proofbundle 1.4.0__tar.gz → 1.7.0__tar.gz

{proofbundle-1.4.0/src/proofbundle.egg-info → proofbundle-1.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofbundle
-Version: 1.4.0
+Version: 1.7.0
 Summary: Emit and verify portable cryptographic evidence bundles, offline: Ed25519 + RFC 6962 Merkle + optional SD-JWT.
 Author: Konrad Gruszka
 License: MIT
@@ -10,7 +10,7 @@ Project-URL: Issues, https://github.com/b7n0de/proofbundle/issues
 Project-URL: Changelog, https://github.com/b7n0de/proofbundle/blob/main/CHANGELOG.md
 Project-URL: Documentation, https://github.com/b7n0de/proofbundle#readme
 Keywords: cryptography,merkle,transparency-log,ed25519,sd-jwt,verifiable-credentials,attestation,provenance,rfc6962
-Classifier: Development Status :: 3 - Alpha
+Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Developers
 Classifier: License :: OSI Approved :: MIT License
 Classifier: Programming Language :: Python :: 3
@@ -63,13 +63,16 @@ revocation snapshots, aligned to the in-toto test-result predicate. One portable
 file, no server, no network.**
 
 [![CI](https://github.com/b7n0de/proofbundle/actions/workflows/ci.yml/badge.svg)](https://github.com/b7n0de/proofbundle/actions/workflows/ci.yml)
+[![License: MIT](https://img.shields.io/badge/license-MIT-D6248A.svg)](LICENSE)
+[![Ruff](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/ruff/main/assets/badge/v2.json)](https://github.com/astral-sh/ruff)
+<!-- Badges below are enabled AFTER the first PyPI release (they render broken/false before it,
+     which reads as abandonment). Un-comment on first publish — see RELEASE.md:
 [![PyPI](https://img.shields.io/pypi/v/proofbundle.svg?color=D6248A&cacheSeconds=3600)](https://pypi.org/project/proofbundle/)
 [![Python](https://img.shields.io/pypi/pyversions/proofbundle.svg?color=D6248A&cacheSeconds=3600)](https://pypi.org/project/proofbundle/)
 [![Downloads](https://static.pepy.tech/badge/proofbundle)](https://pepy.tech/project/proofbundle)
-[![License: MIT](https://img.shields.io/badge/license-MIT-D6248A.svg)](LICENSE)
-[![Ruff](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/ruff/main/assets/badge/v2.json)](https://github.com/astral-sh/ruff)
 [![SLSA build provenance](https://img.shields.io/badge/SLSA-build_provenance-D6248A.svg)](https://slsa.dev)
 [![PyPI attestations](https://img.shields.io/badge/PyPI-attestations_(PEP_740)-D6248A.svg)](https://pypi.org/project/proofbundle/)
+-->
 [![Post-quantum witnesses](https://img.shields.io/badge/PQ-ML--DSA--44_cosignatures-D6248A.svg)](https://github.com/C2SP/C2SP/blob/main/tlog-cosignature.md)
 [![Mutation tested](https://img.shields.io/badge/tests-mutation_gated-D6248A.svg)](scripts/mutation_check.py)
 [![C2SP tlog-proof](https://img.shields.io/badge/C2SP-tlog--proof-D6248A.svg)](https://github.com/C2SP/C2SP/blob/main/tlog-proof.md)
@@ -81,7 +84,7 @@ file, no server, no network.**
 
 **At a glance:** `proofbundle emit` signs and anchors a payload; `proofbundle
 verify` checks one self-contained `bundle.json` with three offline cryptographic
-checks → `OK` or `FAILED`. No network, no daemon, no own crypto. 209 tests + a CI mutation gate.
+checks → `OK` or `FAILED`. No network, no daemon, no own crypto. 257 tests + a CI mutation gate.
 
 ## Contents
 
@@ -146,6 +149,8 @@ not a proof that the number is *true* or that the evaluation was well designed.
 | `reproduced` | independently re-run and matched |
 | `enclave_attested` | produced in an attested trusted execution environment |
 
+Since v1.6 `decode_eval_claim(bundle, expected_context=...)` enforces the signed `context_binding` (cross-context replay guard), and verify-side re-checks the `samples.n == n` invariant — guarantees no longer live only in the emitter.
+
 Full detail: **[THREAT_MODEL.md](THREAT_MODEL.md)** — what `verify` catches and what it structurally cannot.
 
