proofbundle 1.2.0__tar.gz → 1.4.0__tar.gz

{proofbundle-1.2.0/src/proofbundle.egg-info → proofbundle-1.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofbundle
-Version: 1.2.0
+Version: 1.4.0
 Summary: Emit and verify portable cryptographic evidence bundles, offline: Ed25519 + RFC 6962 Merkle + optional SD-JWT.
 Author: Konrad Gruszka
 License: MIT
@@ -14,12 +14,13 @@ Classifier: Development Status :: 3 - Alpha
 Classifier: Intended Audience :: Developers
 Classifier: License :: OSI Approved :: MIT License
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: Security :: Cryptography
-Requires-Python: >=3.9
+Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: cryptography>=42
@@ -27,10 +28,12 @@ Provides-Extra: sdjwt
 Provides-Extra: eval
 Requires-Dist: rfc8785>=0.1.4; extra == "eval"
 Provides-Extra: adapters
+Provides-Extra: pq
+Requires-Dist: cryptography>=48; extra == "pq"
 Provides-Extra: pytest
 Requires-Dist: pytest>=7; extra == "pytest"
 Provides-Extra: inspect
-Requires-Dist: inspect_ai<0.4,>=0.3.112; python_version >= "3.10" and extra == "inspect"
+Requires-Dist: inspect_ai<0.4,>=0.3.112; extra == "inspect"
 Provides-Extra: dev
 Requires-Dist: pytest>=7; extra == "dev"
 Requires-Dist: ruff>=0.5; extra == "dev"
@@ -40,7 +43,7 @@ Requires-Dist: build>=1; extra == "dev"
 Requires-Dist: hypothesis>=6; extra == "dev"
 Requires-Dist: rfc8785>=0.1.4; extra == "dev"
 Requires-Dist: sd-jwt>=0.10; extra == "dev"
-Requires-Dist: inspect_ai<0.4,>=0.3.112; python_version >= "3.10" and extra == "dev"
+Requires-Dist: inspect_ai<0.4,>=0.3.112; extra == "dev"
 Dynamic: license-file
 
 <div align="center">
@@ -53,9 +56,11 @@ Dynamic: license-file
 <h1>proofbundle</h1>
 
 **An offline verifier for AI eval receipts. Standards-native: Ed25519 signature,
-RFC 6962 transparency-log Merkle anchoring, optional SD-JWT (RFC 9901) selective
-disclosure, aligned to the in-toto test-result predicate. One portable JSON file,
-no server, no network.**
+RFC 6962 transparency-log Merkle anchoring, C2SP witnessed checkpoints and
+`.tlog-proof` transparent signatures (post-quantum-ready witnesses, ML-DSA-44),
+SD-JWT (RFC 9901) selective disclosure with Key Binding, Token-Status-List
+revocation snapshots, aligned to the in-toto test-result predicate. One portable
+file, no server, no network.**
 
 [![CI](https://github.com/b7n0de/proofbundle/actions/workflows/ci.yml/badge.svg)](https://github.com/b7n0de/proofbundle/actions/workflows/ci.yml)
 [![PyPI](https://img.shields.io/pypi/v/proofbundle.svg?color=D6248A&cacheSeconds=3600)](https://pypi.org/project/proofbundle/)
@@ -65,6 +70,9 @@ no server, no network.**
 [![Ruff](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/ruff/main/assets/badge/v2.json)](https://github.com/astral-sh/ruff)
 [![SLSA build provenance](https://img.shields.io/badge/SLSA-build_provenance-D6248A.svg)](https://slsa.dev)
 [![PyPI attestations](https://img.shields.io/badge/PyPI-attestations_(PEP_740)-D6248A.svg)](https://pypi.org/project/proofbundle/)
+[![Post-quantum witnesses](https://img.shields.io/badge/PQ-ML--DSA--44_cosignatures-D6248A.svg)](https://github.com/C2SP/C2SP/blob/main/tlog-cosignature.md)
+[![Mutation tested](https://img.shields.io/badge/tests-mutation_gated-D6248A.svg)](scripts/mutation_check.py)
+[![C2SP tlog-proof](https://img.shields.io/badge/C2SP-tlog--proof-D6248A.svg)](https://github.com/C2SP/C2SP/blob/main/tlog-proof.md)
 <!-- DOI badge placeholder: enable Zenodo archiving for this repo, then add the Zenodo concept-DOI
      badge here (and the DOI to CITATION.cff) once Zenodo assigns one on the next release. No DOI has
      been assigned yet (no archived record exists at build time) — tracked in the human checklist. -->
@@ -73,11 +81,12 @@ no server, no network.**
 
 **At a glance:** `proofbundle emit` signs and anchors a payload; `proofbundle
 verify` checks one self-contained `bundle.json` with three offline cryptographic
-checks → `OK` or `FAILED`. No network, no daemon, no own crypto. 148 tests.
+checks → `OK` or `FAILED`. No network, no daemon, no own crypto. 209 tests + a CI mutation gate.
 
