proofbundle 0.8.1__tar.gz → 1.0.0__tar.gz

{proofbundle-0.8.1/src/proofbundle.egg-info → proofbundle-1.0.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofbundle
-Version: 0.8.1
+Version: 1.0.0
 Summary: Emit and verify portable cryptographic evidence bundles, offline: Ed25519 + RFC 6962 Merkle + optional SD-JWT.
 Author: Konrad Gruszka
 License: MIT
@@ -27,8 +27,10 @@ Provides-Extra: sdjwt
 Provides-Extra: eval
 Requires-Dist: rfc8785>=0.1.4; extra == "eval"
 Provides-Extra: adapters
+Provides-Extra: pytest
+Requires-Dist: pytest>=7; extra == "pytest"
 Provides-Extra: inspect
-Requires-Dist: inspect_ai<0.4,>=0.3.100; python_version >= "3.10" and extra == "inspect"
+Requires-Dist: inspect_ai<0.4,>=0.3.112; python_version >= "3.10" and extra == "inspect"
 Provides-Extra: dev
 Requires-Dist: pytest>=7; extra == "dev"
 Requires-Dist: ruff>=0.5; extra == "dev"
@@ -38,7 +40,7 @@ Requires-Dist: build>=1; extra == "dev"
 Requires-Dist: hypothesis>=6; extra == "dev"
 Requires-Dist: rfc8785>=0.1.4; extra == "dev"
 Requires-Dist: sd-jwt>=0.10; extra == "dev"
-Requires-Dist: inspect_ai<0.4,>=0.3.100; python_version >= "3.10" and extra == "dev"
+Requires-Dist: inspect_ai<0.4,>=0.3.112; python_version >= "3.10" and extra == "dev"
 Dynamic: license-file
 
 <div align="center">
@@ -50,9 +52,10 @@ Dynamic: license-file
 
 <h1>proofbundle</h1>
 
-**Emit and verify, fully offline, portable evidence that a piece of data was
-signed and anchored in a tamper-evident log — and optionally carries a
-selectively disclosable credential. Pure Python, no server, no daemon, one JSON file.**
+**An offline verifier for AI eval receipts. Standards-native: Ed25519 signature,
+RFC 6962 transparency-log Merkle anchoring, optional SD-JWT (RFC 9901) selective
+disclosure, aligned to the in-toto test-result predicate. One portable JSON file,
+no server, no network.**
 
 [![CI](https://github.com/b7n0de/proofbundle/actions/workflows/ci.yml/badge.svg)](https://github.com/b7n0de/proofbundle/actions/workflows/ci.yml)
 [![PyPI](https://img.shields.io/pypi/v/proofbundle.svg?color=D6248A&cacheSeconds=3600)](https://pypi.org/project/proofbundle/)
@@ -70,7 +73,7 @@ selectively disclosable credential. Pure Python, no server, no daemon, one JSON
 
 **At a glance:** `proofbundle emit` signs and anchors a payload; `proofbundle
 verify` checks one self-contained `bundle.json` with three offline cryptographic
-checks → `OK` or `FAILED`. No network, no daemon, no own crypto. 74 tests.
+checks → `OK` or `FAILED`. No network, no daemon, no own crypto. 102 tests.
 
 ## Contents
 
@@ -80,6 +83,7 @@ checks → `OK` or `FAILED`. No network, no daemon, no own crypto. 74 tests.
 - [Install](#install)
 - [Quickstart](#quickstart)
 - [Demo](#demo--a-real-eval-log-to-a-verified-receipt-offline)
+- [Integrations](#integrations--a-signed-receipt-of-your-eval-or-test-run-automatically-v10)
 - [Interoperability](#interoperability)
 - [Bundle format](#bundle-format-proofbundlev01)
 - [Eval receipts](#eval-receipts)
@@ -225,6 +229,25 @@ that the *artifact* is signed and offline-verifiable, with model and dataset kep
 See [`examples/inspect_receipt.py`](examples/inspect_receipt.py) and
 [`examples/lm_eval_receipt.py`](examples/lm_eval_receipt.py).
 
