proofbundle 1.4.0__tar.gz → 1.8.0__tar.gz

{proofbundle-1.4.0/src/proofbundle.egg-info → proofbundle-1.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofbundle
-Version: 1.4.0
+Version: 1.8.0
 Summary: Emit and verify portable cryptographic evidence bundles, offline: Ed25519 + RFC 6962 Merkle + optional SD-JWT.
 Author: Konrad Gruszka
 License: MIT
@@ -10,7 +10,7 @@ Project-URL: Issues, https://github.com/b7n0de/proofbundle/issues
 Project-URL: Changelog, https://github.com/b7n0de/proofbundle/blob/main/CHANGELOG.md
 Project-URL: Documentation, https://github.com/b7n0de/proofbundle#readme
 Keywords: cryptography,merkle,transparency-log,ed25519,sd-jwt,verifiable-credentials,attestation,provenance,rfc6962
-Classifier: Development Status :: 3 - Alpha
+Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Developers
 Classifier: License :: OSI Approved :: MIT License
 Classifier: Programming Language :: Python :: 3
@@ -63,13 +63,16 @@ revocation snapshots, aligned to the in-toto test-result predicate. One portable
 file, no server, no network.**
 
 [![CI](https://github.com/b7n0de/proofbundle/actions/workflows/ci.yml/badge.svg)](https://github.com/b7n0de/proofbundle/actions/workflows/ci.yml)
+[![License: MIT](https://img.shields.io/badge/license-MIT-D6248A.svg)](LICENSE)
+[![Ruff](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/ruff/main/assets/badge/v2.json)](https://github.com/astral-sh/ruff)
+<!-- Badges below are enabled AFTER the first PyPI release (they render broken/false before it,
+     which reads as abandonment). Un-comment on first publish — see RELEASE.md:
 [![PyPI](https://img.shields.io/pypi/v/proofbundle.svg?color=D6248A&cacheSeconds=3600)](https://pypi.org/project/proofbundle/)
 [![Python](https://img.shields.io/pypi/pyversions/proofbundle.svg?color=D6248A&cacheSeconds=3600)](https://pypi.org/project/proofbundle/)
 [![Downloads](https://static.pepy.tech/badge/proofbundle)](https://pepy.tech/project/proofbundle)
-[![License: MIT](https://img.shields.io/badge/license-MIT-D6248A.svg)](LICENSE)
-[![Ruff](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/ruff/main/assets/badge/v2.json)](https://github.com/astral-sh/ruff)
 [![SLSA build provenance](https://img.shields.io/badge/SLSA-build_provenance-D6248A.svg)](https://slsa.dev)
 [![PyPI attestations](https://img.shields.io/badge/PyPI-attestations_(PEP_740)-D6248A.svg)](https://pypi.org/project/proofbundle/)
+-->
 [![Post-quantum witnesses](https://img.shields.io/badge/PQ-ML--DSA--44_cosignatures-D6248A.svg)](https://github.com/C2SP/C2SP/blob/main/tlog-cosignature.md)
 [![Mutation tested](https://img.shields.io/badge/tests-mutation_gated-D6248A.svg)](scripts/mutation_check.py)
 [![C2SP tlog-proof](https://img.shields.io/badge/C2SP-tlog--proof-D6248A.svg)](https://github.com/C2SP/C2SP/blob/main/tlog-proof.md)
@@ -81,7 +84,7 @@ file, no server, no network.**
 
 **At a glance:** `proofbundle emit` signs and anchors a payload; `proofbundle
 verify` checks one self-contained `bundle.json` with three offline cryptographic
-checks → `OK` or `FAILED`. No network, no daemon, no own crypto. 209 tests + a CI mutation gate.
+checks → `OK` or `FAILED`. No network, no daemon, no own crypto. 289 tests + a CI mutation gate.
 
 ## Contents
 
@@ -146,6 +149,8 @@ not a proof that the number is *true* or that the evaluation was well designed.
 | `reproduced` | independently re-run and matched |
 | `enclave_attested` | produced in an attested trusted execution environment |
 
+Since v1.6 `decode_eval_claim(bundle, expected_context=...)` enforces the signed `context_binding` (cross-context replay guard), and verify-side re-checks the `samples.n == n` invariant — guarantees no longer live only in the emitter.
+
 Full detail: **[THREAT_MODEL.md](THREAT_MODEL.md)** — what `verify` catches and what it structurally cannot.
 
