proofbundle 1.3.0__tar.gz → 1.7.0__tar.gz

{proofbundle-1.3.0/src/proofbundle.egg-info → proofbundle-1.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofbundle
-Version: 1.3.0
+Version: 1.7.0
 Summary: Emit and verify portable cryptographic evidence bundles, offline: Ed25519 + RFC 6962 Merkle + optional SD-JWT.
 Author: Konrad Gruszka
 License: MIT
@@ -10,18 +10,17 @@ Project-URL: Issues, https://github.com/b7n0de/proofbundle/issues
 Project-URL: Changelog, https://github.com/b7n0de/proofbundle/blob/main/CHANGELOG.md
 Project-URL: Documentation, https://github.com/b7n0de/proofbundle#readme
 Keywords: cryptography,merkle,transparency-log,ed25519,sd-jwt,verifiable-credentials,attestation,provenance,rfc6962
-Classifier: Development Status :: 3 - Alpha
+Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Developers
 Classifier: License :: OSI Approved :: MIT License
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: Security :: Cryptography
-Requires-Python: >=3.9
+Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: cryptography>=42
@@ -34,7 +33,7 @@ Requires-Dist: cryptography>=48; extra == "pq"
 Provides-Extra: pytest
 Requires-Dist: pytest>=7; extra == "pytest"
 Provides-Extra: inspect
-Requires-Dist: inspect_ai<0.4,>=0.3.112; python_version >= "3.10" and extra == "inspect"
+Requires-Dist: inspect_ai<0.4,>=0.3.112; extra == "inspect"
 Provides-Extra: dev
 Requires-Dist: pytest>=7; extra == "dev"
 Requires-Dist: ruff>=0.5; extra == "dev"
@@ -44,7 +43,7 @@ Requires-Dist: build>=1; extra == "dev"
 Requires-Dist: hypothesis>=6; extra == "dev"
 Requires-Dist: rfc8785>=0.1.4; extra == "dev"
 Requires-Dist: sd-jwt>=0.10; extra == "dev"
-Requires-Dist: inspect_ai<0.4,>=0.3.112; python_version >= "3.10" and extra == "dev"
+Requires-Dist: inspect_ai<0.4,>=0.3.112; extra == "dev"
 Dynamic: license-file
 
 <div align="center">
@@ -64,13 +63,16 @@ revocation snapshots, aligned to the in-toto test-result predicate. One portable
 file, no server, no network.**
 
 [![CI](https://github.com/b7n0de/proofbundle/actions/workflows/ci.yml/badge.svg)](https://github.com/b7n0de/proofbundle/actions/workflows/ci.yml)
+[![License: MIT](https://img.shields.io/badge/license-MIT-D6248A.svg)](LICENSE)
+[![Ruff](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/ruff/main/assets/badge/v2.json)](https://github.com/astral-sh/ruff)
+<!-- Badges below are enabled AFTER the first PyPI release (they render broken/false before it,
+     which reads as abandonment). Un-comment on first publish — see RELEASE.md:
 [![PyPI](https://img.shields.io/pypi/v/proofbundle.svg?color=D6248A&cacheSeconds=3600)](https://pypi.org/project/proofbundle/)
 [![Python](https://img.shields.io/pypi/pyversions/proofbundle.svg?color=D6248A&cacheSeconds=3600)](https://pypi.org/project/proofbundle/)
 [![Downloads](https://static.pepy.tech/badge/proofbundle)](https://pepy.tech/project/proofbundle)
-[![License: MIT](https://img.shields.io/badge/license-MIT-D6248A.svg)](LICENSE)
-[![Ruff](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/ruff/main/assets/badge/v2.json)](https://github.com/astral-sh/ruff)
 [![SLSA build provenance](https://img.shields.io/badge/SLSA-build_provenance-D6248A.svg)](https://slsa.dev)
 [![PyPI attestations](https://img.shields.io/badge/PyPI-attestations_(PEP_740)-D6248A.svg)](https://pypi.org/project/proofbundle/)
+-->
 [![Post-quantum witnesses](https://img.shields.io/badge/PQ-ML--DSA--44_cosignatures-D6248A.svg)](https://github.com/C2SP/C2SP/blob/main/tlog-cosignature.md)
 [![Mutation tested](https://img.shields.io/badge/tests-mutation_gated-D6248A.svg)](scripts/mutation_check.py)
 [![C2SP tlog-proof](https://img.shields.io/badge/C2SP-tlog--proof-D6248A.svg)](https://github.com/C2SP/C2SP/blob/main/tlog-proof.md)
@@ -82,7 +84,7 @@ file, no server, no network.**
 
 **At a glance:** `proofbundle emit` signs and anchors a payload; `proofbundle
 verify` checks one self-contained `bundle.json` with three offline cryptographic
-checks → `OK` or `FAILED`. No network, no daemon, no own crypto. 188 tests + a CI mutation gate.
+checks → `OK` or `FAILED`. No network, no daemon, no own crypto. 257 tests + a CI mutation gate.
 