+## Integrations — a signed receipt of your eval or test run, automatically (v1.0)
+
+Since v1.0, proofbundle can **auto-emit** a signed receipt of an **inspect_ai eval** or a **pytest run** via
+each framework's native plugin API — installed and ready, but strictly **opt-in** (it emits only when you set
+`PROOFBUNDLE_EMIT=1` or pass a flag; never silently, never failing your run):
+
+```bash
+pip install "proofbundle[inspect,eval]" && PROOFBUNDLE_EMIT=1 inspect eval task.py --model mockllm/model
+pip install "proofbundle[pytest,eval]"  && PROOFBUNDLE_EMIT=1 pytest
+```
+
+The distinguishing angle is exactly this opt-in **auto-emit of an Ed25519-signed receipt via the framework's
+own plugin** (an inspect_ai end-of-task hook + a pytest11 plugin), on top of the standards stack. Named
+fairly: [ai-audit-trail](https://pypi.org/project/ai-audit-trail/) records *runtime* agent Decision Receipts
+(FastAPI/LangChain, ISO 42001), a different layer; [ValiChord](https://github.com/topeuph-ai/ValiChord)
+builds attestation bundles from inspect_ai logs *post-hoc* (its v1 library is JCS + SHA-256 Merkle + HMAC
+challenge-response, **not digitally signed** — signatures are v2 scope). See
+[INTEGRATIONS.md](INTEGRATIONS.md) (+ a prepared composite GitHub Action under [`action/`](action/action.yml)).
+
 ## Interoperability
 
 proofbundle uses the same RFC 6962 / RFC 9162 Merkle primitive as
@@ -325,24 +348,46 @@ SD-JWT selective disclosure over one portable file, offline.
 The maintainers of inspect_evals (Arcadia Impact, funded by the UK AI Safety Institute) name an open
 gap ([arXiv:2507.06893](https://arxiv.org/abs/2507.06893)):
 a database of trustworthy evaluation results with proper provenance tracking. proofbundle is the
-missing **signature + selective-disclosure layer** for exactly that — complementary to metadata
-aggregation (Every Eval Ever) and documentation taxonomies (Eval Factsheets), not a competitor.
-See [INTEROP.md](INTEROP.md) for how it maps to OpenSSF Model Signing, CycloneDX ML-BOM, and in-toto.
-
-- **Two framework adapters** — `pip install "proofbundle[inspect]"` reads a UK AISI
+missing **signature + selective-disclosure layer** for exactly that.
+
+**How it fits — standards-native, and honest about the neighbours.** proofbundle attests that a *claimed*
+evaluation result is authentic, tamper-evident, and selectively disclosable. It does **not** attest that
+the evaluation was computed correctly or that results were not cherry-picked — proving faithful
+computation is the domain of TEE approaches such as
+[Attestable Audits](https://arxiv.org/abs/2506.23706). It is complementary to its neighbours, named
+fairly: [Every Eval Ever](https://github.com/evaleval/every_eval_ever) standardizes eval *metadata* but
+adds no cryptography (proofbundle ships an EEE→receipt converter);
+[OpenSSF Model Signing](https://github.com/ossf/model-signing-spec) signs *model weights*, not eval
+results; [ValiChord](https://github.com/topeuph-ai/ValiChord) plans blind peer consensus and a
+Holochain attested log (v2 scope); its current v1 attestation library uses a simple SHA-256 Merkle tree with
+no digital signature, no SD-JWT, no in-toto. proofbundle is the lightweight, **standards-native** piece between them:
+a portable receipt a third party verifies offline, with selective disclosure so an auditor can prove a
+threshold was met without revealing the model or the data. See [INTEROP.md](INTEROP.md).
+
+- **Three framework bridges** — `pip install "proofbundle[inspect]"` reads a UK AISI
   [inspect_ai](https://github.com/UKGovernmentBEIS/inspect_ai) eval log via the stable `read_eval_log`
   API (lazy import). `proofbundle.adapters.from_lm_eval_results` reads a real EleutherAI
   [lm-evaluation-harness](https://github.com/EleutherAI/lm-evaluation-harness) `results_*.json` (the
-  genuine `acc,none` filter-suffix format) and captures run provenance — no framework import either way.
-- **in-toto Statement v1** — `proofbundle.intoto.to_intoto_statement(claim, root_b64=…)`
-  emits the receipt as an in-toto statement with a self-hosted predicate type. The subject
-  digest is an *honest salted commitment* under a custom key, never `sha256` (see
-  [PREDICATE.md](PREDICATE.md)).
-- **SD-JWT issuance** (RFC 9901) — `proofbundle.sdjwt_issue.issue_sd_jwt(claim, signer,
+  genuine `acc,none` filter-suffix format). **`proofbundle.adapters.from_eee_dataset`** (v0.9) reads an
+  Every Eval Ever v0.2.2 aggregate JSON and builds a signed receipt — validated against the vendored EEE
+  schema, with **no runtime import** of `every_eval_ever` (it needs Python 3.12; proofbundle stays 3.9+).
+- **in-toto test-result export, DSSE-signed** (v0.9) — `proofbundle.intoto.export_intoto_dsse(claim,
+  signer)` emits the receipt as a DSSE-signed in-toto Statement v1 with the **generic
+  `test-result/v0.1` predicate** (result PASSED/FAILED, `configuration` ResourceDescriptors), so a generic
+  in-toto verifier understands it. Alongside the self-hosted-predicate `to_intoto_statement` (see
+  [PREDICATE.md](PREDICATE.md)). Metric details live in `annotations` (test-result has no native metric
+  field); the model/dataset stay salted commitments, never `sha256`.
+- **C2SP tlog-checkpoint** (v0.9) — `proofbundle.checkpoint.sign_checkpoint(origin, tree_size, root, …)`
+  emits a valid [C2SP](https://github.com/C2SP/C2SP/blob/main/tlog-checkpoint.md) signed note over the
+  RFC 6962 Merkle root, making a receipt witness-network / transparency-log compatible. Pure serialization
+  over the Ed25519 key already in use — no new crypto.
+- **SD-JWT issuance** (RFC 9901, verified Nov 2025) — `proofbundle.sdjwt_issue.issue_sd_jwt(claim, signer,
   root_b64=…, exact_score=…)` issues the receipt so a holder can disclose `passed` +
-  `threshold` while **withholding the exact score** and the identifier openings. The signed
-  bundle payload is the source of truth; the SD-JWT is a derived, bundle-bound view, verified
-  by proofbundle's own verifier **and** the `sd-jwt-python` reference.
+  `threshold` while **withholding the exact score** and the identifier openings. The digest mechanic is
+  RFC 9901 §4.2.3 (base64url of SHA-256 over the base64url-encoded Disclosure), cross-checked against the
+  `sd-jwt-python` reference.
+The signed bundle payload is always the source of truth; the SD-JWT and the in-toto export are derived,
+bundle-bound views.
 
