proofbundle 1.3.0__tar.gz → 1.4.0__tar.gz

{proofbundle-1.3.0/src/proofbundle.egg-info → proofbundle-1.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofbundle
-Version: 1.3.0
+Version: 1.4.0
 Summary: Emit and verify portable cryptographic evidence bundles, offline: Ed25519 + RFC 6962 Merkle + optional SD-JWT.
 Author: Konrad Gruszka
 License: MIT
@@ -14,14 +14,13 @@ Classifier: Development Status :: 3 - Alpha
 Classifier: Intended Audience :: Developers
 Classifier: License :: OSI Approved :: MIT License
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: Security :: Cryptography
-Requires-Python: >=3.9
+Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: cryptography>=42
@@ -34,7 +33,7 @@ Requires-Dist: cryptography>=48; extra == "pq"
 Provides-Extra: pytest
 Requires-Dist: pytest>=7; extra == "pytest"
 Provides-Extra: inspect
-Requires-Dist: inspect_ai<0.4,>=0.3.112; python_version >= "3.10" and extra == "inspect"
+Requires-Dist: inspect_ai<0.4,>=0.3.112; extra == "inspect"
 Provides-Extra: dev
 Requires-Dist: pytest>=7; extra == "dev"
 Requires-Dist: ruff>=0.5; extra == "dev"
@@ -44,7 +43,7 @@ Requires-Dist: build>=1; extra == "dev"
 Requires-Dist: hypothesis>=6; extra == "dev"
 Requires-Dist: rfc8785>=0.1.4; extra == "dev"
 Requires-Dist: sd-jwt>=0.10; extra == "dev"
-Requires-Dist: inspect_ai<0.4,>=0.3.112; python_version >= "3.10" and extra == "dev"
+Requires-Dist: inspect_ai<0.4,>=0.3.112; extra == "dev"
 Dynamic: license-file
 
 <div align="center">
@@ -82,7 +81,7 @@ file, no server, no network.**
 
 **At a glance:** `proofbundle emit` signs and anchors a payload; `proofbundle
 verify` checks one self-contained `bundle.json` with three offline cryptographic
-checks → `OK` or `FAILED`. No network, no daemon, no own crypto. 188 tests + a CI mutation gate.
+checks → `OK` or `FAILED`. No network, no daemon, no own crypto. 209 tests + a CI mutation gate.
 
 ## Contents
 
@@ -159,12 +158,19 @@ A bundle is a single JSON document. `proofbundle` checks, offline:
    Certificate Transparency)
 3. **sd-jwt** (optional) — an embedded SD-JWT selective-disclosure credential is
    well formed, and if an issuer key is given, correctly issuer-signed
-4. **sd-jwt-key-binding** (optional, v1.2) — if the SD-JWT carries a Key Binding
-   JWT (RFC 9901 §4.3), it is verified **fail-closed**: `typ` is `kb+jwt`,
-   `iat`/`aud`/`nonce`/`sd_hash` are present, `sd_hash` binds the exact presented
-   disclosure set, and the signature verifies under the issuer-bound `cnf.jwk`
-   holder key. A present-but-broken KB-JWT fails the bundle — it is never
-   silently ignored.
+4. **sd-jwt-key-binding** (optional, v1.2; hardened v1.3) — proof-of-possession, **fail-closed**.
+   The check runs only once the issuer signature itself verified (an unauthenticated SD-JWT can
+   never report a valid holder binding). Then: `typ` is `kb+jwt`, `iat`/`aud`/`nonce`/`sd_hash` are
+   present, `sd_hash` binds the exact presented disclosure set, and the signature verifies under the
+   issuer-bound `cnf.jwk` holder key. A present-but-broken KB-JWT fails the bundle; and if the issuer
+   **bound** a `cnf` holder key but the presentation carries **no** KB-JWT, that fails too — stripping
+   the binding is a bearer downgrade, not a valid receipt. `verify --aud/--nonce` enforce RFC 9901
+   §7.3 audience/replay binding when the relying party supplies them.
+
+Beyond the single-file bundle, the library also verifies, all offline: a **witnessed C2SP checkpoint**
+(`verify_witnessed_checkpoint`, Ed25519 + post-quantum ML-DSA-44 cosignatures — the quorum counts distinct
+witness **keys**, not names, so one key under many names can never stuff a threshold), a **C2SP
+`.tlog-proof`** (`proofbundle verify-proof`), and a **Token Status List** revocation snapshot.
 