 ## Contents
 
@@ -147,6 +149,8 @@ not a proof that the number is *true* or that the evaluation was well designed.
 | `reproduced` | independently re-run and matched |
 | `enclave_attested` | produced in an attested trusted execution environment |
 
+Since v1.6 `decode_eval_claim(bundle, expected_context=...)` enforces the signed `context_binding` (cross-context replay guard), and verify-side re-checks the `samples.n == n` invariant — guarantees no longer live only in the emitter.
+
 Full detail: **[THREAT_MODEL.md](THREAT_MODEL.md)** — what `verify` catches and what it structurally cannot.
 
 ## What it verifies
@@ -159,12 +163,19 @@ A bundle is a single JSON document. `proofbundle` checks, offline:
    Certificate Transparency)
 3. **sd-jwt** (optional) — an embedded SD-JWT selective-disclosure credential is
    well formed, and if an issuer key is given, correctly issuer-signed
-4. **sd-jwt-key-binding** (optional, v1.2) — if the SD-JWT carries a Key Binding
-   JWT (RFC 9901 §4.3), it is verified **fail-closed**: `typ` is `kb+jwt`,
-   `iat`/`aud`/`nonce`/`sd_hash` are present, `sd_hash` binds the exact presented
-   disclosure set, and the signature verifies under the issuer-bound `cnf.jwk`
-   holder key. A present-but-broken KB-JWT fails the bundle — it is never
-   silently ignored.
+4. **sd-jwt-key-binding** (optional, v1.2; hardened v1.3) — proof-of-possession, **fail-closed**.
+   The check runs only once the issuer signature itself verified (an unauthenticated SD-JWT can
+   never report a valid holder binding). Then: `typ` is `kb+jwt`, `iat`/`aud`/`nonce`/`sd_hash` are
+   present, `sd_hash` binds the exact presented disclosure set, and the signature verifies under the
+   issuer-bound `cnf.jwk` holder key. A present-but-broken KB-JWT fails the bundle; and if the issuer
+   **bound** a `cnf` holder key but the presentation carries **no** KB-JWT, that fails too — stripping
+   the binding is a bearer downgrade, not a valid receipt. `verify --aud/--nonce` enforce RFC 9901
+   §7.3 audience/replay binding when the relying party supplies them.
+
+Beyond the single-file bundle, the library also verifies, all offline: a **witnessed C2SP checkpoint**
+(`verify_witnessed_checkpoint`, Ed25519 + post-quantum ML-DSA-44 cosignatures — the quorum counts distinct
+witness **keys**, not names, so one key under many names can never stuff a threshold), a **C2SP
+`.tlog-proof`** (`proofbundle verify-proof`), and a **Token Status List** revocation snapshot.
 
 The verifier treats the payload as opaque bytes. It proves that these exact
 bytes were signed and anchored, not what they mean. That is on purpose: it keeps
@@ -203,7 +214,7 @@ flowchart LR
 pip install proofbundle
 ```
 
-Requires Python 3.9+ and [`cryptography`](https://cryptography.io). Signature
+Requires Python 3.10+ and [`cryptography`](https://cryptography.io). Signature
 math is delegated to `cryptography`; this project never rolls its own crypto.
 The Merkle and SD-JWT logic is pure standard library.
 
@@ -217,7 +228,7 @@ pip install "proofbundle[sdjwt]"
 ## Quickstart
 
 ```bash
-# generate a real example bundle with throwaway keys
+# from a git checkout (examples/ ships in the repo, not the wheel):
 python examples/make_example.py
 
 # verify it
@@ -228,6 +239,15 @@ proofbundle verify examples/example_bundle.json
 <img src="assets/demo.svg" alt="proofbundle verify output: PASS checks and OK" width="680">
 </div>
 