 Every release ships **PEP 740 attestations** (Trusted Publishing) + an SLSA build-provenance
 attestation — see [SECURITY.md](SECURITY.md).
@@ -359,8 +404,12 @@ attestation — see [SECURITY.md](SECURITY.md).
   CITATION.cff, PEP 740 attestations documented.
 - **v0.7** — citability polish (ORCID, Zenodo DOI placeholder, in-toto proposal draft); v0.7.1 hardened
   verifier robustness + CI on Python 3.9 after a holistic review.
-- **v0.8 (current release)** — an offline `make demo` (real eval log -> signed receipt -> verified),
+- **v0.8** — an offline `make demo` (real eval log -> signed receipt -> verified),
   a sharpened honesty guardrail (authenticity/integrity, not computation-correctness), and outreach drafts.
+- **v0.9** — the standards moat: a DSSE-signed in-toto `test-result` export, a C2SP tlog-checkpoint over
+  the RFC 6962 root, an Every Eval Ever converter, and standards-native repositioning.
+- **v1.0 (current release)** — distribution: opt-in framework integrations that auto-emit a signed receipt
+  of an inspect_ai eval (end-of-task hook) or a pytest run (pytest11 plugin), plus a composite GitHub Action.
 - **Deferred** (explicitly not yet built) — SD-JWT VC conformance + `vct` metadata,
   Key-Binding JWT, status lists / revocation, an official in-toto PR, DSSE / a full in-toto client.
 