 ## What it verifies
@@ -223,7 +228,7 @@ pip install "proofbundle[sdjwt]"
 ## Quickstart
 
 ```bash
-# generate a real example bundle with throwaway keys
+# from a git checkout (examples/ ships in the repo, not the wheel):
 python examples/make_example.py
 
 # verify it
@@ -234,6 +239,15 @@ proofbundle verify examples/example_bundle.json
 <img src="assets/demo.svg" alt="proofbundle verify output: PASS checks and OK" width="680">
 </div>
 
+See the whole trust story in five seconds — pip-only, offline, in memory (honest receipt verifies, six tampers fail, a swapped sample is caught):
+
+```bash
+pip install proofbundle
+proofbundle demo
+```
+
+Full walkthrough incl. the forced-random-sample audit: **[docs/DEMO.md](docs/DEMO.md)**.
+
 Machine-readable output and a non-zero exit code on failure:
 
 ```bash
@@ -327,7 +341,7 @@ Since v1.2 proofbundle also speaks the witness layer:
 (Ed25519 cosignature/v1) — `verify_witnessed_checkpoint` checks a checkpoint is
 both log-signed **and** cosigned by a quorum of distinct witnesses, offline,
 which rules out a split view by the log operator. This is the same
-witnessed-checkpoint pattern Rekor v2 (GA October 2025) institutionalizes.
+witnessed-checkpoint pattern Rekor v2 (GA October 2025) is integrating.
 
 Since v1.3 the witness layer is complete: **ML-DSA-44 cosignatures** (C2SP type
 0x06, FIPS 204 — post-quantum, the spec's SHOULD for new witness deployments;
@@ -551,15 +565,25 @@ ISO/IEC DIS 24970), including the anti-patterns no one should claim.
   Status List** snapshot verification (offline revocation), SD-JWT VC markers (`dc+sd-jwt`,
   `vct`, `status`), COMPLIANCE.md (EU AI Act Art. 12 / NIST AI RMF mapping), and the mutation
   suite as a CI gate.
-- **v1.4 (current release)** — distribution: a **promptfoo** adapter (results.json v3 →
+- **v1.4** — distribution: a **promptfoo** adapter (results.json v3 →
   pass_rate receipt), the **Hugging Face Community Evals bridge** (`pb1.` receipt tokens for the
   `.eval_results` `verifyToken` field + a strict YAML entry emitter — proofbundle-verifiable,
   explicitly NOT the HF-internal badge token), `hf-token` CLI, and the **Python 3.10+ floor**
   (3.9 is EOL since 2025-10).
-- **v2.0 (next major, research differentiation)** — **per-sample Merkle receipts**: the payload carries a
-  Merkle root over *individual* sample results, so a verifier can force a random-sample re-check instead of
-  trusting only the reported aggregate. This is the THREAT_MODEL's one named structural gap ("forced random
-  sub-sampling"), and closing it is the road from *authorship* to *sampled correctness*.
+- **v1.5** — per-sample receipts: a signed **Merkle commitment over every
+  individual sample** (`samples` claim field, SPEC §7g), salted per-leaf disclosures (RFC 9901
+  mechanic), **sample openings** with replay guards, and a **spot-check audit protocol**
+  (`audit-challenge` / `verify-opening` CLI; auditor-nonce, beacon, and documented-grindable
+  self-challenge modes; PoR soundness 1−(1−m)^k) — narrowing the THREAT_MODEL's sub-sampling gap.
+  Extractors for lm-eval `--log_samples` JSONL and promptfoo rows.
+- **v1.6** — external principal-security review fixes: verify-side sample/`leaf_alg`/root invariants
+  and signed `context_binding` enforcement (was signed but unchecked), status-list freshness
+  (`exp`/`ttl` None-safe), `merkle.hash_alg` now required; Beta classifier; 26-operator mutation gate.
+- **v1.6.1** — developer experience: `proofbundle demo` (pip-only, fail-closed tamper smoke test), a
+  runnable per-sample example, `docs/DEMO.md`.
+- **v1.7 (current release)** — release supply-chain hardening: `release.yml` builds once and
+  publishes the **attested** bytes (sha256 gate: attested == published), a reviewer-gated `pypi`
+  environment, least-privilege permissions, SHA-pinned actions, `RELEASE.md` + `docs/REVIEWERS.md`.
 - **Deferred** (explicitly not yet built, stated honestly) — full SD-JWT VC conformance + `vct`
   type-metadata resolution (pre-IESG), an official in-toto eval predicate (proposal path via
   OpenSSF/CoSAI), and a full in-toto client.