+See the whole trust story in five seconds — pip-only, offline, in memory (honest receipt verifies, six tampers fail, a swapped sample is caught):
+
+```bash
+pip install proofbundle
+proofbundle demo
+```
+
+Full walkthrough incl. the forced-random-sample audit: **[docs/DEMO.md](docs/DEMO.md)**.
+
 Machine-readable output and a non-zero exit code on failure:
 
 ```bash
@@ -321,7 +341,7 @@ Since v1.2 proofbundle also speaks the witness layer:
 (Ed25519 cosignature/v1) — `verify_witnessed_checkpoint` checks a checkpoint is
 both log-signed **and** cosigned by a quorum of distinct witnesses, offline,
 which rules out a split view by the log operator. This is the same
-witnessed-checkpoint pattern Rekor v2 (GA October 2025) institutionalizes.
+witnessed-checkpoint pattern Rekor v2 (GA October 2025) is integrating.
 
 Since v1.3 the witness layer is complete: **ML-DSA-44 cosignatures** (C2SP type
 0x06, FIPS 204 — post-quantum, the spec's SHOULD for new witness deployments;
@@ -480,7 +500,7 @@ threshold was met without revealing the model or the data. See [INTEROP.md](INTE
   [lm-evaluation-harness](https://github.com/EleutherAI/lm-evaluation-harness) `results_*.json` (the
   genuine `acc,none` filter-suffix format). **`proofbundle.adapters.from_eee_dataset`** (v0.9) reads an
   Every Eval Ever v0.2.2 aggregate JSON and builds a signed receipt — validated against the vendored EEE
-  schema, with **no runtime import** of `every_eval_ever` (it needs Python 3.12; proofbundle stays 3.9+).
+  schema, with **no runtime import** of `every_eval_ever` (it needs Python 3.12; proofbundle stays 3.10+).
 - **in-toto test-result export, DSSE-signed** (v0.9) — `proofbundle.intoto.export_intoto_dsse(claim,
   signer)` emits the receipt as a DSSE-signed in-toto Statement v1 with the **generic
   `test-result/v0.1` predicate** (result PASSED/FAILED, `configuration` ResourceDescriptors), so a generic
@@ -540,15 +560,33 @@ ISO/IEC DIS 24970), including the anti-patterns no one should claim.
   (RFC 9901 §4.3, fail-closed; closes #1) with `cnf.jwk` issuance and holder presentation, **C2SP
   tlog-cosignature** verification (Ed25519 cosignature/v1, witness quorum, split-view resistance), and
   `verify --verbose` with the recomputed Merkle root (closes #2).
-- **v1.3 (current release)** — the portable proof: **C2SP tlog-proof** emit/verify (+
+- **v1.3** — the portable proof: **C2SP tlog-proof** emit/verify (+
   `verify-proof` CLI), **ML-DSA-44** witness cosignatures (post-quantum, `[pq]` extra), **Token
   Status List** snapshot verification (offline revocation), SD-JWT VC markers (`dc+sd-jwt`,
   `vct`, `status`), COMPLIANCE.md (EU AI Act Art. 12 / NIST AI RMF mapping), and the mutation
   suite as a CI gate.
-- **Deferred** (explicitly not yet built) — full SD-JWT VC conformance + `vct` type-metadata
-  resolution (pre-IESG), per-sample Merkle receipts (the THREAT_MODEL's named gap; v2.0
-  direction), an official in-toto eval predicate (proposal path via OpenSSF/CoSAI), a full
-  in-toto client, a Python-3.10 floor.
+- **v1.4** — distribution: a **promptfoo** adapter (results.json v3 →
+  pass_rate receipt), the **Hugging Face Community Evals bridge** (`pb1.` receipt tokens for the
+  `.eval_results` `verifyToken` field + a strict YAML entry emitter — proofbundle-verifiable,
+  explicitly NOT the HF-internal badge token), `hf-token` CLI, and the **Python 3.10+ floor**
+  (3.9 is EOL since 2025-10).
+- **v1.5** — per-sample receipts: a signed **Merkle commitment over every
+  individual sample** (`samples` claim field, SPEC §7g), salted per-leaf disclosures (RFC 9901
+  mechanic), **sample openings** with replay guards, and a **spot-check audit protocol**
+  (`audit-challenge` / `verify-opening` CLI; auditor-nonce, beacon, and documented-grindable
+  self-challenge modes; PoR soundness 1−(1−m)^k) — narrowing the THREAT_MODEL's sub-sampling gap.
+  Extractors for lm-eval `--log_samples` JSONL and promptfoo rows.
+- **v1.6** — external principal-security review fixes: verify-side sample/`leaf_alg`/root invariants
+  and signed `context_binding` enforcement (was signed but unchecked), status-list freshness
+  (`exp`/`ttl` None-safe), `merkle.hash_alg` now required; Beta classifier; 26-operator mutation gate.
+- **v1.6.1** — developer experience: `proofbundle demo` (pip-only, fail-closed tamper smoke test), a
+  runnable per-sample example, `docs/DEMO.md`.
+- **v1.7 (current release)** — release supply-chain hardening: `release.yml` builds once and
+  publishes the **attested** bytes (sha256 gate: attested == published), a reviewer-gated `pypi`
+  environment, least-privilege permissions, SHA-pinned actions, `RELEASE.md` + `docs/REVIEWERS.md`.
+- **Deferred** (explicitly not yet built, stated honestly) — full SD-JWT VC conformance + `vct`
+  type-metadata resolution (pre-IESG), an official in-toto eval predicate (proposal path via
+  OpenSSF/CoSAI), and a full in-toto client.
 
 ## Contributing
 

{proofbundle-1.3.0 → proofbundle-1.7.0}/README.md