 The verifier treats the payload as opaque bytes. It proves that these exact
 bytes were signed and anchored, not what they mean. That is on purpose: it keeps
@@ -203,7 +209,7 @@ flowchart LR
 pip install proofbundle
 ```
 
-Requires Python 3.9+ and [`cryptography`](https://cryptography.io). Signature
+Requires Python 3.10+ and [`cryptography`](https://cryptography.io). Signature
 math is delegated to `cryptography`; this project never rolls its own crypto.
 The Merkle and SD-JWT logic is pure standard library.
 
@@ -480,7 +486,7 @@ threshold was met without revealing the model or the data. See [INTEROP.md](INTE
   [lm-evaluation-harness](https://github.com/EleutherAI/lm-evaluation-harness) `results_*.json` (the
   genuine `acc,none` filter-suffix format). **`proofbundle.adapters.from_eee_dataset`** (v0.9) reads an
   Every Eval Ever v0.2.2 aggregate JSON and builds a signed receipt — validated against the vendored EEE
-  schema, with **no runtime import** of `every_eval_ever` (it needs Python 3.12; proofbundle stays 3.9+).
+  schema, with **no runtime import** of `every_eval_ever` (it needs Python 3.12; proofbundle stays 3.10+).
 - **in-toto test-result export, DSSE-signed** (v0.9) — `proofbundle.intoto.export_intoto_dsse(claim,
   signer)` emits the receipt as a DSSE-signed in-toto Statement v1 with the **generic
   `test-result/v0.1` predicate** (result PASSED/FAILED, `configuration` ResourceDescriptors), so a generic
@@ -540,15 +546,23 @@ ISO/IEC DIS 24970), including the anti-patterns no one should claim.
   (RFC 9901 §4.3, fail-closed; closes #1) with `cnf.jwk` issuance and holder presentation, **C2SP
   tlog-cosignature** verification (Ed25519 cosignature/v1, witness quorum, split-view resistance), and
   `verify --verbose` with the recomputed Merkle root (closes #2).
-- **v1.3 (current release)** — the portable proof: **C2SP tlog-proof** emit/verify (+
+- **v1.3** — the portable proof: **C2SP tlog-proof** emit/verify (+
   `verify-proof` CLI), **ML-DSA-44** witness cosignatures (post-quantum, `[pq]` extra), **Token
   Status List** snapshot verification (offline revocation), SD-JWT VC markers (`dc+sd-jwt`,
   `vct`, `status`), COMPLIANCE.md (EU AI Act Art. 12 / NIST AI RMF mapping), and the mutation
   suite as a CI gate.
-- **Deferred** (explicitly not yet built) — full SD-JWT VC conformance + `vct` type-metadata
-  resolution (pre-IESG), per-sample Merkle receipts (the THREAT_MODEL's named gap; v2.0
-  direction), an official in-toto eval predicate (proposal path via OpenSSF/CoSAI), a full
-  in-toto client, a Python-3.10 floor.
+- **v1.4 (current release)** — distribution: a **promptfoo** adapter (results.json v3 →
+  pass_rate receipt), the **Hugging Face Community Evals bridge** (`pb1.` receipt tokens for the
+  `.eval_results` `verifyToken` field + a strict YAML entry emitter — proofbundle-verifiable,
+  explicitly NOT the HF-internal badge token), `hf-token` CLI, and the **Python 3.10+ floor**
+  (3.9 is EOL since 2025-10).
+- **v2.0 (next major, research differentiation)** — **per-sample Merkle receipts**: the payload carries a
+  Merkle root over *individual* sample results, so a verifier can force a random-sample re-check instead of
+  trusting only the reported aggregate. This is the THREAT_MODEL's one named structural gap ("forced random
+  sub-sampling"), and closing it is the road from *authorship* to *sampled correctness*.
+- **Deferred** (explicitly not yet built, stated honestly) — full SD-JWT VC conformance + `vct`
+  type-metadata resolution (pre-IESG), an official in-toto eval predicate (proposal path via
+  OpenSSF/CoSAI), and a full in-toto client.
 
 ## Contributing
 

{proofbundle-1.3.0 → proofbundle-1.4.0}/README.md

@@ -33,7 +33,7 @@ file, no server, no network.**
 
 **At a glance:** `proofbundle emit` signs and anchors a payload; `proofbundle
 verify` checks one self-contained `bundle.json` with three offline cryptographic
-checks → `OK` or `FAILED`. No network, no daemon, no own crypto. 188 tests + a CI mutation gate.
+checks → `OK` or `FAILED`. No network, no daemon, no own crypto. 209 tests + a CI mutation gate.
 
 ## Contents
 
@@ -110,12 +110,19 @@ A bundle is a single JSON document. `proofbundle` checks, offline:
    Certificate Transparency)
 3. **sd-jwt** (optional) — an embedded SD-JWT selective-disclosure credential is
    well formed, and if an issuer key is given, correctly issuer-signed
-4. **sd-jwt-key-binding** (optional, v1.2) — if the SD-JWT carries a Key Binding
-   JWT (RFC 9901 §4.3), it is verified **fail-closed**: `typ` is `kb+jwt`,
-   `iat`/`aud`/`nonce`/`sd_hash` are present, `sd_hash` binds the exact presented
-   disclosure set, and the signature verifies under the issuer-bound `cnf.jwk`
-   holder key. A present-but-broken KB-JWT fails the bundle — it is never
-   silently ignored.
+4. **sd-jwt-key-binding** (optional, v1.2; hardened v1.3) — proof-of-possession, **fail-closed**.
+   The check runs only once the issuer signature itself verified (an unauthenticated SD-JWT can
+   never report a valid holder binding). Then: `typ` is `kb+jwt`, `iat`/`aud`/`nonce`/`sd_hash` are
+   present, `sd_hash` binds the exact presented disclosure set, and the signature verifies under the
+   issuer-bound `cnf.jwk` holder key. A present-but-broken KB-JWT fails the bundle; and if the issuer
+   **bound** a `cnf` holder key but the presentation carries **no** KB-JWT, that fails too — stripping
+   the binding is a bearer downgrade, not a valid receipt. `verify --aud/--nonce` enforce RFC 9901
+   §7.3 audience/replay binding when the relying party supplies them.
+
+Beyond the single-file bundle, the library also verifies, all offline: a **witnessed C2SP checkpoint**
+(`verify_witnessed_checkpoint`, Ed25519 + post-quantum ML-DSA-44 cosignatures — the quorum counts distinct
+witness **keys**, not names, so one key under many names can never stuff a threshold), a **C2SP
+`.tlog-proof`** (`proofbundle verify-proof`), and a **Token Status List** revocation snapshot.
 
 The verifier treats the payload as opaque bytes. It proves that these exact
 bytes were signed and anchored, not what they mean. That is on purpose: it keeps
@@ -154,7 +161,7 @@ flowchart LR
 pip install proofbundle
 ```
 