{proofbundle-0.8.1 → proofbundle-1.0.0}/README.md

@@ -7,9 +7,10 @@
 
 <h1>proofbundle</h1>
 
-**Emit and verify, fully offline, portable evidence that a piece of data was
-signed and anchored in a tamper-evident log — and optionally carries a
-selectively disclosable credential. Pure Python, no server, no daemon, one JSON file.**
+**An offline verifier for AI eval receipts. Standards-native: Ed25519 signature,
+RFC 6962 transparency-log Merkle anchoring, optional SD-JWT (RFC 9901) selective
+disclosure, aligned to the in-toto test-result predicate. One portable JSON file,
+no server, no network.**
 
 [![CI](https://github.com/b7n0de/proofbundle/actions/workflows/ci.yml/badge.svg)](https://github.com/b7n0de/proofbundle/actions/workflows/ci.yml)
 [![PyPI](https://img.shields.io/pypi/v/proofbundle.svg?color=D6248A&cacheSeconds=3600)](https://pypi.org/project/proofbundle/)
@@ -27,7 +28,7 @@ selectively disclosable credential. Pure Python, no server, no daemon, one JSON
 
 **At a glance:** `proofbundle emit` signs and anchors a payload; `proofbundle
 verify` checks one self-contained `bundle.json` with three offline cryptographic
-checks → `OK` or `FAILED`. No network, no daemon, no own crypto. 74 tests.
+checks → `OK` or `FAILED`. No network, no daemon, no own crypto. 102 tests.
 
 ## Contents
 
@@ -37,6 +38,7 @@ checks → `OK` or `FAILED`. No network, no daemon, no own crypto. 74 tests.
 - [Install](#install)
 - [Quickstart](#quickstart)
 - [Demo](#demo--a-real-eval-log-to-a-verified-receipt-offline)
+- [Integrations](#integrations--a-signed-receipt-of-your-eval-or-test-run-automatically-v10)
 - [Interoperability](#interoperability)
 - [Bundle format](#bundle-format-proofbundlev01)
 - [Eval receipts](#eval-receipts)
@@ -182,6 +184,25 @@ that the *artifact* is signed and offline-verifiable, with model and dataset kep
 See [`examples/inspect_receipt.py`](examples/inspect_receipt.py) and
 [`examples/lm_eval_receipt.py`](examples/lm_eval_receipt.py).
 
+## Integrations — a signed receipt of your eval or test run, automatically (v1.0)
+
+Since v1.0, proofbundle can **auto-emit** a signed receipt of an **inspect_ai eval** or a **pytest run** via
+each framework's native plugin API — installed and ready, but strictly **opt-in** (it emits only when you set
+`PROOFBUNDLE_EMIT=1` or pass a flag; never silently, never failing your run):
+
+```bash
+pip install "proofbundle[inspect,eval]" && PROOFBUNDLE_EMIT=1 inspect eval task.py --model mockllm/model
+pip install "proofbundle[pytest,eval]"  && PROOFBUNDLE_EMIT=1 pytest
+```
+
+The distinguishing angle is exactly this opt-in **auto-emit of an Ed25519-signed receipt via the framework's
+own plugin** (an inspect_ai end-of-task hook + a pytest11 plugin), on top of the standards stack. Named
+fairly: [ai-audit-trail](https://pypi.org/project/ai-audit-trail/) records *runtime* agent Decision Receipts
+(FastAPI/LangChain, ISO 42001), a different layer; [ValiChord](https://github.com/topeuph-ai/ValiChord)
+builds attestation bundles from inspect_ai logs *post-hoc* (its v1 library is JCS + SHA-256 Merkle + HMAC
+challenge-response, **not digitally signed** — signatures are v2 scope). See
+[INTEGRATIONS.md](INTEGRATIONS.md) (+ a prepared composite GitHub Action under [`action/`](action/action.yml)).
+
 ## Interoperability
 