@@ -15,13 +15,16 @@ revocation snapshots, aligned to the in-toto test-result predicate. One portable
 file, no server, no network.**
 
 [![CI](https://github.com/b7n0de/proofbundle/actions/workflows/ci.yml/badge.svg)](https://github.com/b7n0de/proofbundle/actions/workflows/ci.yml)
+[![License: MIT](https://img.shields.io/badge/license-MIT-D6248A.svg)](LICENSE)
+[![Ruff](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/ruff/main/assets/badge/v2.json)](https://github.com/astral-sh/ruff)
+<!-- Badges below are enabled AFTER the first PyPI release (they render broken/false before it,
+     which reads as abandonment). Un-comment on first publish — see RELEASE.md:
 [![PyPI](https://img.shields.io/pypi/v/proofbundle.svg?color=D6248A&cacheSeconds=3600)](https://pypi.org/project/proofbundle/)
 [![Python](https://img.shields.io/pypi/pyversions/proofbundle.svg?color=D6248A&cacheSeconds=3600)](https://pypi.org/project/proofbundle/)
 [![Downloads](https://static.pepy.tech/badge/proofbundle)](https://pepy.tech/project/proofbundle)
-[![License: MIT](https://img.shields.io/badge/license-MIT-D6248A.svg)](LICENSE)
-[![Ruff](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/ruff/main/assets/badge/v2.json)](https://github.com/astral-sh/ruff)
 [![SLSA build provenance](https://img.shields.io/badge/SLSA-build_provenance-D6248A.svg)](https://slsa.dev)
 [![PyPI attestations](https://img.shields.io/badge/PyPI-attestations_(PEP_740)-D6248A.svg)](https://pypi.org/project/proofbundle/)
+-->
 [![Post-quantum witnesses](https://img.shields.io/badge/PQ-ML--DSA--44_cosignatures-D6248A.svg)](https://github.com/C2SP/C2SP/blob/main/tlog-cosignature.md)
 [![Mutation tested](https://img.shields.io/badge/tests-mutation_gated-D6248A.svg)](scripts/mutation_check.py)
 [![C2SP tlog-proof](https://img.shields.io/badge/C2SP-tlog--proof-D6248A.svg)](https://github.com/C2SP/C2SP/blob/main/tlog-proof.md)
@@ -33,7 +36,7 @@ file, no server, no network.**
 
 **At a glance:** `proofbundle emit` signs and anchors a payload; `proofbundle
 verify` checks one self-contained `bundle.json` with three offline cryptographic
-checks → `OK` or `FAILED`. No network, no daemon, no own crypto. 188 tests + a CI mutation gate.
+checks → `OK` or `FAILED`. No network, no daemon, no own crypto. 257 tests + a CI mutation gate.
 
 ## Contents
 
@@ -98,6 +101,8 @@ not a proof that the number is *true* or that the evaluation was well designed.
 | `reproduced` | independently re-run and matched |
 | `enclave_attested` | produced in an attested trusted execution environment |
 
+Since v1.6 `decode_eval_claim(bundle, expected_context=...)` enforces the signed `context_binding` (cross-context replay guard), and verify-side re-checks the `samples.n == n` invariant — guarantees no longer live only in the emitter.
+
 Full detail: **[THREAT_MODEL.md](THREAT_MODEL.md)** — what `verify` catches and what it structurally cannot.
 
 ## What it verifies
@@ -110,12 +115,19 @@ A bundle is a single JSON document. `proofbundle` checks, offline:
    Certificate Transparency)
 3. **sd-jwt** (optional) — an embedded SD-JWT selective-disclosure credential is
    well formed, and if an issuer key is given, correctly issuer-signed
-4. **sd-jwt-key-binding** (optional, v1.2) — if the SD-JWT carries a Key Binding
-   JWT (RFC 9901 §4.3), it is verified **fail-closed**: `typ` is `kb+jwt`,
-   `iat`/`aud`/`nonce`/`sd_hash` are present, `sd_hash` binds the exact presented
-   disclosure set, and the signature verifies under the issuer-bound `cnf.jwk`
-   holder key. A present-but-broken KB-JWT fails the bundle — it is never
-   silently ignored.
+4. **sd-jwt-key-binding** (optional, v1.2; hardened v1.3) — proof-of-possession, **fail-closed**.
+   The check runs only once the issuer signature itself verified (an unauthenticated SD-JWT can
+   never report a valid holder binding). Then: `typ` is `kb+jwt`, `iat`/`aud`/`nonce`/`sd_hash` are
+   present, `sd_hash` binds the exact presented disclosure set, and the signature verifies under the
+   issuer-bound `cnf.jwk` holder key. A present-but-broken KB-JWT fails the bundle; and if the issuer
+   **bound** a `cnf` holder key but the presentation carries **no** KB-JWT, that fails too — stripping
+   the binding is a bearer downgrade, not a valid receipt. `verify --aud/--nonce` enforce RFC 9901
+   §7.3 audience/replay binding when the relying party supplies them.
+
+Beyond the single-file bundle, the library also verifies, all offline: a **witnessed C2SP checkpoint**
+(`verify_witnessed_checkpoint`, Ed25519 + post-quantum ML-DSA-44 cosignatures — the quorum counts distinct
+witness **keys**, not names, so one key under many names can never stuff a threshold), a **C2SP
+`.tlog-proof`** (`proofbundle verify-proof`), and a **Token Status List** revocation snapshot.
 
 The verifier treats the payload as opaque bytes. It proves that these exact
 bytes were signed and anchored, not what they mean. That is on purpose: it keeps
@@ -154,7 +166,7 @@ flowchart LR
 pip install proofbundle
 ```
 