 ## What it verifies
@@ -223,7 +228,7 @@ pip install "proofbundle[sdjwt]"
 ## Quickstart
 
 ```bash
-# generate a real example bundle with throwaway keys
+# from a git checkout (examples/ ships in the repo, not the wheel):
 python examples/make_example.py
 
 # verify it
@@ -234,6 +239,15 @@ proofbundle verify examples/example_bundle.json
 <img src="assets/demo.svg" alt="proofbundle verify output: PASS checks and OK" width="680">
 </div>
 
+See the whole trust story in five seconds — pip-only, offline, in memory (honest receipt verifies, six tampers fail, a swapped sample is caught):
+
+```bash
+pip install proofbundle
+proofbundle demo
+```
+
+Full walkthrough incl. the forced-random-sample audit: **[docs/DEMO.md](docs/DEMO.md)**.
+
 Machine-readable output and a non-zero exit code on failure:
 
 ```bash
@@ -327,7 +341,7 @@ Since v1.2 proofbundle also speaks the witness layer:
 (Ed25519 cosignature/v1) — `verify_witnessed_checkpoint` checks a checkpoint is
 both log-signed **and** cosigned by a quorum of distinct witnesses, offline,
 which rules out a split view by the log operator. This is the same
-witnessed-checkpoint pattern Rekor v2 (GA October 2025) institutionalizes.
+witnessed-checkpoint pattern Rekor v2 (GA October 2025) is integrating.
 
 Since v1.3 the witness layer is complete: **ML-DSA-44 cosignatures** (C2SP type
 0x06, FIPS 204 — post-quantum, the spec's SHOULD for new witness deployments;
@@ -551,15 +565,25 @@ ISO/IEC DIS 24970), including the anti-patterns no one should claim.
   Status List** snapshot verification (offline revocation), SD-JWT VC markers (`dc+sd-jwt`,
   `vct`, `status`), COMPLIANCE.md (EU AI Act Art. 12 / NIST AI RMF mapping), and the mutation
   suite as a CI gate.
-- **v1.4 (current release)** — distribution: a **promptfoo** adapter (results.json v3 →
+- **v1.4** — distribution: a **promptfoo** adapter (results.json v3 →
   pass_rate receipt), the **Hugging Face Community Evals bridge** (`pb1.` receipt tokens for the
   `.eval_results` `verifyToken` field + a strict YAML entry emitter — proofbundle-verifiable,
   explicitly NOT the HF-internal badge token), `hf-token` CLI, and the **Python 3.10+ floor**
   (3.9 is EOL since 2025-10).
-- **v2.0 (next major, research differentiation)** — **per-sample Merkle receipts**: the payload carries a
-  Merkle root over *individual* sample results, so a verifier can force a random-sample re-check instead of
-  trusting only the reported aggregate. This is the THREAT_MODEL's one named structural gap ("forced random
-  sub-sampling"), and closing it is the road from *authorship* to *sampled correctness*.
+- **v1.5** — per-sample receipts: a signed **Merkle commitment over every
+  individual sample** (`samples` claim field, SPEC §7g), salted per-leaf disclosures (RFC 9901
+  mechanic), **sample openings** with replay guards, and a **spot-check audit protocol**
+  (`audit-challenge` / `verify-opening` CLI; auditor-nonce, beacon, and documented-grindable
+  self-challenge modes; PoR soundness 1−(1−m)^k) — narrowing the THREAT_MODEL's sub-sampling gap.
+  Extractors for lm-eval `--log_samples` JSONL and promptfoo rows.
+- **v1.6** — external principal-security review fixes: verify-side sample/`leaf_alg`/root invariants
+  and signed `context_binding` enforcement (was signed but unchecked), status-list freshness
+  (`exp`/`ttl` None-safe), `merkle.hash_alg` now required; Beta classifier; 26-operator mutation gate.
+- **v1.6.1** — developer experience: `proofbundle demo` (pip-only, fail-closed tamper smoke test), a
+  runnable per-sample example, `docs/DEMO.md`.
+- **v1.7 (current release)** — release supply-chain hardening: `release.yml` builds once and
+  publishes the **attested** bytes (sha256 gate: attested == published), a reviewer-gated `pypi`
+  environment, least-privilege permissions, SHA-pinned actions, `RELEASE.md` + `docs/REVIEWERS.md`.
 - **Deferred** (explicitly not yet built, stated honestly) — full SD-JWT VC conformance + `vct`
   type-metadata resolution (pre-IESG), an official in-toto eval predicate (proposal path via
   OpenSSF/CoSAI), and a full in-toto client.