 proofbundle uses the same RFC 6962 / RFC 9162 Merkle primitive as
@@ -282,24 +303,46 @@ SD-JWT selective disclosure over one portable file, offline.
 The maintainers of inspect_evals (Arcadia Impact, funded by the UK AI Safety Institute) name an open
 gap ([arXiv:2507.06893](https://arxiv.org/abs/2507.06893)):
 a database of trustworthy evaluation results with proper provenance tracking. proofbundle is the
-missing **signature + selective-disclosure layer** for exactly that — complementary to metadata
-aggregation (Every Eval Ever) and documentation taxonomies (Eval Factsheets), not a competitor.
-See [INTEROP.md](INTEROP.md) for how it maps to OpenSSF Model Signing, CycloneDX ML-BOM, and in-toto.
-
-- **Two framework adapters** — `pip install "proofbundle[inspect]"` reads a UK AISI
+missing **signature + selective-disclosure layer** for exactly that.
+
+**How it fits — standards-native, and honest about the neighbours.** proofbundle attests that a *claimed*
+evaluation result is authentic, tamper-evident, and selectively disclosable. It does **not** attest that
+the evaluation was computed correctly or that results were not cherry-picked — proving faithful
+computation is the domain of TEE approaches such as
+[Attestable Audits](https://arxiv.org/abs/2506.23706). It is complementary to its neighbours, named
+fairly: [Every Eval Ever](https://github.com/evaleval/every_eval_ever) standardizes eval *metadata* but
+adds no cryptography (proofbundle ships an EEE→receipt converter);
+[OpenSSF Model Signing](https://github.com/ossf/model-signing-spec) signs *model weights*, not eval
+results; [ValiChord](https://github.com/topeuph-ai/ValiChord) plans blind peer consensus and a
+Holochain attested log (v2 scope); its current v1 attestation library uses a simple SHA-256 Merkle tree with
+no digital signature, no SD-JWT, no in-toto. proofbundle is the lightweight, **standards-native** piece between them:
+a portable receipt a third party verifies offline, with selective disclosure so an auditor can prove a
+threshold was met without revealing the model or the data. See [INTEROP.md](INTEROP.md).
+
+- **Three framework bridges** — `pip install "proofbundle[inspect]"` reads a UK AISI
   [inspect_ai](https://github.com/UKGovernmentBEIS/inspect_ai) eval log via the stable `read_eval_log`
   API (lazy import). `proofbundle.adapters.from_lm_eval_results` reads a real EleutherAI
   [lm-evaluation-harness](https://github.com/EleutherAI/lm-evaluation-harness) `results_*.json` (the
-  genuine `acc,none` filter-suffix format) and captures run provenance — no framework import either way.
-- **in-toto Statement v1** — `proofbundle.intoto.to_intoto_statement(claim, root_b64=…)`
-  emits the receipt as an in-toto statement with a self-hosted predicate type. The subject
-  digest is an *honest salted commitment* under a custom key, never `sha256` (see
-  [PREDICATE.md](PREDICATE.md)).
-- **SD-JWT issuance** (RFC 9901) — `proofbundle.sdjwt_issue.issue_sd_jwt(claim, signer,
+  genuine `acc,none` filter-suffix format). **`proofbundle.adapters.from_eee_dataset`** (v0.9) reads an
+  Every Eval Ever v0.2.2 aggregate JSON and builds a signed receipt — validated against the vendored EEE
+  schema, with **no runtime import** of `every_eval_ever` (it needs Python 3.12; proofbundle stays 3.9+).
+- **in-toto test-result export, DSSE-signed** (v0.9) — `proofbundle.intoto.export_intoto_dsse(claim,
+  signer)` emits the receipt as a DSSE-signed in-toto Statement v1 with the **generic
+  `test-result/v0.1` predicate** (result PASSED/FAILED, `configuration` ResourceDescriptors), so a generic
+  in-toto verifier understands it. Alongside the self-hosted-predicate `to_intoto_statement` (see
+  [PREDICATE.md](PREDICATE.md)). Metric details live in `annotations` (test-result has no native metric
+  field); the model/dataset stay salted commitments, never `sha256`.
+- **C2SP tlog-checkpoint** (v0.9) — `proofbundle.checkpoint.sign_checkpoint(origin, tree_size, root, …)`
+  emits a valid [C2SP](https://github.com/C2SP/C2SP/blob/main/tlog-checkpoint.md) signed note over the
+  RFC 6962 Merkle root, making a receipt witness-network / transparency-log compatible. Pure serialization
+  over the Ed25519 key already in use — no new crypto.
+- **SD-JWT issuance** (RFC 9901, verified Nov 2025) — `proofbundle.sdjwt_issue.issue_sd_jwt(claim, signer,
   root_b64=…, exact_score=…)` issues the receipt so a holder can disclose `passed` +
-  `threshold` while **withholding the exact score** and the identifier openings. The signed
-  bundle payload is the source of truth; the SD-JWT is a derived, bundle-bound view, verified
-  by proofbundle's own verifier **and** the `sd-jwt-python` reference.
+  `threshold` while **withholding the exact score** and the identifier openings. The digest mechanic is
+  RFC 9901 §4.2.3 (base64url of SHA-256 over the base64url-encoded Disclosure), cross-checked against the
+  `sd-jwt-python` reference.
+The signed bundle payload is always the source of truth; the SD-JWT and the in-toto export are derived,
+bundle-bound views.
 