 ## Contents
 
 - [Why](#why)
+- [What a receipt proves](#what-a-receipt-proves-and-what-it-does-not)
 - [What it verifies](#what-it-verifies)
 - [How it fits together](#how-it-fits-together)
 - [Install](#install)
@@ -88,6 +97,7 @@ checks → `OK` or `FAILED`. No network, no daemon, no own crypto. 148 tests.
 - [Bundle format](#bundle-format-proofbundlev01)
 - [Eval receipts](#eval-receipts)
 - [Security notes and scope](#security-notes-and-scope-stated-honestly)
+- [Compliance](#compliance)
 - [Roadmap](#roadmap)
 - [Contributing](#contributing)
 - [License](#license)
@@ -148,12 +158,19 @@ A bundle is a single JSON document. `proofbundle` checks, offline:
    Certificate Transparency)
 3. **sd-jwt** (optional) — an embedded SD-JWT selective-disclosure credential is
    well formed, and if an issuer key is given, correctly issuer-signed
-4. **sd-jwt-key-binding** (optional, v1.2) — if the SD-JWT carries a Key Binding
-   JWT (RFC 9901 §4.3), it is verified **fail-closed**: `typ` is `kb+jwt`,
-   `iat`/`aud`/`nonce`/`sd_hash` are present, `sd_hash` binds the exact presented
-   disclosure set, and the signature verifies under the issuer-bound `cnf.jwk`
-   holder key. A present-but-broken KB-JWT fails the bundle — it is never
-   silently ignored.
+4. **sd-jwt-key-binding** (optional, v1.2; hardened v1.3) — proof-of-possession, **fail-closed**.
+   The check runs only once the issuer signature itself verified (an unauthenticated SD-JWT can
+   never report a valid holder binding). Then: `typ` is `kb+jwt`, `iat`/`aud`/`nonce`/`sd_hash` are
+   present, `sd_hash` binds the exact presented disclosure set, and the signature verifies under the
+   issuer-bound `cnf.jwk` holder key. A present-but-broken KB-JWT fails the bundle; and if the issuer
+   **bound** a `cnf` holder key but the presentation carries **no** KB-JWT, that fails too — stripping
+   the binding is a bearer downgrade, not a valid receipt. `verify --aud/--nonce` enforce RFC 9901
+   §7.3 audience/replay binding when the relying party supplies them.
+
+Beyond the single-file bundle, the library also verifies, all offline: a **witnessed C2SP checkpoint**
+(`verify_witnessed_checkpoint`, Ed25519 + post-quantum ML-DSA-44 cosignatures — the quorum counts distinct
+witness **keys**, not names, so one key under many names can never stuff a threshold), a **C2SP
+`.tlog-proof`** (`proofbundle verify-proof`), and a **Token Status List** revocation snapshot.
 
 The verifier treats the payload as opaque bytes. It proves that these exact
 bytes were signed and anchored, not what they mean. That is on purpose: it keeps
@@ -192,7 +209,7 @@ flowchart LR
 pip install proofbundle
 ```
 
-Requires Python 3.9+ and [`cryptography`](https://cryptography.io). Signature
+Requires Python 3.10+ and [`cryptography`](https://cryptography.io). Signature
 math is delegated to `cryptography`; this project never rolls its own crypto.
 The Merkle and SD-JWT logic is pure standard library.
 
@@ -214,7 +231,7 @@ proofbundle verify examples/example_bundle.json
 ```
 
 <div align="center">
-<img src="assets/demo.svg" alt="proofbundle verify output: four PASS checks and OK" width="680">
+<img src="assets/demo.svg" alt="proofbundle verify output: PASS checks and OK" width="680">
 </div>
 
 Machine-readable output and a non-zero exit code on failure:
@@ -312,6 +329,41 @@ both log-signed **and** cosigned by a quorum of distinct witnesses, offline,
 which rules out a split view by the log operator. This is the same
 witnessed-checkpoint pattern Rekor v2 (GA October 2025) institutionalizes.
 