{proofbundle-1.4.0 → proofbundle-1.7.0}/README.md

@@ -15,13 +15,16 @@ revocation snapshots, aligned to the in-toto test-result predicate. One portable
 file, no server, no network.**
 
 [![CI](https://github.com/b7n0de/proofbundle/actions/workflows/ci.yml/badge.svg)](https://github.com/b7n0de/proofbundle/actions/workflows/ci.yml)
+[![License: MIT](https://img.shields.io/badge/license-MIT-D6248A.svg)](LICENSE)
+[![Ruff](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/ruff/main/assets/badge/v2.json)](https://github.com/astral-sh/ruff)
+<!-- Badges below are enabled AFTER the first PyPI release (they render broken/false before it,
+     which reads as abandonment). Un-comment on first publish — see RELEASE.md:
 [![PyPI](https://img.shields.io/pypi/v/proofbundle.svg?color=D6248A&cacheSeconds=3600)](https://pypi.org/project/proofbundle/)
 [![Python](https://img.shields.io/pypi/pyversions/proofbundle.svg?color=D6248A&cacheSeconds=3600)](https://pypi.org/project/proofbundle/)
 [![Downloads](https://static.pepy.tech/badge/proofbundle)](https://pepy.tech/project/proofbundle)
-[![License: MIT](https://img.shields.io/badge/license-MIT-D6248A.svg)](LICENSE)
-[![Ruff](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/ruff/main/assets/badge/v2.json)](https://github.com/astral-sh/ruff)
 [![SLSA build provenance](https://img.shields.io/badge/SLSA-build_provenance-D6248A.svg)](https://slsa.dev)
 [![PyPI attestations](https://img.shields.io/badge/PyPI-attestations_(PEP_740)-D6248A.svg)](https://pypi.org/project/proofbundle/)
+-->
 [![Post-quantum witnesses](https://img.shields.io/badge/PQ-ML--DSA--44_cosignatures-D6248A.svg)](https://github.com/C2SP/C2SP/blob/main/tlog-cosignature.md)
 [![Mutation tested](https://img.shields.io/badge/tests-mutation_gated-D6248A.svg)](scripts/mutation_check.py)
 [![C2SP tlog-proof](https://img.shields.io/badge/C2SP-tlog--proof-D6248A.svg)](https://github.com/C2SP/C2SP/blob/main/tlog-proof.md)
@@ -33,7 +36,7 @@ file, no server, no network.**
 
 **At a glance:** `proofbundle emit` signs and anchors a payload; `proofbundle
 verify` checks one self-contained `bundle.json` with three offline cryptographic
-checks → `OK` or `FAILED`. No network, no daemon, no own crypto. 209 tests + a CI mutation gate.
+checks → `OK` or `FAILED`. No network, no daemon, no own crypto. 257 tests + a CI mutation gate.
 
 ## Contents
 
@@ -98,6 +101,8 @@ not a proof that the number is *true* or that the evaluation was well designed.
 | `reproduced` | independently re-run and matched |
 | `enclave_attested` | produced in an attested trusted execution environment |
 
+Since v1.6 `decode_eval_claim(bundle, expected_context=...)` enforces the signed `context_binding` (cross-context replay guard), and verify-side re-checks the `samples.n == n` invariant — guarantees no longer live only in the emitter.
+
 Full detail: **[THREAT_MODEL.md](THREAT_MODEL.md)** — what `verify` catches and what it structurally cannot.
 
 ## What it verifies
@@ -175,7 +180,7 @@ pip install "proofbundle[sdjwt]"
 ## Quickstart
 
 ```bash
-# generate a real example bundle with throwaway keys
+# from a git checkout (examples/ ships in the repo, not the wheel):
 python examples/make_example.py
 
 # verify it
@@ -186,6 +191,15 @@ proofbundle verify examples/example_bundle.json
 <img src="assets/demo.svg" alt="proofbundle verify output: PASS checks and OK" width="680">
 </div>
 
+See the whole trust story in five seconds — pip-only, offline, in memory (honest receipt verifies, six tampers fail, a swapped sample is caught):
+
+```bash
+pip install proofbundle
+proofbundle demo
+```
+
+Full walkthrough incl. the forced-random-sample audit: **[docs/DEMO.md](docs/DEMO.md)**.
+
 Machine-readable output and a non-zero exit code on failure:
 
 ```bash
@@ -279,7 +293,7 @@ Since v1.2 proofbundle also speaks the witness layer:
 (Ed25519 cosignature/v1) — `verify_witnessed_checkpoint` checks a checkpoint is
 both log-signed **and** cosigned by a quorum of distinct witnesses, offline,
 which rules out a split view by the log operator. This is the same
-witnessed-checkpoint pattern Rekor v2 (GA October 2025) institutionalizes.
+witnessed-checkpoint pattern Rekor v2 (GA October 2025) is integrating.
 