-Requires Python 3.9+ and [`cryptography`](https://cryptography.io). Signature
+Requires Python 3.10+ and [`cryptography`](https://cryptography.io). Signature
 math is delegated to `cryptography`; this project never rolls its own crypto.
 The Merkle and SD-JWT logic is pure standard library.
 
@@ -168,7 +180,7 @@ pip install "proofbundle[sdjwt]"
 ## Quickstart
 
 ```bash
-# generate a real example bundle with throwaway keys
+# from a git checkout (examples/ ships in the repo, not the wheel):
 python examples/make_example.py
 
 # verify it
@@ -179,6 +191,15 @@ proofbundle verify examples/example_bundle.json
 <img src="assets/demo.svg" alt="proofbundle verify output: PASS checks and OK" width="680">
 </div>
 
+See the whole trust story in five seconds — pip-only, offline, in memory (honest receipt verifies, six tampers fail, a swapped sample is caught):
+
+```bash
+pip install proofbundle
+proofbundle demo
+```
+
+Full walkthrough incl. the forced-random-sample audit: **[docs/DEMO.md](docs/DEMO.md)**.
+
 Machine-readable output and a non-zero exit code on failure:
 
 ```bash
@@ -272,7 +293,7 @@ Since v1.2 proofbundle also speaks the witness layer:
 (Ed25519 cosignature/v1) — `verify_witnessed_checkpoint` checks a checkpoint is
 both log-signed **and** cosigned by a quorum of distinct witnesses, offline,
 which rules out a split view by the log operator. This is the same
-witnessed-checkpoint pattern Rekor v2 (GA October 2025) institutionalizes.
+witnessed-checkpoint pattern Rekor v2 (GA October 2025) is integrating.
 
 Since v1.3 the witness layer is complete: **ML-DSA-44 cosignatures** (C2SP type
 0x06, FIPS 204 — post-quantum, the spec's SHOULD for new witness deployments;
@@ -431,7 +452,7 @@ threshold was met without revealing the model or the data. See [INTEROP.md](INTE
   [lm-evaluation-harness](https://github.com/EleutherAI/lm-evaluation-harness) `results_*.json` (the
   genuine `acc,none` filter-suffix format). **`proofbundle.adapters.from_eee_dataset`** (v0.9) reads an
   Every Eval Ever v0.2.2 aggregate JSON and builds a signed receipt — validated against the vendored EEE
-  schema, with **no runtime import** of `every_eval_ever` (it needs Python 3.12; proofbundle stays 3.9+).
+  schema, with **no runtime import** of `every_eval_ever` (it needs Python 3.12; proofbundle stays 3.10+).
 - **in-toto test-result export, DSSE-signed** (v0.9) — `proofbundle.intoto.export_intoto_dsse(claim,
   signer)` emits the receipt as a DSSE-signed in-toto Statement v1 with the **generic
   `test-result/v0.1` predicate** (result PASSED/FAILED, `configuration` ResourceDescriptors), so a generic
@@ -491,15 +512,33 @@ ISO/IEC DIS 24970), including the anti-patterns no one should claim.
   (RFC 9901 §4.3, fail-closed; closes #1) with `cnf.jwk` issuance and holder presentation, **C2SP
   tlog-cosignature** verification (Ed25519 cosignature/v1, witness quorum, split-view resistance), and
   `verify --verbose` with the recomputed Merkle root (closes #2).
-- **v1.3 (current release)** — the portable proof: **C2SP tlog-proof** emit/verify (+
+- **v1.3** — the portable proof: **C2SP tlog-proof** emit/verify (+
   `verify-proof` CLI), **ML-DSA-44** witness cosignatures (post-quantum, `[pq]` extra), **Token
   Status List** snapshot verification (offline revocation), SD-JWT VC markers (`dc+sd-jwt`,
   `vct`, `status`), COMPLIANCE.md (EU AI Act Art. 12 / NIST AI RMF mapping), and the mutation
   suite as a CI gate.
-- **Deferred** (explicitly not yet built) — full SD-JWT VC conformance + `vct` type-metadata
-  resolution (pre-IESG), per-sample Merkle receipts (the THREAT_MODEL's named gap; v2.0
-  direction), an official in-toto eval predicate (proposal path via OpenSSF/CoSAI), a full
-  in-toto client, a Python-3.10 floor.
+- **v1.4** — distribution: a **promptfoo** adapter (results.json v3 →
+  pass_rate receipt), the **Hugging Face Community Evals bridge** (`pb1.` receipt tokens for the
+  `.eval_results` `verifyToken` field + a strict YAML entry emitter — proofbundle-verifiable,
+  explicitly NOT the HF-internal badge token), `hf-token` CLI, and the **Python 3.10+ floor**
+  (3.9 is EOL since 2025-10).
+- **v1.5** — per-sample receipts: a signed **Merkle commitment over every
+  individual sample** (`samples` claim field, SPEC §7g), salted per-leaf disclosures (RFC 9901
+  mechanic), **sample openings** with replay guards, and a **spot-check audit protocol**
+  (`audit-challenge` / `verify-opening` CLI; auditor-nonce, beacon, and documented-grindable
+  self-challenge modes; PoR soundness 1−(1−m)^k) — narrowing the THREAT_MODEL's sub-sampling gap.
+  Extractors for lm-eval `--log_samples` JSONL and promptfoo rows.
+- **v1.6** — external principal-security review fixes: verify-side sample/`leaf_alg`/root invariants
+  and signed `context_binding` enforcement (was signed but unchecked), status-list freshness
+  (`exp`/`ttl` None-safe), `merkle.hash_alg` now required; Beta classifier; 26-operator mutation gate.
+- **v1.6.1** — developer experience: `proofbundle demo` (pip-only, fail-closed tamper smoke test), a
+  runnable per-sample example, `docs/DEMO.md`.
+- **v1.7 (current release)** — release supply-chain hardening: `release.yml` builds once and
+  publishes the **attested** bytes (sha256 gate: attested == published), a reviewer-gated `pypi`
+  environment, least-privilege permissions, SHA-pinned actions, `RELEASE.md` + `docs/REVIEWERS.md`.
+- **Deferred** (explicitly not yet built, stated honestly) — full SD-JWT VC conformance + `vct`
+  type-metadata resolution (pre-IESG), an official in-toto eval predicate (proposal path via
+  OpenSSF/CoSAI), and a full in-toto client.
 