+Since v1.3 the witness layer is complete: **ML-DSA-44 cosignatures** (C2SP type
+0x06, FIPS 204 — post-quantum, the spec's SHOULD for new witness deployments;
+optional `proofbundle[pq]` extra, Ed25519 stays the default) and the
+**[C2SP tlog-proof](https://github.com/C2SP/C2SP/blob/main/tlog-proof.md)** file
+format (`.tlog-proof`) — index + inclusion proof + (co)signed checkpoint in one
+portable, offline-verifiable "transparent signature":
+
+```bash
+proofbundle verify-proof receipt.tlog-proof --payload-file result.json \
+    --log-vkey <log-vkey> --witness-vkey <w1> --witness-vkey <w2> --threshold 2
+```
+
+Revocation joins the offline model too: a receipt SD-JWT can carry a Token
+Status List `status` claim, checked against a signed, **bundled list snapshot**
+(`proofbundle.statuslist`) — staleness is reported explicitly instead of
+assumed away.
+
+```mermaid
+flowchart LR
+    B["bundle.json<br/>(signed + anchored receipt)"] --> CK["tlog-checkpoint<br/>(signed note over the root)"]
+    CK --> W1["witness cosignature<br/>Ed25519 · 0x04"]
+    CK --> W2["witness cosignature<br/>ML-DSA-44 · 0x06 · PQ"]
+    B -->|"index + inclusion proof"| TP[".tlog-proof<br/>transparent signature"]
+    W1 --> TP
+    W2 --> TP
+    TP --> V{{"proofbundle verify-proof<br/>offline · k-of-n policy"}}
+    V --> R1["log signature"]
+    V --> R2["witness quorum"]
+    V --> R3["merkle inclusion"]
+
+    style V fill:#D6248A,stroke:#D6248A,color:#fff
+    style W2 fill:#1e2327,stroke:#D6248A,color:#fff
+    style TP fill:#1e2327,stroke:#D6248A,color:#fff
+```
+
 ## Bundle format (`proofbundle/v0.1`)
 
 The format is specified normatively in [SPEC.md](SPEC.md) (fields, encodings,
@@ -359,6 +411,11 @@ The scope is deliberately narrow. It does exactly what it says and no more:
 - Witness cosignatures (v1.2) prove consistency *observations* by the listed
   witnesses; real split-view resistance additionally requires the witnesses to be
   operationally independent — a deployment property no file format can supply.
+- Post-quantum: witness **cosignatures** may be ML-DSA-44 (v1.3, `[pq]` extra) — the layer where
+  the ecosystem (C2SP, Sigstore) is deploying PQ first. Primary signatures stay Ed25519 until the
+  ecosystem moves; a configured ML-DSA witness on a build without PQ support fails closed.
+- Revocation (v1.3) is checked against a SIGNED status-list snapshot the relying party supplies;
+  its freshness is reported and only judged against the caller's clock — never assumed.
 - The verifier does not fetch anything. Trust anchors (the signer key, the
   expected root, witness keys) are inputs you supply out of band.
 - No custom cryptography. Ed25519 comes from `cryptography`; Merkle hashing is
@@ -429,7 +486,7 @@ threshold was met without revealing the model or the data. See [INTEROP.md](INTE
   [lm-evaluation-harness](https://github.com/EleutherAI/lm-evaluation-harness) `results_*.json` (the
   genuine `acc,none` filter-suffix format). **`proofbundle.adapters.from_eee_dataset`** (v0.9) reads an
   Every Eval Ever v0.2.2 aggregate JSON and builds a signed receipt — validated against the vendored EEE
-  schema, with **no runtime import** of `every_eval_ever` (it needs Python 3.12; proofbundle stays 3.9+).
+  schema, with **no runtime import** of `every_eval_ever` (it needs Python 3.12; proofbundle stays 3.10+).
 - **in-toto test-result export, DSSE-signed** (v0.9) — `proofbundle.intoto.export_intoto_dsse(claim,
   signer)` emits the receipt as a DSSE-signed in-toto Statement v1 with the **generic
   `test-result/v0.1` predicate** (result PASSED/FAILED, `configuration` ResourceDescriptors), so a generic
@@ -455,6 +512,16 @@ bundle-bound views.
 Every release ships **PEP 740 attestations** (Trusted Publishing) + an SLSA build-provenance
 attestation — see [SECURITY.md](SECURITY.md).
 
+## Compliance
+
+The EU AI Act's record-keeping duty for high-risk systems (Article 12 — automatic,
+tamper-evident, independently verifiable logs) applies from **August 2, 2026**;
+the GPAI Code of Practice expects documented, credible model evaluations.
+**[COMPLIANCE.md](COMPLIANCE.md)** maps — honestly, and without claiming more
+than the cryptography supports — what a verified receipt covers under Article 12,
+NIST AI RMF MEASURE, and the logging standards in flight (prEN 18229-1,
+ISO/IEC DIS 24970), including the anti-patterns no one should claim.
+
 ## Roadmap
 