{proofbundle-1.4.0 → proofbundle-1.8.0}/README.md

@@ -15,13 +15,16 @@ revocation snapshots, aligned to the in-toto test-result predicate. One portable
 file, no server, no network.**
 
 [![CI](https://github.com/b7n0de/proofbundle/actions/workflows/ci.yml/badge.svg)](https://github.com/b7n0de/proofbundle/actions/workflows/ci.yml)
+[![License: MIT](https://img.shields.io/badge/license-MIT-D6248A.svg)](LICENSE)
+[![Ruff](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/ruff/main/assets/badge/v2.json)](https://github.com/astral-sh/ruff)
+<!-- Badges below are enabled AFTER the first PyPI release (they render broken/false before it,
+     which reads as abandonment). Un-comment on first publish — see RELEASE.md:
 [![PyPI](https://img.shields.io/pypi/v/proofbundle.svg?color=D6248A&cacheSeconds=3600)](https://pypi.org/project/proofbundle/)
 [![Python](https://img.shields.io/pypi/pyversions/proofbundle.svg?color=D6248A&cacheSeconds=3600)](https://pypi.org/project/proofbundle/)
 [![Downloads](https://static.pepy.tech/badge/proofbundle)](https://pepy.tech/project/proofbundle)
-[![License: MIT](https://img.shields.io/badge/license-MIT-D6248A.svg)](LICENSE)
-[![Ruff](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/ruff/main/assets/badge/v2.json)](https://github.com/astral-sh/ruff)
 [![SLSA build provenance](https://img.shields.io/badge/SLSA-build_provenance-D6248A.svg)](https://slsa.dev)
 [![PyPI attestations](https://img.shields.io/badge/PyPI-attestations_(PEP_740)-D6248A.svg)](https://pypi.org/project/proofbundle/)
+-->
 [![Post-quantum witnesses](https://img.shields.io/badge/PQ-ML--DSA--44_cosignatures-D6248A.svg)](https://github.com/C2SP/C2SP/blob/main/tlog-cosignature.md)
 [![Mutation tested](https://img.shields.io/badge/tests-mutation_gated-D6248A.svg)](scripts/mutation_check.py)
 [![C2SP tlog-proof](https://img.shields.io/badge/C2SP-tlog--proof-D6248A.svg)](https://github.com/C2SP/C2SP/blob/main/tlog-proof.md)
@@ -33,7 +36,7 @@ file, no server, no network.**
 
 **At a glance:** `proofbundle emit` signs and anchors a payload; `proofbundle
 verify` checks one self-contained `bundle.json` with three offline cryptographic
-checks → `OK` or `FAILED`. No network, no daemon, no own crypto. 209 tests + a CI mutation gate.
+checks → `OK` or `FAILED`. No network, no daemon, no own crypto. 289 tests + a CI mutation gate.
 
 ## Contents
 
@@ -98,6 +101,8 @@ not a proof that the number is *true* or that the evaluation was well designed.
 | `reproduced` | independently re-run and matched |
 | `enclave_attested` | produced in an attested trusted execution environment |
 
+Since v1.6 `decode_eval_claim(bundle, expected_context=...)` enforces the signed `context_binding` (cross-context replay guard), and verify-side re-checks the `samples.n == n` invariant — guarantees no longer live only in the emitter.
+
 Full detail: **[THREAT_MODEL.md](THREAT_MODEL.md)** — what `verify` catches and what it structurally cannot.
 