-Requires Python 3.9+ and [`cryptography`](https://cryptography.io). Signature
+Requires Python 3.10+ and [`cryptography`](https://cryptography.io). Signature
 math is delegated to `cryptography`; this project never rolls its own crypto.
 The Merkle and SD-JWT logic is pure standard library.
 
@@ -431,7 +438,7 @@ threshold was met without revealing the model or the data. See [INTEROP.md](INTE
   [lm-evaluation-harness](https://github.com/EleutherAI/lm-evaluation-harness) `results_*.json` (the
   genuine `acc,none` filter-suffix format). **`proofbundle.adapters.from_eee_dataset`** (v0.9) reads an
   Every Eval Ever v0.2.2 aggregate JSON and builds a signed receipt — validated against the vendored EEE
-  schema, with **no runtime import** of `every_eval_ever` (it needs Python 3.12; proofbundle stays 3.9+).
+  schema, with **no runtime import** of `every_eval_ever` (it needs Python 3.12; proofbundle stays 3.10+).
 - **in-toto test-result export, DSSE-signed** (v0.9) — `proofbundle.intoto.export_intoto_dsse(claim,
   signer)` emits the receipt as a DSSE-signed in-toto Statement v1 with the **generic
   `test-result/v0.1` predicate** (result PASSED/FAILED, `configuration` ResourceDescriptors), so a generic
@@ -491,15 +498,23 @@ ISO/IEC DIS 24970), including the anti-patterns no one should claim.
   (RFC 9901 §4.3, fail-closed; closes #1) with `cnf.jwk` issuance and holder presentation, **C2SP
   tlog-cosignature** verification (Ed25519 cosignature/v1, witness quorum, split-view resistance), and
   `verify --verbose` with the recomputed Merkle root (closes #2).
-- **v1.3 (current release)** — the portable proof: **C2SP tlog-proof** emit/verify (+
+- **v1.3** — the portable proof: **C2SP tlog-proof** emit/verify (+
   `verify-proof` CLI), **ML-DSA-44** witness cosignatures (post-quantum, `[pq]` extra), **Token
   Status List** snapshot verification (offline revocation), SD-JWT VC markers (`dc+sd-jwt`,
   `vct`, `status`), COMPLIANCE.md (EU AI Act Art. 12 / NIST AI RMF mapping), and the mutation
   suite as a CI gate.
-- **Deferred** (explicitly not yet built) — full SD-JWT VC conformance + `vct` type-metadata
-  resolution (pre-IESG), per-sample Merkle receipts (the THREAT_MODEL's named gap; v2.0
-  direction), an official in-toto eval predicate (proposal path via OpenSSF/CoSAI), a full
-  in-toto client, a Python-3.10 floor.
+- **v1.4 (current release)** — distribution: a **promptfoo** adapter (results.json v3 →
+  pass_rate receipt), the **Hugging Face Community Evals bridge** (`pb1.` receipt tokens for the
+  `.eval_results` `verifyToken` field + a strict YAML entry emitter — proofbundle-verifiable,
+  explicitly NOT the HF-internal badge token), `hf-token` CLI, and the **Python 3.10+ floor**
+  (3.9 is EOL since 2025-10).
+- **v2.0 (next major, research differentiation)** — **per-sample Merkle receipts**: the payload carries a
+  Merkle root over *individual* sample results, so a verifier can force a random-sample re-check instead of
+  trusting only the reported aggregate. This is the THREAT_MODEL's one named structural gap ("forced random
+  sub-sampling"), and closing it is the road from *authorship* to *sampled correctness*.
+- **Deferred** (explicitly not yet built, stated honestly) — full SD-JWT VC conformance + `vct`
+  type-metadata resolution (pre-IESG), an official in-toto eval predicate (proposal path via
+  OpenSSF/CoSAI), and a full in-toto client.
 
