public key — never one embedded in the bundle.
+    header = canonical_json_bytes(
+        {
+            "tenant_id": bundle.get("tenant_id"),
+            "trace_id": bundle.get("trace_id"),
+            "from_seq": bundle.get("from_seq"),
+            "to_seq": bundle.get("to_seq"),
+            "merkle_root": bundle.get("merkle_root"),
+        }
+    )
+    try:
+        public_key = Ed25519PublicKey.from_public_bytes(bytes.fromhex(trusted_public_key_hex))
+        public_key.verify(bytes.fromhex(bundle.get("signature_hex", "")), header)
+    except (InvalidSignature, ValueError):
+        errors.append("signature does not verify against the supplied public key")
+
+    return VerificationResult(ok=not errors, errors=errors)

pramana_verify-0.0.1/tests/conftest.py

@@ -0,0 +1,18 @@
+import os
+
+import pytest
+from pramana_store.postgres import apply_schema
+
+CONNINFO = os.environ.get(
+    "PRAMANA_TEST_PG", "postgresql://postgres@127.0.0.1:55432/pramana"
+)
+
+
+@pytest.fixture(scope="session", autouse=True)
+def _schema():
+    apply_schema(CONNINFO)
+
+
+@pytest.fixture
+def conninfo():
+    return CONNINFO

pramana_verify-0.0.1/tests/test_matches_pramana_core.py

@@ -0,0 +1,39 @@
+"""The real spec for canonical.py/merkle.py: they must produce byte-for-byte
+identical output to pramana_core's versions. This is a dev-only, test-time
+dependency on pramana_core — never a runtime one (see pyproject.toml).
+"""
+
+import hashlib
+
+import pramana_core.hashing as core_hashing
+import pramana_core.merkle as core_merkle
+import pramana_verify.canonical as verify_canonical
+import pramana_verify.merkle as verify_merkle
+
+
+def test_canonical_json_bytes_matches():
+    samples = [
+        {"b": 1, "a": 2},
+        {"unicode": "café", "nested": {"x": [1, 2, 3]}},
+        [],
+        {},
+        {"z": None, "a": True},
+    ]
+    for obj in samples:
+        assert verify_canonical.canonical_json_bytes(obj) == core_hashing.canonical_json_bytes(obj)
+
+
+def test_sha256_hex_matches():
+    data = b"some bytes"
+    assert verify_canonical.sha256_hex(data) == core_hashing.sha256_hex(data)
+
+
+def test_merkle_root_matches():
+    leaves = [hashlib.sha256(str(i).encode()).hexdigest() for i in range(7)]
+    assert verify_merkle.merkle_root(leaves) == core_merkle.merkle_root(leaves)
+
+
+def test_merkle_root_matches_for_various_sizes():
+    for n in range(15):
+        leaves = [hashlib.sha256(str(i).encode()).hexdigest() for i in range(n)]
+        assert verify_merkle.merkle_root(leaves) == core_merkle.merkle_root(leaves)