 Every release ships **PEP 740 attestations** (Trusted Publishing) + an SLSA build-provenance
 attestation — see [SECURITY.md](SECURITY.md).
@@ -316,8 +359,12 @@ attestation — see [SECURITY.md](SECURITY.md).
   CITATION.cff, PEP 740 attestations documented.
 - **v0.7** — citability polish (ORCID, Zenodo DOI placeholder, in-toto proposal draft); v0.7.1 hardened
   verifier robustness + CI on Python 3.9 after a holistic review.
-- **v0.8 (current release)** — an offline `make demo` (real eval log -> signed receipt -> verified),
+- **v0.8** — an offline `make demo` (real eval log -> signed receipt -> verified),
   a sharpened honesty guardrail (authenticity/integrity, not computation-correctness), and outreach drafts.
+- **v0.9** — the standards moat: a DSSE-signed in-toto `test-result` export, a C2SP tlog-checkpoint over
+  the RFC 6962 root, an Every Eval Ever converter, and standards-native repositioning.
+- **v1.0 (current release)** — distribution: opt-in framework integrations that auto-emit a signed receipt
+  of an inspect_ai eval (end-of-task hook) or a pytest run (pytest11 plugin), plus a composite GitHub Action.
 - **Deferred** (explicitly not yet built) — SD-JWT VC conformance + `vct` metadata,
   Key-Binding JWT, status lists / revocation, an official in-toto PR, DSSE / a full in-toto client.
 

{proofbundle-0.8.1 → proofbundle-1.0.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "proofbundle"
-version = "0.8.1"
+version = "1.0.0"
 description = "Emit and verify portable cryptographic evidence bundles, offline: Ed25519 + RFC 6962 Merkle + optional SD-JWT."
 readme = "README.md"
 requires-python = ">=3.9"
@@ -45,13 +45,16 @@ sdjwt = []
 eval = ["rfc8785>=0.1.4"]
 # The lm-eval adapter reads exported results.json (no import) → pure stdlib.
 adapters = []
+# The pytest plugin (opt-in test-run receipt via the pytest11 entry-point) — pytest is an optional extra,
+# never a core dependency. Floor 7.0: the hooks/stats API is signature-stable across pytest 7/8/9.
+pytest = ["pytest>=7"]
 # The inspect_ai adapter uses the STABLE read_eval_log API (lazy import). Pinned with an UPPER bound:
 # the .eval format + pydantic schema change between versions (inspect_ai issue 834), and the fixture
 # test is bound to this range. inspect_ai requires Python >= 3.10, so the marker gates it out on 3.9
 # (base + [eval]/[sdjwt] still work on 3.9; the inspect adapter test skips there). Fixes the red 3.9 CI.
-inspect = ['inspect_ai>=0.3.100,<0.4; python_version >= "3.10"']
+inspect = ['inspect_ai>=0.3.112,<0.4; python_version >= "3.10"']
 dev = ["pytest>=7", "ruff>=0.5", "jsonschema>=4", "mypy>=1.8", "build>=1", "hypothesis>=6",
-       "rfc8785>=0.1.4", "sd-jwt>=0.10", 'inspect_ai>=0.3.100,<0.4; python_version >= "3.10"']
+       "rfc8785>=0.1.4", "sd-jwt>=0.10", 'inspect_ai>=0.3.112,<0.4; python_version >= "3.10"']
 
 [project.urls]
 Homepage = "https://b7n0de.com"
@@ -63,11 +66,17 @@ Documentation = "https://github.com/b7n0de/proofbundle#readme"
 [project.scripts]
 proofbundle = "proofbundle.cli:main"
 