 ## What it verifies
@@ -175,7 +180,7 @@ pip install "proofbundle[sdjwt]"
 ## Quickstart
 
 ```bash
-# generate a real example bundle with throwaway keys
+# from a git checkout (examples/ ships in the repo, not the wheel):
 python examples/make_example.py
 
 # verify it
@@ -186,6 +191,15 @@ proofbundle verify examples/example_bundle.json
 <img src="assets/demo.svg" alt="proofbundle verify output: PASS checks and OK" width="680">
 </div>
 
+See the whole trust story in five seconds — pip-only, offline, in memory (honest receipt verifies, six tampers fail, a swapped sample is caught):
+
+```bash
+pip install proofbundle
+proofbundle demo
+```
+
+Full walkthrough incl. the forced-random-sample audit: **[docs/DEMO.md](docs/DEMO.md)**.
+
 Machine-readable output and a non-zero exit code on failure:
 
 ```bash
@@ -279,7 +293,7 @@ Since v1.2 proofbundle also speaks the witness layer:
 (Ed25519 cosignature/v1) — `verify_witnessed_checkpoint` checks a checkpoint is
 both log-signed **and** cosigned by a quorum of distinct witnesses, offline,
 which rules out a split view by the log operator. This is the same
-witnessed-checkpoint pattern Rekor v2 (GA October 2025) institutionalizes.
+witnessed-checkpoint pattern Rekor v2 (GA October 2025) is integrating.
 
 Since v1.3 the witness layer is complete: **ML-DSA-44 cosignatures** (C2SP type
 0x06, FIPS 204 — post-quantum, the spec's SHOULD for new witness deployments;
@@ -503,15 +517,25 @@ ISO/IEC DIS 24970), including the anti-patterns no one should claim.
   Status List** snapshot verification (offline revocation), SD-JWT VC markers (`dc+sd-jwt`,
   `vct`, `status`), COMPLIANCE.md (EU AI Act Art. 12 / NIST AI RMF mapping), and the mutation
   suite as a CI gate.
-- **v1.4 (current release)** — distribution: a **promptfoo** adapter (results.json v3 →
+- **v1.4** — distribution: a **promptfoo** adapter (results.json v3 →
   pass_rate receipt), the **Hugging Face Community Evals bridge** (`pb1.` receipt tokens for the
   `.eval_results` `verifyToken` field + a strict YAML entry emitter — proofbundle-verifiable,
   explicitly NOT the HF-internal badge token), `hf-token` CLI, and the **Python 3.10+ floor**
   (3.9 is EOL since 2025-10).
-- **v2.0 (next major, research differentiation)** — **per-sample Merkle receipts**: the payload carries a
-  Merkle root over *individual* sample results, so a verifier can force a random-sample re-check instead of
-  trusting only the reported aggregate. This is the THREAT_MODEL's one named structural gap ("forced random
-  sub-sampling"), and closing it is the road from *authorship* to *sampled correctness*.
+- **v1.5** — per-sample receipts: a signed **Merkle commitment over every
+  individual sample** (`samples` claim field, SPEC §7g), salted per-leaf disclosures (RFC 9901
+  mechanic), **sample openings** with replay guards, and a **spot-check audit protocol**
+  (`audit-challenge` / `verify-opening` CLI; auditor-nonce, beacon, and documented-grindable
+  self-challenge modes; PoR soundness 1−(1−m)^k) — narrowing the THREAT_MODEL's sub-sampling gap.
+  Extractors for lm-eval `--log_samples` JSONL and promptfoo rows.
+- **v1.6** — external principal-security review fixes: verify-side sample/`leaf_alg`/root invariants
+  and signed `context_binding` enforcement (was signed but unchecked), status-list freshness
+  (`exp`/`ttl` None-safe), `merkle.hash_alg` now required; Beta classifier; 26-operator mutation gate.
+- **v1.6.1** — developer experience: `proofbundle demo` (pip-only, fail-closed tamper smoke test), a
+  runnable per-sample example, `docs/DEMO.md`.
+- **v1.7 (current release)** — release supply-chain hardening: `release.yml` builds once and
+  publishes the **attested** bytes (sha256 gate: attested == published), a reviewer-gated `pypi`
+  environment, least-privilege permissions, SHA-pinned actions, `RELEASE.md` + `docs/REVIEWERS.md`.
 - **Deferred** (explicitly not yet built, stated honestly) — full SD-JWT VC conformance + `vct`
   type-metadata resolution (pre-IESG), an official in-toto eval predicate (proposal path via
   OpenSSF/CoSAI), and a full in-toto client.