pramana_verify-0.0.1/tests/test_verify_cli_offline.py

@@ -0,0 +1,164 @@
+"""docs/plan.md §7 acceptance test: `test_verify_cli_offline`.
+docs/PROJECT_SCOPE.md §6: "editing any stored event breaks the hash chain
+and `verify` CLI detects it"; "a bundle verifies... with the public CLI (no
+server)".
+"""
+
+from __future__ import annotations
+
+import copy
+import uuid
+
+from pramana_core.hashing import canonical_json_bytes
+from pramana_core.signing import generate_keypair
+from pramana_evidence.bundle import build_bundle
+from pramana_proto.v1.event_pb2 import LLM_CALL, Event
+from pramana_store.blob import LocalBlobStore
+from pramana_store.postgres import PostgresEventRepository
+from pramana_verify.verifier import verify_bundle
+
+
+def _make_bundle(conninfo, tmp_path, n=3):
+    tenant_id, trace_id = f"tenant-{uuid.uuid4()}", f"trace-{uuid.uuid4()}"
+    repo = PostgresEventRepository(conninfo, tenant_id=tenant_id)
+    blob_store = LocalBlobStore(tmp_path, tenant_id=tenant_id)
+    for i in range(n):
+        # canonical_json_bytes, not json.dumps — this must match the real
+        # record path (pramana.canonical.dump_blob), or payload_ref won't be
+        # the content hash of what's actually stored. The fixture used plain
+        # json.dumps for a long time, and that discrepancy is precisely why
+        # nobody noticed verify_bundle never checked blob content at all.
+        payload_ref = blob_store.put(canonical_json_bytes({"input": {"i": i}, "output": {"ok": True}}))
+        repo.append_if_new(
+            Event(
+                event_id=str(uuid.uuid4()),
+                tenant_id=tenant_id,
+                trace_id=trace_id,
+                agent_id="default",
+                call_site_id="cs1",
+                call_site_ordinal=i,
+                logical_seq=i,
+                kind=LLM_CALL,
+                input_hash=f"ih{i}",
+                payload_ref=payload_ref,
+                ts_wall_ns=1000 + i,
+            )
+        )
+    priv, pub = generate_keypair()
+    bundle = build_bundle(
+        repo=repo, blob_store=blob_store, tenant_id=tenant_id, trace_id=trace_id,
+        from_seq=0, to_seq=n - 1, private_key=priv,
+    )
+    return bundle.as_dict, pub.hex()
+
+
+def test_untampered_bundle_verifies(conninfo, tmp_path):
+    bundle, pubkey_hex = _make_bundle(conninfo, tmp_path)
+    result = verify_bundle(bundle, pubkey_hex)
+    assert result.ok, result.errors
+
+
+def test_wrong_public_key_fails(conninfo, tmp_path):
+    bundle, _ = _make_bundle(conninfo, tmp_path)
+    _, wrong_pub = generate_keypair()
+    result = verify_bundle(bundle, wrong_pub.hex())
+    assert not result.ok
+    assert any("signature" in e for e in result.errors)
+
+
+def test_tampered_event_is_detected_and_named(conninfo, tmp_path):
+    bundle, pubkey_hex = _make_bundle(conninfo, tmp_path, n=3)
+    tampered = copy.deepcopy(bundle)
+    tampered["events"][1]["input_hash"] = "0" * 64  # edit one stored event
+
+    result = verify_bundle(tampered, pubkey_hex)
+    assert not result.ok
+    # names the specific event, not just "something is wrong"
+    tampered_event_id = tampered["events"][1]["event_id"]
+    assert any(tampered_event_id in e for e in result.errors)
+    assert any("this_hash does not match" in e for e in result.errors)
+
+
+def test_sophisticated_tamper_still_breaks_the_chain_link(conninfo, tmp_path):
+    # A naive edit (change a field, leave this_hash alone) is already caught
+    # by the per-event self-consistency check above. This simulates a more
+    # careful attacker who *also* recomputes event 0's this_hash to match
+    # its new (fake) content — self-consistent in isolation, but event 1's
+    # prev_hash still points at the ORIGINAL this_hash, so the link breaks.
+    from pramana_verify.verifier import _event_this_hash
+
+    bundle, pubkey_hex = _make_bundle(conninfo, tmp_path, n=3)
+    tampered = copy.deepcopy(bundle)
+    tampered["events"][0]["input_hash"] = "0" * 64
+    tampered["events"][0]["this_hash"] = _event_this_hash(
+        tampered["events"][0], tampered["events"][0]["prev_hash"]
+    )
+
+    result = verify_bundle(tampered, pubkey_hex)
+    assert not result.ok
+    assert not any("event #0" in e for e in result.errors)  # event 0 is internally self-consistent
+    assert any("prev_hash does not match" in e for e in result.errors)  # but the link to it is broken
+    assert any("merkle_root" in e for e in result.errors)  # and the signed root no longer matches
+
+
+def test_tampered_merkle_root_is_detected(conninfo, tmp_path):
+    bundle, pubkey_hex = _make_bundle(conninfo, tmp_path)
+    tampered = copy.deepcopy(bundle)
+    tampered["merkle_root"] = "f" * 64
+
+    result = verify_bundle(tampered, pubkey_hex)
+    assert not result.ok
+    assert any("merkle_root" in e for e in result.errors)
+    assert any("signature" in e for e in result.errors)  # header changed too
+
+
+def test_empty_bundle_is_rejected():
+    result = verify_bundle({"events": []}, "00" * 32)
+    assert not result.ok
+
+
+def test_editing_a_recorded_prompt_or_response_is_detected(conninfo, tmp_path):
+    """The tamper an auditor cares most about, and the one that used to pass.
+
+    The hash chain covers each event's `payload_ref`, so an attacker can't
+    repoint an event at different content. But the prompt and response text
+    itself lives in `bundle["blobs"]`, and verify_bundle never read it — so
+    rewriting a recorded answer in place, leaving every hash and signature
+    untouched, verified completely clean.
+    """
+    bundle, pubkey_hex = _make_bundle(conninfo, tmp_path, n=3)
+    assert verify_bundle(bundle, pubkey_hex).ok
+
+    tampered = copy.deepcopy(bundle)
+    ref = tampered["events"][1]["payload_ref"]
+    assert tampered["blobs"][ref]["output"] == {"ok": True}
+    tampered["blobs"][ref]["output"] = {"ok": False, "refund": "not owed"}
+
+    result = verify_bundle(tampered, pubkey_hex)
+    assert not result.ok, "a rewritten recorded response must not verify"
+    assert any("tampered with" in e for e in result.errors)
+    assert any(ref[:12] in e for e in result.errors), "must name which payload"
+
+
+def test_dropping_a_payload_is_detected(conninfo, tmp_path):
+    """Removing the content instead of editing it is the same attack: an
+    auditor is handed a bundle that verifies but shows them nothing."""
+    bundle, pubkey_hex = _make_bundle(conninfo, tmp_path, n=2)
+    tampered = copy.deepcopy(bundle)
+    tampered["blobs"] = {}
+
+    result = verify_bundle(tampered, pubkey_hex)
+    assert not result.ok
+    assert any("has no payload in this bundle" in e for e in result.errors)
+
+
+def test_a_blob_nobody_references_is_still_hash_checked(conninfo, tmp_path):
+    """Content-addressing is checked per blob, so junk smuggled into `blobs`
+    under a made-up ref is caught even though no event points at it."""
+    bundle, pubkey_hex = _make_bundle(conninfo, tmp_path, n=2)
+    tampered = copy.deepcopy(bundle)
+    tampered["blobs"]["0" * 64] = {"input": "smuggled", "output": "smuggled"}
+
+    result = verify_bundle(tampered, pubkey_hex)
+    assert not result.ok
+    assert any("does not hash to its reference" in e for e in result.errors)