 Since v1.3 the witness layer is complete: **ML-DSA-44 cosignatures** (C2SP type
 0x06, FIPS 204 — post-quantum, the spec's SHOULD for new witness deployments;
@@ -503,15 +517,25 @@ ISO/IEC DIS 24970), including the anti-patterns no one should claim.
   Status List** snapshot verification (offline revocation), SD-JWT VC markers (`dc+sd-jwt`,
   `vct`, `status`), COMPLIANCE.md (EU AI Act Art. 12 / NIST AI RMF mapping), and the mutation
   suite as a CI gate.
-- **v1.4 (current release)** — distribution: a **promptfoo** adapter (results.json v3 →
+- **v1.4** — distribution: a **promptfoo** adapter (results.json v3 →
   pass_rate receipt), the **Hugging Face Community Evals bridge** (`pb1.` receipt tokens for the
   `.eval_results` `verifyToken` field + a strict YAML entry emitter — proofbundle-verifiable,
   explicitly NOT the HF-internal badge token), `hf-token` CLI, and the **Python 3.10+ floor**
   (3.9 is EOL since 2025-10).
-- **v2.0 (next major, research differentiation)** — **per-sample Merkle receipts**: the payload carries a
-  Merkle root over *individual* sample results, so a verifier can force a random-sample re-check instead of
-  trusting only the reported aggregate. This is the THREAT_MODEL's one named structural gap ("forced random
-  sub-sampling"), and closing it is the road from *authorship* to *sampled correctness*.
+- **v1.5** — per-sample receipts: a signed **Merkle commitment over every
+  individual sample** (`samples` claim field, SPEC §7g), salted per-leaf disclosures (RFC 9901
+  mechanic), **sample openings** with replay guards, and a **spot-check audit protocol**
+  (`audit-challenge` / `verify-opening` CLI; auditor-nonce, beacon, and documented-grindable
+  self-challenge modes; PoR soundness 1−(1−m)^k) — narrowing the THREAT_MODEL's sub-sampling gap.
+  Extractors for lm-eval `--log_samples` JSONL and promptfoo rows.
+- **v1.6** — external principal-security review fixes: verify-side sample/`leaf_alg`/root invariants
+  and signed `context_binding` enforcement (was signed but unchecked), status-list freshness
+  (`exp`/`ttl` None-safe), `merkle.hash_alg` now required; Beta classifier; 26-operator mutation gate.
+- **v1.6.1** — developer experience: `proofbundle demo` (pip-only, fail-closed tamper smoke test), a
+  runnable per-sample example, `docs/DEMO.md`.
+- **v1.7 (current release)** — release supply-chain hardening: `release.yml` builds once and
+  publishes the **attested** bytes (sha256 gate: attested == published), a reviewer-gated `pypi`
+  environment, least-privilege permissions, SHA-pinned actions, `RELEASE.md` + `docs/REVIEWERS.md`.
 - **Deferred** (explicitly not yet built, stated honestly) — full SD-JWT VC conformance + `vct`
   type-metadata resolution (pre-IESG), an official in-toto eval predicate (proposal path via
   OpenSSF/CoSAI), and a full in-toto client.

{proofbundle-1.4.0 → proofbundle-1.7.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "proofbundle"
-version = "1.4.0"
+version = "1.7.0"
 description = "Emit and verify portable cryptographic evidence bundles, offline: Ed25519 + RFC 6962 Merkle + optional SD-JWT."
 readme = "README.md"
 requires-python = ">=3.10"
@@ -22,7 +22,7 @@ keywords = [
     "rfc6962",
 ]
 classifiers = [
-    "Development Status :: 3 - Alpha",
+    "Development Status :: 4 - Beta",
     "Intended Audience :: Developers",
     "License :: OSI Approved :: MIT License",
     "Programming Language :: Python :: 3",

{proofbundle-1.4.0 → proofbundle-1.7.0}/src/proofbundle/__init__.py

@@ -13,7 +13,7 @@ from __future__ import annotations
 
 from typing import TYPE_CHECKING
 
-__version__ = "1.4.0"
+__version__ = "1.7.0"
 