{proofbundle-1.4.0 → proofbundle-1.8.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "proofbundle"
-version = "1.4.0"
+version = "1.8.0"
 description = "Emit and verify portable cryptographic evidence bundles, offline: Ed25519 + RFC 6962 Merkle + optional SD-JWT."
 readme = "README.md"
 requires-python = ">=3.10"
@@ -22,7 +22,7 @@ keywords = [
     "rfc6962",
 ]
 classifiers = [
-    "Development Status :: 3 - Alpha",
+    "Development Status :: 4 - Beta",
     "Intended Audience :: Developers",
     "License :: OSI Approved :: MIT License",
     "Programming Language :: Python :: 3",

{proofbundle-1.4.0 → proofbundle-1.8.0}/src/proofbundle/__init__.py

@@ -13,7 +13,7 @@ from __future__ import annotations
 
 from typing import TYPE_CHECKING
 
-__version__ = "1.4.0"
+__version__ = "1.8.0"
 
 __all__ = [
     "__version__",
@@ -32,6 +32,12 @@ __all__ = [
     "verify_status_snapshot",
     "receipt_token",
     "verify_receipt_token",
+    "build_sample_tree",
+    "sample_opening",
+    "verify_sample_opening",
+    "audit_challenge",
+    "prereg_hash",
+    "verify_prereg",
     "VerificationResult",
     "Check",
     "ProofBundleError",
@@ -51,6 +57,12 @@ _LAZY = {
     "verify_status_snapshot": ".statuslist",
     "receipt_token": ".hf_evals",
     "verify_receipt_token": ".hf_evals",
+    "build_sample_tree": ".persample",
+    "sample_opening": ".persample",
+    "verify_sample_opening": ".persample",
+    "audit_challenge": ".persample",
+    "prereg_hash": ".prereg",
+    "verify_prereg": ".prereg",
 }
 
 if TYPE_CHECKING:  # static analysers + IDEs see the real names/types; runtime stays lazy
@@ -60,6 +72,9 @@ if TYPE_CHECKING:  # static analysers + IDEs see the real names/types; runtime s
     from .checkpoint import verify_cosignature, verify_witnessed_checkpoint
     from .kbjwt import verify_key_binding
     from .hf_evals import receipt_token, verify_receipt_token
+    from .persample import (audit_challenge, build_sample_tree, sample_opening,
+                            verify_sample_opening)
+    from .prereg import prereg_hash, verify_prereg
     from .statuslist import verify_status_snapshot
     from .tlogproof import verify_tlog_proof
     from .merkle import verify_consistency, verify_inclusion

{proofbundle-1.4.0 → proofbundle-1.8.0}/src/proofbundle/adapters/__init__.py

@@ -8,6 +8,8 @@ from .inspect_ai import from_inspect_ai_log
 from .eee import from_eee_dataset
 from .lm_eval import from_lm_eval_results
 from .promptfoo import from_promptfoo_results
+from .samples import samples_from_lm_eval_jsonl, samples_from_promptfoo_results
 