 ## Contributing
 

{proofbundle-1.3.0 → proofbundle-1.7.0}/pyproject.toml

@@ -4,10 +4,10 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "proofbundle"
-version = "1.3.0"
+version = "1.7.0"
 description = "Emit and verify portable cryptographic evidence bundles, offline: Ed25519 + RFC 6962 Merkle + optional SD-JWT."
 readme = "README.md"
-requires-python = ">=3.9"
+requires-python = ">=3.10"
 license = { text = "MIT" }
 authors = [{ name = "Konrad Gruszka" }]
 keywords = [
@@ -22,11 +22,10 @@ keywords = [
     "rfc6962",
 ]
 classifiers = [
-    "Development Status :: 3 - Alpha",
+    "Development Status :: 4 - Beta",
     "Intended Audience :: Developers",
     "License :: OSI Approved :: MIT License",
     "Programming Language :: Python :: 3",
-    "Programming Language :: Python :: 3.9",
     "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
@@ -56,11 +55,11 @@ pq = ["cryptography>=48"]
 pytest = ["pytest>=7"]
 # The inspect_ai adapter uses the STABLE read_eval_log API (lazy import). Pinned with an UPPER bound:
 # the .eval format + pydantic schema change between versions (inspect_ai issue 834), and the fixture
-# test is bound to this range. inspect_ai requires Python >= 3.10, so the marker gates it out on 3.9
-# (base + [eval]/[sdjwt] still work on 3.9; the inspect adapter test skips there). Fixes the red 3.9 CI.
-inspect = ['inspect_ai>=0.3.112,<0.4; python_version >= "3.10"']
+# test is bound to this range. Since v1.4.0 the project floor is Python 3.10, so no per-extra version
+# marker is needed here (inspect_ai's own >=3.10 requirement is always satisfiable on a supported base).
+inspect = ['inspect_ai>=0.3.112,<0.4']
 dev = ["pytest>=7", "ruff>=0.5", "jsonschema>=4", "mypy>=1.8", "build>=1", "hypothesis>=6",
-       "rfc8785>=0.1.4", "sd-jwt>=0.10", 'inspect_ai>=0.3.112,<0.4; python_version >= "3.10"']
+       "rfc8785>=0.1.4", "sd-jwt>=0.10", 'inspect_ai>=0.3.112,<0.4']
 
 [project.urls]
 Homepage = "https://b7n0de.com"

{proofbundle-1.3.0 → proofbundle-1.7.0}/src/proofbundle/__init__.py

@@ -13,7 +13,7 @@ from __future__ import annotations
 
 from typing import TYPE_CHECKING
 
-__version__ = "1.3.0"
+__version__ = "1.7.0"
 