 __all__ = [
     "__version__",
@@ -32,6 +32,10 @@ __all__ = [
     "verify_status_snapshot",
     "receipt_token",
     "verify_receipt_token",
+    "build_sample_tree",
+    "sample_opening",
+    "verify_sample_opening",
+    "audit_challenge",
     "VerificationResult",
     "Check",
     "ProofBundleError",
@@ -51,6 +55,10 @@ _LAZY = {
     "verify_status_snapshot": ".statuslist",
     "receipt_token": ".hf_evals",
     "verify_receipt_token": ".hf_evals",
+    "build_sample_tree": ".persample",
+    "sample_opening": ".persample",
+    "verify_sample_opening": ".persample",
+    "audit_challenge": ".persample",
 }
 
 if TYPE_CHECKING:  # static analysers + IDEs see the real names/types; runtime stays lazy
@@ -60,6 +68,8 @@ if TYPE_CHECKING:  # static analysers + IDEs see the real names/types; runtime s
     from .checkpoint import verify_cosignature, verify_witnessed_checkpoint
     from .kbjwt import verify_key_binding
     from .hf_evals import receipt_token, verify_receipt_token
+    from .persample import (audit_challenge, build_sample_tree, sample_opening,
+                            verify_sample_opening)
     from .statuslist import verify_status_snapshot
     from .tlogproof import verify_tlog_proof
     from .merkle import verify_consistency, verify_inclusion

{proofbundle-1.4.0 → proofbundle-1.7.0}/src/proofbundle/adapters/__init__.py

@@ -8,6 +8,8 @@ from .inspect_ai import from_inspect_ai_log
 from .eee import from_eee_dataset
 from .lm_eval import from_lm_eval_results
 from .promptfoo import from_promptfoo_results
+from .samples import samples_from_lm_eval_jsonl, samples_from_promptfoo_results
 
 __all__ = ["from_lm_eval_results", "from_inspect_ai_log", "from_eee_dataset",
-           "from_promptfoo_results"]
+           "from_promptfoo_results",
+           "samples_from_lm_eval_jsonl", "samples_from_promptfoo_results"]

{proofbundle-1.4.0 → proofbundle-1.7.0}/src/proofbundle/adapters/eee.py

@@ -5,7 +5,7 @@ it has no cryptography. This converter is strictly additive: it reads an EEE agg
 signed, selectively-disclosable proofbundle receipt from it.
 
 IMPORTANT: `every_eval_ever` is NOT imported at runtime — it requires Python 3.12+ (pydantic/numpy/pandas/
-duckdb), while proofbundle stays 3.9+. We parse the EEE JSON directly and OPTIONALLY validate it against the
+duckdb), while proofbundle stays 3.10+. We parse the EEE JSON directly and OPTIONALLY validate it against the
 vendored `eee_eval_schema.json` (schema version 0.2.2, MIT) using `jsonschema` if available.
 
 Field mapping (verified 2026-07 against schemas/eval.schema.json v0.2.2):