 __all__ = ["from_lm_eval_results", "from_inspect_ai_log", "from_eee_dataset",
-           "from_promptfoo_results"]
+           "from_promptfoo_results",
+           "samples_from_lm_eval_jsonl", "samples_from_promptfoo_results"]

proofbundle-1.8.0/src/proofbundle/adapters/_provenance.py

@@ -0,0 +1,63 @@
+"""Shared provenance helpers for adapters (v1.8).
+
+The external review found that run-id and config-hash were missing from nearly every adapter and
+that the two flagship adapters took the timestamp from the caller rather than the eval log. These
+helpers close that: each adapter now records, where the framework exposes it, a stable RUN id, a
+CONFIG hash, and the LOG-NATIVE timestamp — so a receipt is traceable back to the exact run.
+
+Design notes (verified against framework source, 2026-07):
+  - No framework ships a canonical config hash, so we compute our own. Config is an in-memory
+    object re-serialized non-deterministically, so it MUST be canonicalized before hashing —
+    RFC 8785 JCS via the same `rfc8785` extra the emit path already needs. If that extra is
+    absent we fall back to a deterministic `json.dumps(sort_keys=True)` and LABEL the hash
+    algorithm accordingly, so a verifier is never misled about how the hash was formed.
+  - The hash is over the config's JSON, prefixed with a domain tag, hex sha256. It is provenance
+    metadata (traceability), NOT a security commitment — it is not salted and reveals structure;
+    it exists so two receipts from the same config are linkable and a changed config is visible.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+from typing import Optional
+
+_CONFIG_DOMAIN = b"proofbundle/v1.8/config-hash\x00"
+
+
+def config_hash(config) -> Optional[str]:
+    """Return ``"<alg>:<hex>"`` over the canonical JSON of a config object, or None if it is
+    empty/None. ``<alg>`` is ``sha256-jcs`` when RFC 8785 is available, else ``sha256-sortkeys``
+    (both deterministic; the label tells a verifier which normalization produced the hex)."""
+    if config is None or config == {} or config == []:
+        return None
+    try:
+        import rfc8785  # noqa: PLC0415 — same optional dep as the emit path
+        canonical = rfc8785.dumps(config)
+        alg = "sha256-jcs"
+    except (ImportError, ValueError, TypeError):
+        # rfc8785 rejects non-JCS-able values (e.g. floats it deems unsafe); fall back to a
+        # deterministic stdlib serialization and label it so the difference is never hidden.
+        try:
+            canonical = json.dumps(config, sort_keys=True, separators=(",", ":"),
+                                   ensure_ascii=False).encode("utf-8")
+        except (TypeError, ValueError):
+            return None
+        alg = "sha256-sortkeys"
+    return f"{alg}:{hashlib.sha256(_CONFIG_DOMAIN + canonical).hexdigest()}"
+
+
+def add_provenance(provenance: dict, *, run_id=None, config=None, log_timestamp=None,
+                   config_hash_value: Optional[str] = None) -> dict:
+    """Merge the standard traceability fields into a provenance dict, skipping absent ones.
+
+    ``config_hash_value`` lets a caller pass a precomputed hash (e.g. over already-canonical
+    material) instead of a config object; otherwise ``config`` is hashed here."""
+    if run_id:
+        provenance["run_id"] = str(run_id)
+    if log_timestamp is not None:
+        provenance["run_timestamp"] = str(log_timestamp)
+    ch = config_hash_value if config_hash_value is not None else config_hash(config)
+    if ch:
+        provenance["config_hash"] = ch
+    return provenance

{proofbundle-1.4.0 → proofbundle-1.8.0}/src/proofbundle/adapters/eee.py

@@ -5,7 +5,7 @@ it has no cryptography. This converter is strictly additive: it reads an EEE agg
 signed, selectively-disclosable proofbundle receipt from it.
 
 IMPORTANT: `every_eval_ever` is NOT imported at runtime — it requires Python 3.12+ (pydantic/numpy/pandas/
-duckdb), while proofbundle stays 3.9+. We parse the EEE JSON directly and OPTIONALLY validate it against the
+duckdb), while proofbundle stays 3.10+. We parse the EEE JSON directly and OPTIONALLY validate it against the
 vendored `eee_eval_schema.json` (schema version 0.2.2, MIT) using `jsonschema` if available.
 