 ## Contributing
 

{proofbundle-1.3.0 → proofbundle-1.4.0}/pyproject.toml

@@ -4,10 +4,10 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "proofbundle"
-version = "1.3.0"
+version = "1.4.0"
 description = "Emit and verify portable cryptographic evidence bundles, offline: Ed25519 + RFC 6962 Merkle + optional SD-JWT."
 readme = "README.md"
-requires-python = ">=3.9"
+requires-python = ">=3.10"
 license = { text = "MIT" }
 authors = [{ name = "Konrad Gruszka" }]
 keywords = [
@@ -26,7 +26,6 @@ classifiers = [
     "Intended Audience :: Developers",
     "License :: OSI Approved :: MIT License",
     "Programming Language :: Python :: 3",
-    "Programming Language :: Python :: 3.9",
     "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
@@ -56,11 +55,11 @@ pq = ["cryptography>=48"]
 pytest = ["pytest>=7"]
 # The inspect_ai adapter uses the STABLE read_eval_log API (lazy import). Pinned with an UPPER bound:
 # the .eval format + pydantic schema change between versions (inspect_ai issue 834), and the fixture
-# test is bound to this range. inspect_ai requires Python >= 3.10, so the marker gates it out on 3.9
-# (base + [eval]/[sdjwt] still work on 3.9; the inspect adapter test skips there). Fixes the red 3.9 CI.
-inspect = ['inspect_ai>=0.3.112,<0.4; python_version >= "3.10"']
+# test is bound to this range. Since v1.4.0 the project floor is Python 3.10, so no per-extra version
+# marker is needed here (inspect_ai's own >=3.10 requirement is always satisfiable on a supported base).
+inspect = ['inspect_ai>=0.3.112,<0.4']
 dev = ["pytest>=7", "ruff>=0.5", "jsonschema>=4", "mypy>=1.8", "build>=1", "hypothesis>=6",
-       "rfc8785>=0.1.4", "sd-jwt>=0.10", 'inspect_ai>=0.3.112,<0.4; python_version >= "3.10"']
+       "rfc8785>=0.1.4", "sd-jwt>=0.10", 'inspect_ai>=0.3.112,<0.4']
 
 [project.urls]
 Homepage = "https://b7n0de.com"

{proofbundle-1.3.0 → proofbundle-1.4.0}/src/proofbundle/__init__.py

@@ -13,7 +13,7 @@ from __future__ import annotations
 
 from typing import TYPE_CHECKING
 
-__version__ = "1.3.0"
+__version__ = "1.4.0"
 
 __all__ = [
     "__version__",
@@ -30,6 +30,8 @@ __all__ = [
     "verify_cosignature",
     "verify_witnessed_checkpoint",
     "verify_status_snapshot",
+    "receipt_token",
+    "verify_receipt_token",
     "VerificationResult",
     "Check",
     "ProofBundleError",
@@ -47,6 +49,8 @@ _LAZY = {
     "verify_cosignature": ".checkpoint",
     "verify_witnessed_checkpoint": ".checkpoint",
     "verify_status_snapshot": ".statuslist",
+    "receipt_token": ".hf_evals",
+    "verify_receipt_token": ".hf_evals",
 }
 
 if TYPE_CHECKING:  # static analysers + IDEs see the real names/types; runtime stays lazy
@@ -55,6 +59,7 @@ if TYPE_CHECKING:  # static analysers + IDEs see the real names/types; runtime s
     from .errors import Check, ProofBundleError, VerificationResult
     from .checkpoint import verify_cosignature, verify_witnessed_checkpoint
     from .kbjwt import verify_key_binding
+    from .hf_evals import receipt_token, verify_receipt_token
     from .statuslist import verify_status_snapshot
     from .tlogproof import verify_tlog_proof
     from .merkle import verify_consistency, verify_inclusion

{proofbundle-1.3.0 → proofbundle-1.4.0}/src/proofbundle/adapters/__init__.py

@@ -7,5 +7,7 @@ each fixture in tests/fixtures documents its source + version.
 from .inspect_ai import from_inspect_ai_log
 from .eee import from_eee_dataset
 from .lm_eval import from_lm_eval_results
+from .promptfoo import from_promptfoo_results
 