proofbundle-1.7.0/src/proofbundle/adapters/samples.py

@@ -0,0 +1,82 @@
+"""Per-sample record extractors for the v1.5 sample tree (file-based, no framework imports).
+
+Each extractor maps a framework's per-sample export into small, canonical leaf records for
+:func:`proofbundle.persample.build_sample_tree`. Records are returned in canonical order
+(sorted by the framework's stable sample identity) — the tree builder assigns and embeds `idx`.
+
+Privacy layering (two-layer hiding, per the v1.5 design): records carry the framework's
+CONTENT HASHES (or compact result fields), never benchmark plaintext — so opening a sample for
+audit reveals the model's result without necessarily revealing the benchmark item's text.
+lm-evaluation-harness conveniently already emits per-doc `doc_hash`/`prompt_hash`/`target_hash`
+(SHA-256, verified against lm_eval/evaluator.py) — note these are UNSALTED upstream hashes and
+therefore linkable on their own; hiding comes from the salted disclosure wrapping them, which is
+why they go INSIDE the leaf, never beside it.
+"""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+from typing import List
+
+
+def samples_from_lm_eval_jsonl(path) -> List[dict]:
+    """Read an lm-evaluation-harness ``--log_samples`` JSONL (samples_<task>_*.jsonl) into leaf
+    records: (doc_id, filter, doc/prompt/target hashes, filtered responses, metric values).
+
+    Sorted by (doc_id, filter). Metric values are stringified (leaves are transport artifacts;
+    numeric canonicalization stays out of the commitment)."""
+    records = []
+    for line_no, line in enumerate(Path(path).read_text(encoding="utf-8").splitlines(), 1):
+        if not line.strip():
+            continue
+        try:
+            row = json.loads(line)
+        except json.JSONDecodeError as exc:
+            raise ValueError(f"line {line_no}: not valid JSON") from exc
+        if not isinstance(row, dict) or "doc_id" not in row:
+            raise ValueError(f"line {line_no}: not an lm-eval sample row")
+        doc_id = row.get("doc_id")
+        if isinstance(doc_id, bool) or not isinstance(doc_id, int):
+            raise ValueError(f"line {line_no}: doc_id missing or not an integer")
+        metrics = row.get("metrics") or []
+        rec = {"id": doc_id, "epoch": 1, "filter": str(row.get("filter", "none")),
+               "doc_hash": str(row.get("doc_hash", "")),
+               "prompt_hash": str(row.get("prompt_hash", "")),
+               "target_hash": str(row.get("target_hash", "")),
+               "filtered_resps": [str(r) for r in (row.get("filtered_resps") or [])],
+               "metrics": {m: str(row[m]) for m in metrics if m in row}}
+        records.append(rec)
+    if not records:
+        raise ValueError("no sample rows found")
+    records.sort(key=lambda r: (r["id"], r["filter"]))
+    return records
+
+
+def samples_from_promptfoo_results(path) -> List[dict]:
+    """Read a promptfoo results.json (summary v3) into leaf records:
+    (testIdx, promptIdx, provider, success, score). Sorted by (testIdx, promptIdx, provider)."""
+    data = json.loads(Path(path).read_text(encoding="utf-8"))
+    summary = data.get("results")
+    if not isinstance(summary, dict) or summary.get("version") != 3:
+        raise ValueError("not a promptfoo v3 output file (see adapters.promptfoo)")
+    records = []
+    for i, row in enumerate(summary.get("results") or []):
+        if not isinstance(row, dict):
+            raise ValueError(f"results[{i}] is not an object")
+        test_idx, prompt_idx = row.get("testIdx"), row.get("promptIdx")
+        for name, val in (("testIdx", test_idx), ("promptIdx", prompt_idx)):
+            if isinstance(val, bool) or not isinstance(val, int):
+                raise ValueError(f"results[{i}].{name} missing or not an integer")
+        success = row.get("success")
+        if not isinstance(success, bool):
+            raise ValueError(f"results[{i}].success missing or not a boolean")
+        prov = row.get("provider")
+        provider = str(prov.get("id")) if isinstance(prov, dict) else str(prov or "unknown")
+        records.append({"id": test_idx, "epoch": 1, "prompt_idx": prompt_idx,
+                        "provider": provider, "success": success,
+                        "score": str(row.get("score", ""))})
+    if not records:
+        raise ValueError("no result rows found")
+    records.sort(key=lambda r: (r["id"], r["prompt_idx"], r["provider"]))
+    return records

{proofbundle-1.4.0 → proofbundle-1.7.0}/src/proofbundle/bundle.py

@@ -132,7 +132,9 @@ def verify_bundle(bundle: Union[dict, str], *, expected_aud=None, expected_nonce
     # 2. merkle inclusion of the payload
     mk = _require_dict(_require(bundle, "merkle", "merkle"), "merkle")
     _reject_unknown(mk, _MERKLE_KEYS, "merkle")
-    hash_alg = mk.get("hash_alg", "sha256-rfc6962")
+    # v1.6 (external review): hash_alg is REQUIRED — the emitter always writes it, and a
+    # silent default is exactly where a future multi-alg version would hide an alg-confusion.
+    hash_alg = _require(mk, "hash_alg", "merkle.hash_alg")
     if hash_alg != "sha256-rfc6962":
         raise UnsupportedError(f"merkle hash_alg {hash_alg!r} not supported in v0.1")
     leaf_index = _require_int(mk, "leaf_index", "merkle.leaf_index")
@@ -189,6 +191,20 @@ def verify_bundle(bundle: Union[dict, str], *, expected_aud=None, expected_nonce
                     "sd-jwt-key-binding", False,
                     "issuer bound a holder key (cnf) but the presentation carries NO Key Binding JWT — "
                     "required proof-of-possession is missing (bearer downgrade, RFC 9901 §4.3)")
+        elif not sd_res.get("sig_checked"):
+            # v1.6 fail-closed (external review, CRITICAL): gating holder-binding on issuer
+            # verification opened a KEY-OMISSION downgrade — strip the KB-JWT AND drop
+            # issuer_public_key_b64, and a cnf-bound credential silently passed as a bearer
+            # token. A `cnf`-carrying SD-JWT whose issuer cannot be verified is REFUSED, never
+            # "structure-only passed". SD-JWTs without `cnf` keep the documented no-key
+            # backward-compat path unchanged.
+            sd_part, _ = split_key_binding(compact)
+            if _issuer_requires_holder_binding(sd_part):
+                result.add(
+                    "sd-jwt-key-binding", False,
+                    "SD-JWT declares a cnf holder key but NO issuer key was supplied — holder "
+                    "binding is unverifiable, refusing (fail-closed; supply "
+                    "sd_jwt_vc.issuer_public_key_b64)")
 