 __all__ = [
     "__version__",
@@ -30,6 +30,12 @@ __all__ = [
     "verify_cosignature",
     "verify_witnessed_checkpoint",
     "verify_status_snapshot",
+    "receipt_token",
+    "verify_receipt_token",
+    "build_sample_tree",
+    "sample_opening",
+    "verify_sample_opening",
+    "audit_challenge",
     "VerificationResult",
     "Check",
     "ProofBundleError",
@@ -47,6 +53,12 @@ _LAZY = {
     "verify_cosignature": ".checkpoint",
     "verify_witnessed_checkpoint": ".checkpoint",
     "verify_status_snapshot": ".statuslist",
+    "receipt_token": ".hf_evals",
+    "verify_receipt_token": ".hf_evals",
+    "build_sample_tree": ".persample",
+    "sample_opening": ".persample",
+    "verify_sample_opening": ".persample",
+    "audit_challenge": ".persample",
 }
 
 if TYPE_CHECKING:  # static analysers + IDEs see the real names/types; runtime stays lazy
@@ -55,6 +67,9 @@ if TYPE_CHECKING:  # static analysers + IDEs see the real names/types; runtime s
     from .errors import Check, ProofBundleError, VerificationResult
     from .checkpoint import verify_cosignature, verify_witnessed_checkpoint
     from .kbjwt import verify_key_binding
+    from .hf_evals import receipt_token, verify_receipt_token
+    from .persample import (audit_challenge, build_sample_tree, sample_opening,
+                            verify_sample_opening)
     from .statuslist import verify_status_snapshot
     from .tlogproof import verify_tlog_proof
     from .merkle import verify_consistency, verify_inclusion

{proofbundle-1.3.0 → proofbundle-1.7.0}/src/proofbundle/adapters/__init__.py

@@ -7,5 +7,9 @@ each fixture in tests/fixtures documents its source + version.
 from .inspect_ai import from_inspect_ai_log
 from .eee import from_eee_dataset
 from .lm_eval import from_lm_eval_results
+from .promptfoo import from_promptfoo_results
+from .samples import samples_from_lm_eval_jsonl, samples_from_promptfoo_results
 
-__all__ = ["from_lm_eval_results", "from_inspect_ai_log", "from_eee_dataset"]
+__all__ = ["from_lm_eval_results", "from_inspect_ai_log", "from_eee_dataset",
+           "from_promptfoo_results",
+           "samples_from_lm_eval_jsonl", "samples_from_promptfoo_results"]

{proofbundle-1.3.0 → proofbundle-1.7.0}/src/proofbundle/adapters/eee.py

@@ -5,7 +5,7 @@ it has no cryptography. This converter is strictly additive: it reads an EEE agg
 signed, selectively-disclosable proofbundle receipt from it.
 
 IMPORTANT: `every_eval_ever` is NOT imported at runtime — it requires Python 3.12+ (pydantic/numpy/pandas/
-duckdb), while proofbundle stays 3.9+. We parse the EEE JSON directly and OPTIONALLY validate it against the
+duckdb), while proofbundle stays 3.10+. We parse the EEE JSON directly and OPTIONALLY validate it against the
 vendored `eee_eval_schema.json` (schema version 0.2.2, MIT) using `jsonschema` if available.
 
 Field mapping (verified 2026-07 against schemas/eval.schema.json v0.2.2):