-__all__ = ["from_lm_eval_results", "from_inspect_ai_log", "from_eee_dataset"]
+__all__ = ["from_lm_eval_results", "from_inspect_ai_log", "from_eee_dataset",
+           "from_promptfoo_results"]

proofbundle-1.4.0/src/proofbundle/adapters/promptfoo.py

@@ -0,0 +1,131 @@
+"""Adapter for promptfoo `eval -o results.json` output (file-based, NO promptfoo import) — v1.4.
+
+Parses the exported OutputFile JSON only. Format verified 2026-07-02 against promptfoo `main`
+(`src/types/index.ts` OutputFile / EvaluateSummaryV3 / EvaluateStats, `src/util/output.ts`
+writeOutput): top level carries `evalId`, `results`, `config`, `metadata`; the current summary is
+**version 3** (`results.version == 3`) with whole-run aggregates in `results.stats` as
+`successes` / `failures` / `errors`. The metric emitted is **pass_rate** = successes / (successes
++ failures + errors), rendered as a fixed-point decimal string (the claim schema takes decimal
+strings, never floats).
+
+Version honesty: legacy files with `results.version` 1/2 have a different shape (`table` instead
+of `prompts`) and are REJECTED with a clear message rather than half-parsed; the "v4" storage
+version never appears in output files (they still say `version: 3`). Redaction flags
+(`PROMPTFOO_STRIP_*`) only affect prompt/response bodies — nothing this adapter reads.
+"""
+from __future__ import annotations
+
+import hashlib
+import json
+from decimal import Decimal
+from pathlib import Path
+from typing import Optional
+
+from ..evalclaim import build_eval_claim
+
+_SCALE = 6  # pass_rate decimal places — fixed-point, schema-conformant
+
+
+def _pass_rate(successes: int, failures: int, errors: int) -> "tuple[str, int]":
+    total = successes + failures + errors
+    if total <= 0:
+        raise ValueError("promptfoo results contain no test outcomes (stats all zero)")
+    rate = (Decimal(successes) / Decimal(total)).quantize(Decimal(1).scaleb(-_SCALE))
+    return f"{rate:.{_SCALE}f}", total
+
+
+def from_promptfoo_results(path, *, comparator: str, threshold: str, timestamp: str,
+                           model_salt: Optional[bytes] = None,
+                           dataset_salt: Optional[bytes] = None):
+    """Read a promptfoo results.json (summary v3) and build an eval claim over the run's
+    pass_rate. Returns (claim, salts).
+
+    - suite = `config.description` when present, else the `evalId` (the run's identity).
+    - model_id = the sorted, de-duplicated provider ids of the run (a promptfoo eval may span
+      several providers; the salted commitment pins the exact set).
+    - dataset_id = sha256 over the canonical JSON of `config.tests` AS RECORDED in results.json.
+      Inline tests bind the actual content (the suite IS the dataset); a `file://`/glob reference binds
+      the reference, not the resolved file content (an offline reader cannot resolve it) — provenance
+      records which case applies (`dataset_commitment_scope`) so the binding is never overstated.
+    - provenance: promptfooVersion, evalId, summary timestamp, per-outcome counts.
+    """
+    data = json.loads(Path(path).read_text(encoding="utf-8"))
+    if not isinstance(data, dict) or not isinstance(data.get("results"), dict):
+        raise ValueError("not a promptfoo output file (missing results object)")
+    summary = data["results"]
+    version = summary.get("version")
+    if version != 3:
+        raise ValueError(
+            f"unsupported promptfoo summary version {version!r} — this adapter parses the "
+            "current version 3 (legacy v1/v2 files use a different 'table' shape; re-export "
+            "with a current promptfoo)")
+    stats = summary.get("stats")
+    if not isinstance(stats, dict):
+        raise ValueError("promptfoo results.stats missing")
+    counts = {}
+    for key in ("successes", "failures", "errors"):
+        val = stats.get(key, 0)
+        if isinstance(val, bool) or not isinstance(val, int) or val < 0:
+            raise ValueError(f"promptfoo stats.{key} must be a non-negative integer")
+        counts[key] = val
+    score, n = _pass_rate(counts["successes"], counts["failures"], counts["errors"])
+
+    config = data.get("config") or {}
+    eval_id = data.get("evalId")
+    suite = str(config.get("description") or eval_id or "promptfoo-run")
+
+    # Commit to the providers that ACTUALLY produced a result in this run — not config.providers, which can
+    # list providers that never ran (e.g. --filter-providers). Only fall back to config.providers if the
+    # summary recorded no per-result provider at all (release-review fix).
+    providers = set()
+    for res in summary.get("results", []):
+        prov = (res or {}).get("provider")
+        if isinstance(prov, dict) and prov.get("id"):
+            providers.add(str(prov["id"]))
+        elif isinstance(prov, str):
+            providers.add(prov)
+    if not providers:
+        for prov in config.get("providers") or []:
+            if isinstance(prov, str):
+                providers.add(prov)
+            elif isinstance(prov, dict) and prov.get("id"):
+                providers.add(str(prov["id"]))
+    model_id = "+".join(sorted(providers)) if providers else "unknown:promptfoo-provider"
+
+    tests = config.get("tests")
+    tests_canonical = json.dumps(tests, sort_keys=True, separators=(",", ":")) if tests else ""
+    dataset_id = ("promptfoo-tests-sha256:"
+                  + hashlib.sha256(tests_canonical.encode("utf-8")).hexdigest())
+    # HONESTY (release-review): the commitment is over `config.tests` AS RECORDED in results.json. When tests are
+    # INLINE, that is the content (the suite IS the dataset). When they are a `file://`/glob REFERENCE — whether a
+    # top-level string, a list containing a string, OR a `file://` nested inside an inline test's vars/assert —
+    # promptfoo records the unresolved reference, so the commitment binds the reference, NOT the file content
+    # (an offline reader cannot resolve external files). When there are NO tests at all the commitment is over the
+    # empty string and binds nothing. We label each case so a verifier is never misled that content was bound.
+    tests_by_reference = isinstance(tests, str) or (
+        isinstance(tests, list) and any(isinstance(t, str) for t in tests)) or ("file://" in tests_canonical)
+    if not tests:
+        commitment_scope = "config.tests_absent"
+    elif tests_by_reference:
+        commitment_scope = "config.tests_reference_only"
+    else:
+        commitment_scope = "config.tests_inline_content"
+
+    metadata = data.get("metadata") or {}
+    provenance = {"harness": "promptfoo",
+                  "successes": str(counts["successes"]), "failures": str(counts["failures"]),
+                  "errors": str(counts["errors"]),
+                  "pass_rate_formula": "successes/(successes+failures+errors)",
+                  "dataset_commitment_scope": commitment_scope}
+    if eval_id:
+        provenance["eval_id"] = str(eval_id)
+    if metadata.get("promptfooVersion"):
+        provenance["promptfoo_version"] = str(metadata["promptfooVersion"])
+    if summary.get("timestamp"):
+        provenance["run_timestamp"] = str(summary["timestamp"])
+
+    return build_eval_claim(
+        suite=suite, suite_version=f"promptfoo-summary-v{version}",
+        metric="pass_rate", comparator=comparator, threshold=threshold, score=score, n=n,
+        model_id=model_id, dataset_id=dataset_id, issuer="", timestamp=timestamp,
+        provenance=provenance, model_salt=model_salt, dataset_salt=dataset_salt)