+# Framework integrations (opt-in auto-emit; gated on PROOFBUNDLE_EMIT / a flag, never silent).
+[project.entry-points.inspect_ai]
+proofbundle = "proofbundle._inspect_registry"
+[project.entry-points.pytest11]
+proofbundle = "proofbundle.pytest_plugin"
+
 [tool.setuptools.packages.find]
 where = ["src"]
 
 [tool.setuptools.package-data]
-proofbundle = ["py.typed"]
+proofbundle = ["py.typed", "eee_eval_schema.json"]
 
 [tool.ruff]
 line-length = 100

proofbundle-1.0.0/src/proofbundle/__init__.py

@@ -0,0 +1,56 @@
+"""proofbundle — emit and verify portable, offline cryptographic evidence bundles for AI eval receipts.
+
+Verify, fully offline and in pure Python, that a payload was Ed25519 signed and anchored under an RFC 6962
+Merkle root, with optional SD-JWT selective disclosure — plus opt-in framework integrations that auto-emit a
+signed receipt of an inspect_ai eval or a pytest run.
+
+The public API is loaded LAZILY (PEP 562): ``import proofbundle`` — and, via the entry points, loading the
+pytest plugin / inspect_ai hook — does NOT pull the crypto core until a name like ``verify_bundle`` is
+actually used. ``from proofbundle import verify_bundle`` works exactly as before; it just imports the backing
+module on first access. This keeps the framework integrations light at startup.
+"""
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+__version__ = "1.0.0"
+
+__all__ = [
+    "__version__",
+    "SCHEMA",
+    "verify_bundle",
+    "load_bundle",
+    "emit_bundle",
+    "generate_signer",
+    "verify_inclusion",
+    "verify_consistency",
+    "VerificationResult",
+    "Check",
+    "ProofBundleError",
+]
+
+# name → backing submodule (relative). Loaded on first attribute access.
+_LAZY = {
+    "SCHEMA": ".bundle", "load_bundle": ".bundle", "verify_bundle": ".bundle",
+    "emit_bundle": ".emit", "generate_signer": ".emit",
+    "Check": ".errors", "ProofBundleError": ".errors", "VerificationResult": ".errors",
+    "verify_consistency": ".merkle", "verify_inclusion": ".merkle",
+}
+
+if TYPE_CHECKING:  # static analysers + IDEs see the real names/types; runtime stays lazy
+    from .bundle import SCHEMA, load_bundle, verify_bundle
+    from .emit import emit_bundle, generate_signer
+    from .errors import Check, ProofBundleError, VerificationResult
+    from .merkle import verify_consistency, verify_inclusion
+
+
+def __getattr__(name: str):
+    module = _LAZY.get(name)
+    if module is None:
+        raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
+    import importlib  # noqa: PLC0415
+    return getattr(importlib.import_module(module, __name__), name)
+
+
+def __dir__():
+    return sorted(__all__)

proofbundle-1.0.0/src/proofbundle/_inspect_registry.py

@@ -0,0 +1,3 @@
+"""Entry-point target for the inspect_ai hook group. Importing this module registers ProofbundleHooks as an
+import side-effect. Kept intentionally minimal (no crypto) so inspect's startup discovery stays fast."""
+from .inspect_hook import ProofbundleHooks  # noqa: F401 — import side-effect registers the hook