proofbundle-1.7.0/src/proofbundle/adapters/promptfoo.py

@@ -0,0 +1,131 @@
+"""Adapter for promptfoo `eval -o results.json` output (file-based, NO promptfoo import) — v1.4.
+
+Parses the exported OutputFile JSON only. Format verified 2026-07-02 against promptfoo `main`
+(`src/types/index.ts` OutputFile / EvaluateSummaryV3 / EvaluateStats, `src/util/output.ts`
+writeOutput): top level carries `evalId`, `results`, `config`, `metadata`; the current summary is
+**version 3** (`results.version == 3`) with whole-run aggregates in `results.stats` as
+`successes` / `failures` / `errors`. The metric emitted is **pass_rate** = successes / (successes
++ failures + errors), rendered as a fixed-point decimal string (the claim schema takes decimal
+strings, never floats).
+
+Version honesty: legacy files with `results.version` 1/2 have a different shape (`table` instead
+of `prompts`) and are REJECTED with a clear message rather than half-parsed; the "v4" storage
+version never appears in output files (they still say `version: 3`). Redaction flags
+(`PROMPTFOO_STRIP_*`) only affect prompt/response bodies — nothing this adapter reads.
+"""
+from __future__ import annotations
+
+import hashlib
+import json
+from decimal import Decimal
+from pathlib import Path
+from typing import Optional
+
+from ..evalclaim import build_eval_claim
+
+_SCALE = 6  # pass_rate decimal places — fixed-point, schema-conformant
+
+
+def _pass_rate(successes: int, failures: int, errors: int) -> "tuple[str, int]":
+    total = successes + failures + errors
+    if total <= 0:
+        raise ValueError("promptfoo results contain no test outcomes (stats all zero)")
+    rate = (Decimal(successes) / Decimal(total)).quantize(Decimal(1).scaleb(-_SCALE))
+    return f"{rate:.{_SCALE}f}", total
+
+
+def from_promptfoo_results(path, *, comparator: str, threshold: str, timestamp: str,
+                           model_salt: Optional[bytes] = None,
+                           dataset_salt: Optional[bytes] = None):
+    """Read a promptfoo results.json (summary v3) and build an eval claim over the run's
+    pass_rate. Returns (claim, salts).
+
+    - suite = `config.description` when present, else the `evalId` (the run's identity).
+    - model_id = the sorted, de-duplicated provider ids of the run (a promptfoo eval may span
+      several providers; the salted commitment pins the exact set).
+    - dataset_id = sha256 over the canonical JSON of `config.tests` AS RECORDED in results.json.
+      Inline tests bind the actual content (the suite IS the dataset); a `file://`/glob reference binds
+      the reference, not the resolved file content (an offline reader cannot resolve it) — provenance
+      records which case applies (`dataset_commitment_scope`) so the binding is never overstated.
+    - provenance: promptfooVersion, evalId, summary timestamp, per-outcome counts.
+    """
+    data = json.loads(Path(path).read_text(encoding="utf-8"))
+    if not isinstance(data, dict) or not isinstance(data.get("results"), dict):
+        raise ValueError("not a promptfoo output file (missing results object)")
+    summary = data["results"]
+    version = summary.get("version")
+    if version != 3:
+        raise ValueError(
+            f"unsupported promptfoo summary version {version!r} — this adapter parses the "
+            "current version 3 (legacy v1/v2 files use a different 'table' shape; re-export "
+            "with a current promptfoo)")
+    stats = summary.get("stats")
+    if not isinstance(stats, dict):
+        raise ValueError("promptfoo results.stats missing")
+    counts = {}
+    for key in ("successes", "failures", "errors"):
+        val = stats.get(key, 0)
+        if isinstance(val, bool) or not isinstance(val, int) or val < 0:
+            raise ValueError(f"promptfoo stats.{key} must be a non-negative integer")
+        counts[key] = val
+    score, n = _pass_rate(counts["successes"], counts["failures"], counts["errors"])
+
+    config = data.get("config") or {}
+    eval_id = data.get("evalId")
+    suite = str(config.get("description") or eval_id or "promptfoo-run")
+
+    # Commit to the providers that ACTUALLY produced a result in this run — not config.providers, which can
+    # list providers that never ran (e.g. --filter-providers). Only fall back to config.providers if the
+    # summary recorded no per-result provider at all (release-review fix).
+    providers = set()
+    for res in summary.get("results", []):
+        prov = (res or {}).get("provider")
+        if isinstance(prov, dict) and prov.get("id"):
+            providers.add(str(prov["id"]))
+        elif isinstance(prov, str):
+            providers.add(prov)
+    if not providers:
+        for prov in config.get("providers") or []:
+            if isinstance(prov, str):
+                providers.add(prov)
+            elif isinstance(prov, dict) and prov.get("id"):
+                providers.add(str(prov["id"]))
+    model_id = "+".join(sorted(providers)) if providers else "unknown:promptfoo-provider"
+
+    tests = config.get("tests")
+    tests_canonical = json.dumps(tests, sort_keys=True, separators=(",", ":")) if tests else ""
+    dataset_id = ("promptfoo-tests-sha256:"
+                  + hashlib.sha256(tests_canonical.encode("utf-8")).hexdigest())
+    # HONESTY (release-review): the commitment is over `config.tests` AS RECORDED in results.json. When tests are
+    # INLINE, that is the content (the suite IS the dataset). When they are a `file://`/glob REFERENCE — whether a
+    # top-level string, a list containing a string, OR a `file://` nested inside an inline test's vars/assert —
+    # promptfoo records the unresolved reference, so the commitment binds the reference, NOT the file content
+    # (an offline reader cannot resolve external files). When there are NO tests at all the commitment is over the
+    # empty string and binds nothing. We label each case so a verifier is never misled that content was bound.
+    tests_by_reference = isinstance(tests, str) or (
+        isinstance(tests, list) and any(isinstance(t, str) for t in tests)) or ("file://" in tests_canonical)
+    if not tests:
+        commitment_scope = "config.tests_absent"
+    elif tests_by_reference:
+        commitment_scope = "config.tests_reference_only"
+    else:
+        commitment_scope = "config.tests_inline_content"
+
+    metadata = data.get("metadata") or {}
+    provenance = {"harness": "promptfoo",
+                  "successes": str(counts["successes"]), "failures": str(counts["failures"]),
+                  "errors": str(counts["errors"]),
+                  "pass_rate_formula": "successes/(successes+failures+errors)",
+                  "dataset_commitment_scope": commitment_scope}
+    if eval_id:
+        provenance["eval_id"] = str(eval_id)
+    if metadata.get("promptfooVersion"):
+        provenance["promptfoo_version"] = str(metadata["promptfooVersion"])
+    if summary.get("timestamp"):
+        provenance["run_timestamp"] = str(summary["timestamp"])
+
+    return build_eval_claim(
+        suite=suite, suite_version=f"promptfoo-summary-v{version}",
+        metric="pass_rate", comparator=comparator, threshold=threshold, score=score, n=n,
+        model_id=model_id, dataset_id=dataset_id, issuer="", timestamp=timestamp,
+        provenance=provenance, model_salt=model_salt, dataset_salt=dataset_salt)