{proofbundle-1.3.0 → proofbundle-1.4.0}/src/proofbundle/cli.py

@@ -155,6 +155,28 @@ def _cmd_verify_proof(args: argparse.Namespace) -> int:
     return 0 if res["ok"] else 1
 
 
+def _cmd_hf_token(args: argparse.Namespace) -> int:
+    from .bundle import load_bundle  # noqa: PLC0415
+    from .hf_evals import receipt_token, verify_receipt_token  # noqa: PLC0415
+    try:
+        if args.verify:
+            token = args.bundle_or_token
+            if token.endswith(".txt") or "/" in token:
+                with open(token, encoding="utf-8") as handle:
+                    token = handle.read().strip()
+            result, _bundle = verify_receipt_token(token)
+            for check in result.checks:
+                print(str(check))
+            print("=> OK" if result.ok else "=> FAILED")
+            return 0 if result.ok else 1
+        token = receipt_token(load_bundle(args.bundle_or_token))
+        print(token)
+        return 0
+    except (ProofBundleError, OSError, ValueError) as exc:   # file/JSON/format errors → clean exit
+        print(f"ERROR: {exc}", file=sys.stderr)
+        return 2
+
+
 def build_parser() -> argparse.ArgumentParser:
     parser = argparse.ArgumentParser(
         prog="proofbundle",
@@ -207,6 +229,15 @@ def build_parser() -> argparse.ArgumentParser:
     verify_proof.add_argument("--json", action="store_true", help="machine readable output")
     verify_proof.set_defaults(func=_cmd_verify_proof)
 
+    hf_token = sub.add_parser(
+        "hf-token",
+        help="pack a receipt into a pb1. token for HF eval_results, or verify one (v1.4)")
+    hf_token.add_argument("bundle_or_token",
+                          help="bundle JSON path (emit) or pb1. token / token file (--verify)")
+    hf_token.add_argument("--verify", action="store_true",
+                          help="verify a pb1. token instead of emitting one")
+    hf_token.set_defaults(func=_cmd_hf_token)
+
     return parser
 