 - **v0.1** — the offline verifier plus a real example bundle.
@@ -475,13 +542,27 @@ attestation — see [SECURITY.md](SECURITY.md).
   eval (end-of-task hook) or a pytest run (pytest11 plugin), plus a composite GitHub Action.
 - **v1.1** — trust hardening: a signed `assurance_level`, a THREAT_MODEL, a self_attested-
   without-prereg warning, model-swap + replay + withheld-field checks, and an adversarial No-Fake-PASS suite.
-- **v1.2 (current release)** — holder binding + witness quorum: **Key Binding JWT** verification
+- **v1.2** — holder binding + witness quorum: **Key Binding JWT** verification
   (RFC 9901 §4.3, fail-closed; closes #1) with `cnf.jwk` issuance and holder presentation, **C2SP
   tlog-cosignature** verification (Ed25519 cosignature/v1, witness quorum, split-view resistance), and
   `verify --verbose` with the recomputed Merkle root (closes #2).
-- **Deferred** (explicitly not yet built) — SD-JWT VC conformance + `vct` metadata (not an RFC yet),
-  Token Status List verification (draft in the RFC-Editor queue; planned as a bundled snapshot to stay
-  offline), ML-DSA-44 cosignatures, an official in-toto PR, a full in-toto client.
+- **v1.3** — the portable proof: **C2SP tlog-proof** emit/verify (+
+  `verify-proof` CLI), **ML-DSA-44** witness cosignatures (post-quantum, `[pq]` extra), **Token
+  Status List** snapshot verification (offline revocation), SD-JWT VC markers (`dc+sd-jwt`,
+  `vct`, `status`), COMPLIANCE.md (EU AI Act Art. 12 / NIST AI RMF mapping), and the mutation
+  suite as a CI gate.
+- **v1.4 (current release)** — distribution: a **promptfoo** adapter (results.json v3 →
+  pass_rate receipt), the **Hugging Face Community Evals bridge** (`pb1.` receipt tokens for the
+  `.eval_results` `verifyToken` field + a strict YAML entry emitter — proofbundle-verifiable,
+  explicitly NOT the HF-internal badge token), `hf-token` CLI, and the **Python 3.10+ floor**
+  (3.9 is EOL since 2025-10).
+- **v2.0 (next major, research differentiation)** — **per-sample Merkle receipts**: the payload carries a
+  Merkle root over *individual* sample results, so a verifier can force a random-sample re-check instead of
+  trusting only the reported aggregate. This is the THREAT_MODEL's one named structural gap ("forced random
+  sub-sampling"), and closing it is the road from *authorship* to *sampled correctness*.
+- **Deferred** (explicitly not yet built, stated honestly) — full SD-JWT VC conformance + `vct`
+  type-metadata resolution (pre-IESG), an official in-toto eval predicate (proposal path via
+  OpenSSF/CoSAI), and a full in-toto client.
 
 ## Contributing
 

{proofbundle-1.2.0 → proofbundle-1.4.0}/README.md

@@ -8,9 +8,11 @@
 <h1>proofbundle</h1>
 
 **An offline verifier for AI eval receipts. Standards-native: Ed25519 signature,
-RFC 6962 transparency-log Merkle anchoring, optional SD-JWT (RFC 9901) selective
-disclosure, aligned to the in-toto test-result predicate. One portable JSON file,
-no server, no network.**
+RFC 6962 transparency-log Merkle anchoring, C2SP witnessed checkpoints and
+`.tlog-proof` transparent signatures (post-quantum-ready witnesses, ML-DSA-44),
+SD-JWT (RFC 9901) selective disclosure with Key Binding, Token-Status-List
+revocation snapshots, aligned to the in-toto test-result predicate. One portable
+file, no server, no network.**
 
 [![CI](https://github.com/b7n0de/proofbundle/actions/workflows/ci.yml/badge.svg)](https://github.com/b7n0de/proofbundle/actions/workflows/ci.yml)
 [![PyPI](https://img.shields.io/pypi/v/proofbundle.svg?color=D6248A&cacheSeconds=3600)](https://pypi.org/project/proofbundle/)
@@ -20,6 +22,9 @@ no server, no network.**
 [![Ruff](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/ruff/main/assets/badge/v2.json)](https://github.com/astral-sh/ruff)
 [![SLSA build provenance](https://img.shields.io/badge/SLSA-build_provenance-D6248A.svg)](https://slsa.dev)
 [![PyPI attestations](https://img.shields.io/badge/PyPI-attestations_(PEP_740)-D6248A.svg)](https://pypi.org/project/proofbundle/)
+[![Post-quantum witnesses](https://img.shields.io/badge/PQ-ML--DSA--44_cosignatures-D6248A.svg)](https://github.com/C2SP/C2SP/blob/main/tlog-cosignature.md)
+[![Mutation tested](https://img.shields.io/badge/tests-mutation_gated-D6248A.svg)](scripts/mutation_check.py)
+[![C2SP tlog-proof](https://img.shields.io/badge/C2SP-tlog--proof-D6248A.svg)](https://github.com/C2SP/C2SP/blob/main/tlog-proof.md)
 <!-- DOI badge placeholder: enable Zenodo archiving for this repo, then add the Zenodo concept-DOI
      badge here (and the DOI to CITATION.cff) once Zenodo assigns one on the next release. No DOI has
      been assigned yet (no archived record exists at build time) — tracked in the human checklist. -->
@@ -28,11 +33,12 @@ no server, no network.**
 
 **At a glance:** `proofbundle emit` signs and anchors a payload; `proofbundle
 verify` checks one self-contained `bundle.json` with three offline cryptographic
-checks → `OK` or `FAILED`. No network, no daemon, no own crypto. 148 tests.
+checks → `OK` or `FAILED`. No network, no daemon, no own crypto. 209 tests + a CI mutation gate.
 