     return result
 
@@ -208,9 +224,9 @@ def recompute_merkle_root_b64(bundle: Union[dict, str]) -> dict:
         raise BundleFormatError("bundle must be a JSON object")
     payload = _b64d(_require(bundle, "payload_b64", "payload_b64"), "payload_b64")
     mk = _require_dict(_require(bundle, "merkle", "merkle"), "merkle")
-    # Validate hash_alg the same way verify_bundle does — recompute must not apply SHA-256/RFC-6962 primitives
-    # to a bundle that declares a different algorithm (audit LOW #11/#14).
-    hash_alg = mk.get("hash_alg", "sha256-rfc6962")
+    # Validate hash_alg the SAME way verify_bundle does — REQUIRED, not silently defaulted (release-review #13:
+    # the docstring claimed strict-as-verify_bundle but this defaulted a missing hash_alg; verify_bundle _require's it).
+    hash_alg = _require(mk, "hash_alg", "merkle.hash_alg")
     if hash_alg != "sha256-rfc6962":
         raise UnsupportedError(f"merkle hash_alg {hash_alg!r} not supported in v0.1")
     leaf_index = _require_int(mk, "leaf_index", "merkle.leaf_index")

{proofbundle-1.4.0 → proofbundle-1.7.0}/src/proofbundle/cli.py

@@ -48,11 +48,15 @@ def _cmd_emit_eval(args: argparse.Namespace) -> int:
 
 
 def _cmd_show_eval(args: argparse.Namespace) -> int:
+    from .bundle import load_bundle  # noqa: PLC0415
     from .evalclaim import (  # noqa: PLC0415
         DEFAULT_ASSURANCE, check_freshness, claim_warnings, decode_eval_claim, sd_jwt_hidden_count,
     )
     try:
-        claim = decode_eval_claim(args.receipt)
+        # Resolve the path to a dict ONCE and pass that object to every reader — a second per-function re-read of
+        # the same path would reopen a TOCTOU window (CWE-367) between the reads. Release-review fix 2026-07-02.
+        bundle = load_bundle(args.receipt)
+        claim = decode_eval_claim(bundle, expected_context=getattr(args, "context", None))
     except (OSError, ValueError, ProofBundleError) as exc:   # missing/invalid receipt file → clean exit, not a traceback
         print(f"ERROR: {exc}", file=sys.stderr)
         return 2
@@ -67,7 +71,7 @@ def _cmd_show_eval(args: argparse.Namespace) -> int:
     print(f"dataset    commit {claim['dataset_id_commit']}")
     print(f"issuer     {claim['issuer']}")
     print(f"timestamp  {claim['timestamp']}")
-    hidden = sd_jwt_hidden_count(args.receipt)
+    hidden = sd_jwt_hidden_count(bundle)
     if hidden is not None:
         print(f"sd-jwt     {hidden} field(s) withheld (selective disclosure)")
     fresh = check_freshness(claim)
@@ -80,10 +84,14 @@ def _cmd_show_eval(args: argparse.Namespace) -> int:
 
 
 def _cmd_verify(args: argparse.Namespace) -> int:
+    from .bundle import load_bundle  # noqa: PLC0415
     try:
-        result = verify_bundle(args.bundle, expected_aud=getattr(args, "aud", None),
+        # Resolve the path to a dict ONCE and pass it to both verify_bundle and recompute — a second per-function
+        # re-read of the same path reopens a TOCTOU window (release-review consistency fix, mirrors show-eval).
+        bundle = load_bundle(args.bundle)
+        result = verify_bundle(bundle, expected_aud=getattr(args, "aud", None),
                                expected_nonce=getattr(args, "nonce", None))
-        roots = recompute_merkle_root_b64(args.bundle) if args.verbose else None
+        roots = recompute_merkle_root_b64(bundle) if args.verbose else None
     except (ProofBundleError, OSError, ValueError) as exc:   # file/JSON/format errors → clean exit, never a raw traceback
         if args.json:
             print(json.dumps({"ok": False, "error": str(exc)}))
@@ -177,6 +185,50 @@ def _cmd_hf_token(args: argparse.Namespace) -> int:
         return 2
 