 

proofbundle-1.4.0/src/proofbundle/hf_evals.py

@@ -0,0 +1,185 @@
+"""Hugging Face Community Evals bridge — receipt tokens + `.eval_results/*.yaml` entries (v1.4).
+
+HF Community Evals (Feb 2026, beta) lets anyone PR benchmark results into a model repo as
+`.eval_results/*.yaml`; entries carry an optional, string-typed ``verifyToken`` documented as "a
+signature that can be used to prove that evaluation is provably auditable and reproducible".
+Schema verified 2026-07-02 against hub-docs (`eval_results.yaml` spec + docs page).
+
+**Honesty first — what this module does and does not claim.** The Hub's own "verified" badge is
+granted by HF **server-side** (currently: evaluation ran in HF Jobs with inspect-ai); the token
+format HF validates is not publicly specified. proofbundle therefore does NOT fabricate an
+HF-validated token. It defines its own self-describing, offline-verifiable token profile —
+
+    ``pb1.`` + base64url(zlib(bundle JSON))
+
+— which any third party (and, should they choose, HF) can verify with `verify_receipt_token`:
+the full receipt travels inside the token, so verification is exactly `verify_bundle`, offline.
+Putting it in the schema-valid `verifyToken` field makes the result *proofbundle-verifiable*;
+it does not and must not be presented as HF-endorsed. The docs and `to_eval_results_entry` keep
+that distinction explicit (the receipt link belongs in `source.url` / `notes` either way).
+"""
+
+from __future__ import annotations
+
+import base64
+import json
+import math
+import zlib
+from typing import Optional, Tuple
+
+from .bundle import verify_bundle
+from .errors import BundleFormatError, UnsupportedError, VerificationResult
+
+__all__ = ["TOKEN_PREFIX", "receipt_token", "verify_receipt_token",
+           "to_eval_results_entry", "eval_results_yaml"]
+
+TOKEN_PREFIX = "pb1."
+_MAX_TOKEN_BYTES = 262_144   # 256 KiB decompressed cap — a receipt is a few KB; refuse zip bombs
+
+
+def _b64url(data: bytes) -> str:
+    return base64.urlsafe_b64encode(data).rstrip(b"=").decode("ascii")
+
+
+def _b64url_decode(s: str) -> bytes:
+    raw = s.encode("ascii")
+    return base64.urlsafe_b64decode(raw + b"=" * (-len(raw) % 4))
+
+
+def receipt_token(bundle: dict) -> str:
+    """Pack a receipt bundle into a compact, self-contained token: ``pb1.`` +
+    base64url(zlib(canonical bundle JSON)). The token IS the receipt — verifying it is verifying
+    the bundle, offline, no lookup."""
+    if not isinstance(bundle, dict) or "payload_b64" not in bundle:
+        raise BundleFormatError("receipt_token needs a bundle dict")
+    canonical = json.dumps(bundle, sort_keys=True, separators=(",", ":")).encode("utf-8")
+    return TOKEN_PREFIX + _b64url(zlib.compress(canonical, 9))
+
+
+def verify_receipt_token(token: str) -> Tuple[VerificationResult, Optional[dict]]:
+    """Unpack and verify a ``pb1.`` receipt token. Returns (VerificationResult, bundle_dict).
+    Malformed tokens raise BundleFormatError — never a crash, never a silent pass."""
+    if not isinstance(token, str) or not token.startswith(TOKEN_PREFIX):
+        raise BundleFormatError(f"not a proofbundle receipt token (expected {TOKEN_PREFIX!r} prefix)")
+    try:
+        decomp = zlib.decompressobj()
+        raw = decomp.decompress(_b64url_decode(token[len(TOKEN_PREFIX):]), _MAX_TOKEN_BYTES)
+        if decomp.unconsumed_tail:
+            raise BundleFormatError("receipt token exceeds the decompression cap")
+        bundle = json.loads(raw)
+    except BundleFormatError:
+        raise
+    except (ValueError, TypeError, zlib.error) as exc:
+        raise BundleFormatError("receipt token is not valid base64url(zlib(JSON))") from exc
+    if not isinstance(bundle, dict):
+        raise BundleFormatError("receipt token does not contain a bundle object")
+    # Normalize an unsupported schema/alg to BundleFormatError so the documented contract holds — a malformed
+    # token never escapes as a different exception type (release-review fix).
+    try:
+        return verify_bundle(bundle), bundle
+    except UnsupportedError as exc:
+        raise BundleFormatError(f"receipt token bundle uses an unsupported schema/algorithm: {exc}") from exc
+
+
+def to_eval_results_entry(bundle: dict, *, dataset_id: str, task_id: str, value,
+                          date: Optional[str] = None, source_url: Optional[str] = None,
+                          source_name: Optional[str] = None, source_user: Optional[str] = None,
+                          notes: Optional[str] = None, include_token: bool = True,
+                          require_verified: bool = True) -> dict:
+    """Build one HF `.eval_results/*.yaml` entry for a receipt.
+
+    ``dataset_id``/``task_id`` name the Hub benchmark (per its `eval.yaml`); ``value`` is the