 ## Contents
 
 - [Why](#why)
+- [What a receipt proves](#what-a-receipt-proves-and-what-it-does-not)
 - [What it verifies](#what-it-verifies)
 - [How it fits together](#how-it-fits-together)
 - [Install](#install)
@@ -43,6 +49,7 @@ checks → `OK` or `FAILED`. No network, no daemon, no own crypto. 148 tests.
 - [Bundle format](#bundle-format-proofbundlev01)
 - [Eval receipts](#eval-receipts)
 - [Security notes and scope](#security-notes-and-scope-stated-honestly)
+- [Compliance](#compliance)
 - [Roadmap](#roadmap)
 - [Contributing](#contributing)
 - [License](#license)
@@ -103,12 +110,19 @@ A bundle is a single JSON document. `proofbundle` checks, offline:
    Certificate Transparency)
 3. **sd-jwt** (optional) — an embedded SD-JWT selective-disclosure credential is
    well formed, and if an issuer key is given, correctly issuer-signed
-4. **sd-jwt-key-binding** (optional, v1.2) — if the SD-JWT carries a Key Binding
-   JWT (RFC 9901 §4.3), it is verified **fail-closed**: `typ` is `kb+jwt`,
-   `iat`/`aud`/`nonce`/`sd_hash` are present, `sd_hash` binds the exact presented
-   disclosure set, and the signature verifies under the issuer-bound `cnf.jwk`
-   holder key. A present-but-broken KB-JWT fails the bundle — it is never
-   silently ignored.
+4. **sd-jwt-key-binding** (optional, v1.2; hardened v1.3) — proof-of-possession, **fail-closed**.
+   The check runs only once the issuer signature itself verified (an unauthenticated SD-JWT can
+   never report a valid holder binding). Then: `typ` is `kb+jwt`, `iat`/`aud`/`nonce`/`sd_hash` are
+   present, `sd_hash` binds the exact presented disclosure set, and the signature verifies under the
+   issuer-bound `cnf.jwk` holder key. A present-but-broken KB-JWT fails the bundle; and if the issuer
+   **bound** a `cnf` holder key but the presentation carries **no** KB-JWT, that fails too — stripping
+   the binding is a bearer downgrade, not a valid receipt. `verify --aud/--nonce` enforce RFC 9901
+   §7.3 audience/replay binding when the relying party supplies them.
+
+Beyond the single-file bundle, the library also verifies, all offline: a **witnessed C2SP checkpoint**
+(`verify_witnessed_checkpoint`, Ed25519 + post-quantum ML-DSA-44 cosignatures — the quorum counts distinct
+witness **keys**, not names, so one key under many names can never stuff a threshold), a **C2SP
+`.tlog-proof`** (`proofbundle verify-proof`), and a **Token Status List** revocation snapshot.
 
 The verifier treats the payload as opaque bytes. It proves that these exact
 bytes were signed and anchored, not what they mean. That is on purpose: it keeps
@@ -147,7 +161,7 @@ flowchart LR
 pip install proofbundle
 ```
 
-Requires Python 3.9+ and [`cryptography`](https://cryptography.io). Signature
+Requires Python 3.10+ and [`cryptography`](https://cryptography.io). Signature
 math is delegated to `cryptography`; this project never rolls its own crypto.
 The Merkle and SD-JWT logic is pure standard library.
 
@@ -169,7 +183,7 @@ proofbundle verify examples/example_bundle.json
 ```
 
 <div align="center">
-<img src="assets/demo.svg" alt="proofbundle verify output: four PASS checks and OK" width="680">
+<img src="assets/demo.svg" alt="proofbundle verify output: PASS checks and OK" width="680">
 </div>
 
 Machine-readable output and a non-zero exit code on failure:
@@ -267,6 +281,41 @@ both log-signed **and** cosigned by a quorum of distinct witnesses, offline,
 which rules out a split view by the log operator. This is the same
 witnessed-checkpoint pattern Rekor v2 (GA October 2025) institutionalizes.
 