 
+def _cmd_audit_challenge(args: argparse.Namespace) -> int:
+    from .persample import audit_challenge  # noqa: PLC0415
+    try:
+        nonce = bytes.fromhex(args.nonce) if args.nonce else b""
+        indices = audit_challenge(args.root, args.n, args.k, nonce)
+    except (ProofBundleError, ValueError) as exc:
+        print(f"ERROR: {exc}", file=sys.stderr)
+        return 2
+    if args.json:
+        print(json.dumps({"indices": indices, "n": args.n, "k": args.k,
+                          "mode": "auditor-nonce" if args.nonce else "self-challenge"}))
+    else:
+        if not args.nonce:
+            print("WARNING: self-challenge mode (no --nonce) is a sanity check only — "
+                  "a producer can grind by re-salting; real audits supply a fresh nonce",
+                  file=sys.stderr)
+        print(" ".join(str(i) for i in indices))
+    return 0
+
+
+def _cmd_verify_opening(args: argparse.Namespace) -> int:
+    from .persample import verify_sample_opening  # noqa: PLC0415
+    try:
+        with open(args.opening, encoding="utf-8") as handle:
+            opening = json.load(handle)
+        res = verify_sample_opening(opening, args.root, args.n)
+    except (ProofBundleError, OSError, ValueError) as exc:
+        print(f"ERROR: {exc}", file=sys.stderr)
+        return 2
+    if args.json:
+        print(json.dumps(res))
+    else:
+        print(f"[{'PASS' if res['ok'] else 'FAIL'}] sample-opening: {res['detail']}")
+        if res["ok"]:
+            print(json.dumps(res["record"], indent=2))
+        print("=> OK" if res["ok"] else "=> FAILED")
+    return 0 if res["ok"] else 1
+
+
+def _cmd_demo(args: argparse.Namespace) -> int:
+    from .demo import run_demo  # noqa: PLC0415
+    return run_demo(as_json=args.json)
+
+
 def build_parser() -> argparse.ArgumentParser:
     parser = argparse.ArgumentParser(
         prog="proofbundle",
@@ -213,6 +265,8 @@ def build_parser() -> argparse.ArgumentParser:
 
     show_eval = sub.add_parser("show-eval", help="verify an eval receipt and print the claim")
     show_eval.add_argument("receipt", help="path to the eval receipt bundle JSON")
+    show_eval.add_argument("--context", dest="context", default=None,
+                           help="require the receipt's signed context_binding to equal this (cross-context replay guard)")
     show_eval.set_defaults(func=_cmd_show_eval)
 
     verify_proof = sub.add_parser(
@@ -238,6 +292,31 @@ def build_parser() -> argparse.ArgumentParser:
                           help="verify a pb1. token instead of emitting one")
     hf_token.set_defaults(func=_cmd_hf_token)
 
+    challenge = sub.add_parser(
+        "audit-challenge",
+        help="derive k audit indices from a samples root (v1.5; supply --nonce for real audits)")
+    challenge.add_argument("root", help="the receipt's samples root (base64)")
+    challenge.add_argument("n", type=int, help="committed sample count")
+    challenge.add_argument("k", type=int, help="number of samples to challenge")
+    challenge.add_argument("--nonce", help="fresh auditor nonce (hex, >=32 hex chars recommended)")
+    challenge.add_argument("--json", action="store_true", help="machine readable output")
+    challenge.set_defaults(func=_cmd_audit_challenge)
+
+    verify_opening = sub.add_parser(
+        "verify-opening", help="verify one sample opening against a samples root (v1.5)")
+    verify_opening.add_argument("opening", help="opening JSON file (index/disclosure/proof_b64)")
+    verify_opening.add_argument("--root", required=True, help="the receipt's samples root (base64)")
+    verify_opening.add_argument("--n", required=True, type=int, help="committed sample count")
+    verify_opening.add_argument("--json", action="store_true", help="machine readable output")
+    verify_opening.set_defaults(func=_cmd_verify_opening)
+
+    demo = sub.add_parser(
+        "demo",
+        help="run the whole trust story in memory (pip-only, offline): honest receipt verifies, "
+             "six tampers fail, a swapped sample is caught")
+    demo.add_argument("--json", action="store_true", help="machine readable output")
+    demo.set_defaults(func=_cmd_demo)
+
     return parser