+    REQUIRED metric number — the caller chooses what to disclose (a receipt may withhold the
+    exact score via SD-JWT; publishing a value here IS a disclosure decision).
+
+    No-Fake guard: with ``require_verified=True`` (default) the bundle must verify NOW — an entry
+    is never generated from a broken receipt. ``include_token=True`` puts the ``pb1.`` token in
+    ``verifyToken`` (schema-valid, proofbundle-verifiable; NOT the HF-internal badge token — HF's
+    "verified" badge is HF's server-side decision, and this module makes no claim about it).
+    """
+    if require_verified:
+        result = verify_bundle(bundle)
+        if not result.ok:
+            raise BundleFormatError(
+                "refusing to build an eval_results entry from a bundle that does not verify: "
+                + "; ".join(f"{c.name}: {c.detail}" for c in result.checks if not c.ok))
+    if not dataset_id or not task_id:
+        raise BundleFormatError("dataset_id and task_id are required (the Hub benchmark identity)")
+    if isinstance(value, bool) or not isinstance(value, (int, float, str)):
+        raise BundleFormatError("value must be a number (or numeric string)")
+    # Reject non-numeric strings AND non-finite values (release-review fix): inf/-inf/nan (whether a float or a
+    # string like '1e400'/'nan' that float() accepts) would serialize to the non-standard tokens Infinity/NaN —
+    # neither valid JSON nor unambiguous YAML — so an eval_results.yaml value must be a FINITE number.
+    try:
+        numeric = float(value)
+    except (ValueError, TypeError, OverflowError) as exc:   # OverflowError: an int beyond float range
+        raise BundleFormatError(f"value {value!r} is not a representable finite number") from exc
+    if not math.isfinite(numeric):
+        raise BundleFormatError(
+            "value must be a finite number — inf/-inf/nan cannot be represented in eval_results.yaml")
+
+    entry: dict = {"dataset": {"id": dataset_id, "task_id": task_id},
+                   "value": numeric if isinstance(value, str) else value}
+    if include_token:
+        entry["verifyToken"] = receipt_token(bundle)
+    if date is not None:
+        entry["date"] = date
+    source = {}
+    if source_url:
+        source["url"] = source_url
+    if source_name:
+        source["name"] = source_name
+    if source_user:
+        source["user"] = source_user
+    if source:
+        if "url" not in source:
+            raise BundleFormatError("source.url is required when a source is given (HF schema)")
+        entry["source"] = source
+    if notes is not None:
+        entry["notes"] = notes
+    return entry
+
+
+def _yaml_scalar(value) -> str:
+    """Serialize one scalar for the entry YAML. Strings are always double-quoted (JSON-style
+    escaping is valid YAML), so dates stay strings and tokens survive any special characters."""
+    if isinstance(value, bool):
+        return "true" if value else "false"
+    if isinstance(value, (int, float)):
+        return json.dumps(value)
+    return json.dumps(str(value))
+
+
+def eval_results_yaml(entries) -> str:
+    """Render entries as a `.eval_results/*.yaml` document (block style, deterministic key
+    order per the HF spec example). Only the known, shallow schema is emitted — this is a
+    purpose-built serializer, not a general YAML writer."""
+    order = ("dataset", "value", "verifyToken", "date", "source", "notes")
+    dataset_order = ("id", "task_id", "revision")
+    source_order = ("url", "name", "user")   # HF hub-docs spec fields (no 'org' — 'user' covers the HF org/user)
+    lines = []
+    for entry in entries:
+        unknown = set(entry) - set(order)
+        if unknown:
+            raise BundleFormatError(f"unknown eval_results entry field(s): {sorted(unknown)}")
+        first = True
+        for key in order:
+            if key not in entry:
+                continue
+            prefix = "- " if first else "  "
+            first = False
+            val = entry[key]
+            if key in ("dataset", "source"):
+                sub_order = dataset_order if key == "dataset" else source_order
+                # fail-loud on unknown nested keys too (symmetric with the top-level check) — a dropped field
+                # would silently omit data from the published entry (release-review fix).
+                sub_unknown = set(val) - set(sub_order)
+                if sub_unknown:
+                    raise BundleFormatError(f"unknown {key} field(s): {sorted(sub_unknown)}")
+                lines.append(f"{prefix}{key}:")
+                for sub in sub_order:
+                    if sub in val:
+                        lines.append(f"    {sub}: {_yaml_scalar(val[sub])}")
+            else:
+                lines.append(f"{prefix}{key}: {_yaml_scalar(val)}")
+    return "\n".join(lines) + "\n"