+Since v1.3 the witness layer is complete: **ML-DSA-44 cosignatures** (C2SP type
+0x06, FIPS 204 — post-quantum, the spec's SHOULD for new witness deployments;
+optional `proofbundle[pq]` extra, Ed25519 stays the default) and the
+**[C2SP tlog-proof](https://github.com/C2SP/C2SP/blob/main/tlog-proof.md)** file
+format (`.tlog-proof`) — index + inclusion proof + (co)signed checkpoint in one
+portable, offline-verifiable "transparent signature":
+
+```bash
+proofbundle verify-proof receipt.tlog-proof --payload-file result.json \
+    --log-vkey <log-vkey> --witness-vkey <w1> --witness-vkey <w2> --threshold 2
+```
+
+Revocation joins the offline model too: a receipt SD-JWT can carry a Token
+Status List `status` claim, checked against a signed, **bundled list snapshot**
+(`proofbundle.statuslist`) — staleness is reported explicitly instead of
+assumed away.
+
+```mermaid
+flowchart LR
+    B["bundle.json<br/>(signed + anchored receipt)"] --> CK["tlog-checkpoint<br/>(signed note over the root)"]
+    CK --> W1["witness cosignature<br/>Ed25519 · 0x04"]
+    CK --> W2["witness cosignature<br/>ML-DSA-44 · 0x06 · PQ"]
+    B -->|"index + inclusion proof"| TP[".tlog-proof<br/>transparent signature"]
+    W1 --> TP
+    W2 --> TP
+    TP --> V{{"proofbundle verify-proof<br/>offline · k-of-n policy"}}
+    V --> R1["log signature"]
+    V --> R2["witness quorum"]
+    V --> R3["merkle inclusion"]
+
+    style V fill:#D6248A,stroke:#D6248A,color:#fff
+    style W2 fill:#1e2327,stroke:#D6248A,color:#fff
+    style TP fill:#1e2327,stroke:#D6248A,color:#fff
+```
+
 ## Bundle format (`proofbundle/v0.1`)
 
 The format is specified normatively in [SPEC.md](SPEC.md) (fields, encodings,
@@ -314,6 +363,11 @@ The scope is deliberately narrow. It does exactly what it says and no more:
 - Witness cosignatures (v1.2) prove consistency *observations* by the listed
   witnesses; real split-view resistance additionally requires the witnesses to be
   operationally independent — a deployment property no file format can supply.
+- Post-quantum: witness **cosignatures** may be ML-DSA-44 (v1.3, `[pq]` extra) — the layer where
+  the ecosystem (C2SP, Sigstore) is deploying PQ first. Primary signatures stay Ed25519 until the
+  ecosystem moves; a configured ML-DSA witness on a build without PQ support fails closed.
+- Revocation (v1.3) is checked against a SIGNED status-list snapshot the relying party supplies;
+  its freshness is reported and only judged against the caller's clock — never assumed.
 - The verifier does not fetch anything. Trust anchors (the signer key, the
   expected root, witness keys) are inputs you supply out of band.
 - No custom cryptography. Ed25519 comes from `cryptography`; Merkle hashing is
@@ -384,7 +438,7 @@ threshold was met without revealing the model or the data. See [INTEROP.md](INTE
   [lm-evaluation-harness](https://github.com/EleutherAI/lm-evaluation-harness) `results_*.json` (the
   genuine `acc,none` filter-suffix format). **`proofbundle.adapters.from_eee_dataset`** (v0.9) reads an
   Every Eval Ever v0.2.2 aggregate JSON and builds a signed receipt — validated against the vendored EEE
-  schema, with **no runtime import** of `every_eval_ever` (it needs Python 3.12; proofbundle stays 3.9+).
+  schema, with **no runtime import** of `every_eval_ever` (it needs Python 3.12; proofbundle stays 3.10+).
 - **in-toto test-result export, DSSE-signed** (v0.9) — `proofbundle.intoto.export_intoto_dsse(claim,
   signer)` emits the receipt as a DSSE-signed in-toto Statement v1 with the **generic
   `test-result/v0.1` predicate** (result PASSED/FAILED, `configuration` ResourceDescriptors), so a generic
@@ -410,6 +464,16 @@ bundle-bound views.
 Every release ships **PEP 740 attestations** (Trusted Publishing) + an SLSA build-provenance
 attestation — see [SECURITY.md](SECURITY.md).
 