proofbundle-1.0.0/src/proofbundle/_integration.py

@@ -0,0 +1,84 @@
+"""Shared opt-in helper for the framework integrations (inspect_ai hook, pytest plugin) — v1.0.
+
+THE TOP RULE (opt-in safety): an integration must NEVER silently write a file or alter a host run. It emits
+a receipt ONLY when the user explicitly turns it on — the ``PROOFBUNDLE_EMIT=1`` environment variable, or a
+framework flag that maps to it. A security tool that surprises you loses trust. Every function here is a
+no-op unless emission is enabled, catches its own errors (an integration must never fail the host run), and
+imports the crypto lazily (this module is only imported from inside a hook body, never at framework startup).
+
+Configuration (all optional, all env):
+  PROOFBUNDLE_EMIT       "1" to enable emission (the master opt-in). Anything else = disabled.
+  PROOFBUNDLE_KEY        path to a 32-byte raw Ed25519 seed to sign with. If unset, an EPHEMERAL key is
+                         generated (a warning is printed; the receipt is self-verifiable but not tied to a
+                         durable identity).
+  PROOFBUNDLE_OUT        output path: a file, or a directory (the default file name is written into it).
+                         Default: the default file name in the current directory.
+  PROOFBUNDLE_METRIC     which metric to bind (else the integration's first/most-relevant metric).
+  PROOFBUNDLE_COMPARATOR ">=" | ">" | "<=" | "<"  (default ">=").
+  PROOFBUNDLE_THRESHOLD  decimal string (default "0") — the pass/fail threshold to assert.
+"""
+from __future__ import annotations
+
+import os
+from pathlib import Path
+from typing import Optional
+
+DEFAULT_COMPARATOR = ">="
+DEFAULT_THRESHOLD = "0"
+
+
+def emit_enabled(flag: bool = False) -> bool:
+    """The master opt-in gate. True only if PROOFBUNDLE_EMIT == "1" OR an explicit framework flag is set."""
+    return flag or os.environ.get("PROOFBUNDLE_EMIT") == "1"
+
+
+def emit_config() -> dict:
+    """Read the (metric, comparator, threshold) emission config from the environment, with safe defaults."""
+    return {
+        "metric": os.environ.get("PROOFBUNDLE_METRIC"),
+        "comparator": os.environ.get("PROOFBUNDLE_COMPARATOR") or DEFAULT_COMPARATOR,
+        "threshold": os.environ.get("PROOFBUNDLE_THRESHOLD") or DEFAULT_THRESHOLD,
+    }
+
+
+def _resolve_signer():
+    """Return (signer, is_ephemeral). Loads PROOFBUNDLE_KEY if set, else generates an ephemeral key."""
+    from .emit import generate_signer, load_signer  # noqa: PLC0415 — lazy: only on actual emit
+    key_path = os.environ.get("PROOFBUNDLE_KEY")
+    if key_path:
+        return load_signer(key_path), False
+    return generate_signer(), True
+
+
+def _output_path(default_name: str) -> Path:
+    """Resolve the output file path from PROOFBUNDLE_OUT (file or directory) or the default name in cwd."""
+    out = os.environ.get("PROOFBUNDLE_OUT")
+    if not out:
+        return Path.cwd() / default_name
+    p = Path(out)
+    if p.is_dir() or out.endswith(os.sep):
+        return p / default_name
+    return p
+
+
+def emit_claim_receipt(claim: dict, default_name: str) -> Optional[str]:
+    """Sign ``claim`` into an eval receipt and write it to the resolved output path. Returns the path, or
+    None on any failure (an integration must never raise into the host run). Assumes emission is enabled
+    (the caller checks ``emit_enabled`` first)."""
+    try:
+        from .evalclaim import emit_eval_receipt  # noqa: PLC0415 — lazy
+        import json  # noqa: PLC0415
+
+        signer, ephemeral = _resolve_signer()
+        if ephemeral:
+            print("[proofbundle] PROOFBUNDLE_KEY not set — signing with an EPHEMERAL key "
+                  "(receipt is self-verifiable but not bound to a durable identity).")
+        bundle = emit_eval_receipt(claim, signer)
+        out = _output_path(default_name)
+        out.parent.mkdir(parents=True, exist_ok=True)
+        out.write_text(json.dumps(bundle, indent=2), encoding="utf-8")
+        print(f"[proofbundle] wrote signed eval receipt → {out}")
+        return str(out)
+    except Exception as e:  # noqa: BLE001 — never let emission break the host run
+        print(f"[proofbundle] receipt emission skipped ({type(e).__name__}: {e})")
+        return None

{proofbundle-0.8.1 → proofbundle-1.0.0}/src/proofbundle/adapters/__init__.py

@@ -5,6 +5,7 @@ add no runtime dependency. The output-format mapping is bound to a framework ver
 each fixture in tests/fixtures documents its source + version.
 """
 from .inspect_ai import from_inspect_ai_log
+from .eee import from_eee_dataset
 from .lm_eval import from_lm_eval_results
 
-__all__ = ["from_lm_eval_results", "from_inspect_ai_log"]
+__all__ = ["from_lm_eval_results", "from_inspect_ai_log", "from_eee_dataset"]