+## Compliance
+
+The EU AI Act's record-keeping duty for high-risk systems (Article 12 — automatic,
+tamper-evident, independently verifiable logs) applies from **August 2, 2026**;
+the GPAI Code of Practice expects documented, credible model evaluations.
+**[COMPLIANCE.md](COMPLIANCE.md)** maps — honestly, and without claiming more
+than the cryptography supports — what a verified receipt covers under Article 12,
+NIST AI RMF MEASURE, and the logging standards in flight (prEN 18229-1,
+ISO/IEC DIS 24970), including the anti-patterns no one should claim.
+
 ## Roadmap
 
 - **v0.1** — the offline verifier plus a real example bundle.
@@ -430,13 +494,27 @@ attestation — see [SECURITY.md](SECURITY.md).
   eval (end-of-task hook) or a pytest run (pytest11 plugin), plus a composite GitHub Action.
 - **v1.1** — trust hardening: a signed `assurance_level`, a THREAT_MODEL, a self_attested-
   without-prereg warning, model-swap + replay + withheld-field checks, and an adversarial No-Fake-PASS suite.
-- **v1.2 (current release)** — holder binding + witness quorum: **Key Binding JWT** verification
+- **v1.2** — holder binding + witness quorum: **Key Binding JWT** verification
   (RFC 9901 §4.3, fail-closed; closes #1) with `cnf.jwk` issuance and holder presentation, **C2SP
   tlog-cosignature** verification (Ed25519 cosignature/v1, witness quorum, split-view resistance), and
   `verify --verbose` with the recomputed Merkle root (closes #2).
-- **Deferred** (explicitly not yet built) — SD-JWT VC conformance + `vct` metadata (not an RFC yet),
-  Token Status List verification (draft in the RFC-Editor queue; planned as a bundled snapshot to stay
-  offline), ML-DSA-44 cosignatures, an official in-toto PR, a full in-toto client.
+- **v1.3** — the portable proof: **C2SP tlog-proof** emit/verify (+
+  `verify-proof` CLI), **ML-DSA-44** witness cosignatures (post-quantum, `[pq]` extra), **Token
+  Status List** snapshot verification (offline revocation), SD-JWT VC markers (`dc+sd-jwt`,
+  `vct`, `status`), COMPLIANCE.md (EU AI Act Art. 12 / NIST AI RMF mapping), and the mutation
+  suite as a CI gate.
+- **v1.4 (current release)** — distribution: a **promptfoo** adapter (results.json v3 →
+  pass_rate receipt), the **Hugging Face Community Evals bridge** (`pb1.` receipt tokens for the
+  `.eval_results` `verifyToken` field + a strict YAML entry emitter — proofbundle-verifiable,
+  explicitly NOT the HF-internal badge token), `hf-token` CLI, and the **Python 3.10+ floor**
+  (3.9 is EOL since 2025-10).
+- **v2.0 (next major, research differentiation)** — **per-sample Merkle receipts**: the payload carries a
+  Merkle root over *individual* sample results, so a verifier can force a random-sample re-check instead of
+  trusting only the reported aggregate. This is the THREAT_MODEL's one named structural gap ("forced random
+  sub-sampling"), and closing it is the road from *authorship* to *sampled correctness*.
+- **Deferred** (explicitly not yet built, stated honestly) — full SD-JWT VC conformance + `vct`
+  type-metadata resolution (pre-IESG), an official in-toto eval predicate (proposal path via
+  OpenSSF/CoSAI), and a full in-toto client.
 
 ## Contributing
 

{proofbundle-1.2.0 → proofbundle-1.4.0}/pyproject.toml

@@ -4,10 +4,10 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "proofbundle"
-version = "1.2.0"
+version = "1.4.0"
 description = "Emit and verify portable cryptographic evidence bundles, offline: Ed25519 + RFC 6962 Merkle + optional SD-JWT."
 readme = "README.md"
-requires-python = ">=3.9"
+requires-python = ">=3.10"
 license = { text = "MIT" }
 authors = [{ name = "Konrad Gruszka" }]
 keywords = [
@@ -26,10 +26,11 @@ classifiers = [
     "Intended Audience :: Developers",
     "License :: OSI Approved :: MIT License",
     "Programming Language :: Python :: 3",
-    "Programming Language :: Python :: 3.9",
     "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
     "Topic :: Security :: Cryptography",
 ]
 dependencies = ["cryptography>=42"]
@@ -45,16 +46,20 @@ sdjwt = []
 eval = ["rfc8785>=0.1.4"]
 # The lm-eval adapter reads exported results.json (no import) → pure stdlib.
 adapters = []
+# ML-DSA-44 (FIPS 204) cosignature verification (C2SP tlog-cosignature type 0x06). Needs a
+# cryptography build with OpenSSL 3.5+ (default PyPI wheels since 48.0.0). Verify-only by default;
+# the emit helper needs the same. Ed25519 paths never require this.
+pq = ["cryptography>=48"]
 # The pytest plugin (opt-in test-run receipt via the pytest11 entry-point) — pytest is an optional extra,
 # never a core dependency. Floor 7.0: the hooks/stats API is signature-stable across pytest 7/8/9.
 pytest = ["pytest>=7"]
 # The inspect_ai adapter uses the STABLE read_eval_log API (lazy import). Pinned with an UPPER bound:
 # the .eval format + pydantic schema change between versions (inspect_ai issue 834), and the fixture
-# test is bound to this range. inspect_ai requires Python >= 3.10, so the marker gates it out on 3.9
-# (base + [eval]/[sdjwt] still work on 3.9; the inspect adapter test skips there). Fixes the red 3.9 CI.
-inspect = ['inspect_ai>=0.3.112,<0.4; python_version >= "3.10"']
+# test is bound to this range. Since v1.4.0 the project floor is Python 3.10, so no per-extra version
+# marker is needed here (inspect_ai's own >=3.10 requirement is always satisfiable on a supported base).
+inspect = ['inspect_ai>=0.3.112,<0.4']
 dev = ["pytest>=7", "ruff>=0.5", "jsonschema>=4", "mypy>=1.8", "build>=1", "hypothesis>=6",
-       "rfc8785>=0.1.4", "sd-jwt>=0.10", 'inspect_ai>=0.3.112,<0.4; python_version >= "3.10"']
+       "rfc8785>=0.1.4", "sd-jwt>=0.10", 'inspect_ai>=0.3.112,<0.4']
 
 [project.urls]
 Homepage = "https://b7n0de.com"

{proofbundle-1.2.0 → proofbundle-1.4.0}/src/proofbundle/__init__.py

@@ -13,7 +13,7 @@ from __future__ import annotations
 
 from typing import TYPE_CHECKING
 
-__version__ = "1.2.0"
+__version__ = "1.4.0"
 
 __all__ = [
     "__version__",
@@ -26,6 +26,12 @@ __all__ = [
     "verify_inclusion",
     "verify_consistency",
     "verify_key_binding",
+    "verify_tlog_proof",
+    "verify_cosignature",
+    "verify_witnessed_checkpoint",
+    "verify_status_snapshot",
+    "receipt_token",
+    "verify_receipt_token",
     "VerificationResult",
     "Check",
     "ProofBundleError",
@@ -39,13 +45,23 @@ _LAZY = {
     "Check": ".errors", "ProofBundleError": ".errors", "VerificationResult": ".errors",
     "verify_consistency": ".merkle", "verify_inclusion": ".merkle",
     "verify_key_binding": ".kbjwt",
+    "verify_tlog_proof": ".tlogproof",
+    "verify_cosignature": ".checkpoint",
+    "verify_witnessed_checkpoint": ".checkpoint",
+    "verify_status_snapshot": ".statuslist",
+    "receipt_token": ".hf_evals",
+    "verify_receipt_token": ".hf_evals",
 }
 
 if TYPE_CHECKING:  # static analysers + IDEs see the real names/types; runtime stays lazy
     from .bundle import SCHEMA, load_bundle, recompute_merkle_root_b64, verify_bundle
     from .emit import emit_bundle, generate_signer
     from .errors import Check, ProofBundleError, VerificationResult
+    from .checkpoint import verify_cosignature, verify_witnessed_checkpoint
     from .kbjwt import verify_key_binding
+    from .hf_evals import receipt_token, verify_receipt_token
+    from .statuslist import verify_status_snapshot
+    from .tlogproof import verify_tlog_proof
     from .merkle import verify_consistency, verify_inclusion
 
 

{proofbundle-1.2.0 → proofbundle-1.4.0}/src/proofbundle/adapters/__init__.py

@@ -7,5 +7,7 @@ each fixture in tests/fixtures documents its source + version.
 from .inspect_ai import from_inspect_ai_log
 from .eee import from_eee_dataset
 from .lm_eval import from_lm_eval_results
+from .promptfoo import from_promptfoo_results
 
-__all__ = ["from_lm_eval_results", "from_inspect_ai_log", "from_eee_dataset"]
+__all__ = ["from_lm_eval_results", "from_inspect_ai_log", "from_eee_dataset",
+           "from_promptfoo_results"]

{proofbundle-1.2.0 → proofbundle-1.4.0}/src/proofbundle/adapters/lm_eval.py

@@ -50,7 +50,9 @@ def from_lm_eval_results(path, task: str, metric: str, *, comparator: str, thres
     if value is None:
         raise ValueError(f"metric {metric!r} not found in results[{task!r}] "
                          f"(available: {sorted(k for k in res if ',' in k)})")
-    score = value if isinstance(value, str) else repr(value)
+    # Fixed-point format (never scientific notation, e.g. '1e-05') — build_eval_claim rejects scientific
+    # notation, so repr() silently dropped legitimate small scores (release-review fix, mirrors v0.8.1).
+    score = value if isinstance(value, str) else (format(float(value), ".12f").rstrip("0").rstrip(".") or "0")
 
     n_samples = data.get("n-samples", {}).get(task, {})
     n = int(n_samples.get("effective") or n_samples.get("original") or res.get("sample_len") or 0)