 Field mapping (verified 2026-07 against schemas/eval.schema.json v0.2.2):

{proofbundle-1.4.0 → proofbundle-1.8.0}/src/proofbundle/adapters/inspect_ai.py

@@ -90,6 +90,15 @@ def from_inspect_ai_log(path, metric: str, *, comparator: str, threshold: str, t
     if tv is not None:
         provenance["task_version"] = str(tv)
 
+    # v1.8 (external review): run-id + config-hash + LOG-NATIVE timestamp so a receipt traces back
+    # to the exact run. inspect_ai: eval.run_id (unique run id), eval.created (UTC datetime string),
+    # eval.task_args (the config material — no native config hash exists, so we compute one).
+    from ._provenance import add_provenance  # noqa: PLC0415
+    task_args = getattr(ev, "task_args", None)
+    add_provenance(provenance, run_id=getattr(ev, "run_id", None),
+                   config=task_args if isinstance(task_args, dict) else None,
+                   log_timestamp=getattr(ev, "created", None))
+
     return build_eval_claim(
         suite=suite, suite_version=str(getattr(ev, "task_version", "1")),
         metric=metric, comparator=comparator, threshold=threshold, score=_score_str(value),

{proofbundle-1.4.0 → proofbundle-1.8.0}/src/proofbundle/adapters/lm_eval.py

@@ -71,6 +71,16 @@ def from_lm_eval_results(path, task: str, metric: str, *, comparator: str, thres
     if stderr is not None:
         provenance["stderr"] = repr(stderr) if not isinstance(stderr, str) else stderr
 
+    # v1.8 (external review): config-hash + LOG-NATIVE timestamp. lm-eval has no dedicated run-id;
+    # its `date` is a Unix float (distinct from the ISO filename stamp). `config` is the run config
+    # block (model/args/seeds/gen_kwargs); no native hash exists, so we compute one.
+    from ._provenance import add_provenance  # noqa: PLC0415
+    add_provenance(provenance, config=cfg if isinstance(cfg, dict) and cfg else None,
+                   log_timestamp=data.get("date"))
+    task_hashes = data.get("task_hashes", {})
+    if isinstance(task_hashes, dict) and task_hashes.get(task):
+        provenance["task_hash"] = str(task_hashes[task])   # lm-eval's native per-task sample hash
+
     return build_eval_claim(
         suite=task, suite_version=str(data.get("versions", {}).get(task, "lm-eval")),
         metric=metric, comparator=comparator, threshold=threshold, score=str(score), n=n,

{proofbundle-1.4.0 → proofbundle-1.8.0}/src/proofbundle/adapters/promptfoo.py

@@ -124,6 +124,13 @@ def from_promptfoo_results(path, *, comparator: str, threshold: str, timestamp:
     if summary.get("timestamp"):
         provenance["run_timestamp"] = str(summary["timestamp"])
 
+    # v1.8 (external review): a uniform run_id key across adapters + a config-hash over the FULL
+    # resolved suite config (providers/prompts/tests/…), not just the tests-derived dataset id.
+    from ._provenance import add_provenance  # noqa: PLC0415
+    add_provenance(provenance, run_id=eval_id,
+                   config=config if isinstance(config, dict) and config else None,
+                   log_timestamp=metadata.get("evaluationCreatedAt"))
+
     return build_eval_claim(
         suite=suite, suite_version=f"promptfoo-summary-v{version}",
         metric="pass_rate", comparator=comparator, threshold=threshold, score=score, n=n,

proofbundle-1.8.0/src/proofbundle/adapters/samples.py

@@ -0,0 +1,82 @@
+"""Per-sample record extractors for the v1.5 sample tree (file-based, no framework imports).
+
+Each extractor maps a framework's per-sample export into small, canonical leaf records for
+:func:`proofbundle.persample.build_sample_tree`. Records are returned in canonical order
+(sorted by the framework's stable sample identity) — the tree builder assigns and embeds `idx`.
+
+Privacy layering (two-layer hiding, per the v1.5 design): records carry the framework's
+CONTENT HASHES (or compact result fields), never benchmark plaintext — so opening a sample for
+audit reveals the model's result without necessarily revealing the benchmark item's text.
+lm-evaluation-harness conveniently already emits per-doc `doc_hash`/`prompt_hash`/`target_hash`
+(SHA-256, verified against lm_eval/evaluator.py) — note these are UNSALTED upstream hashes and
+therefore linkable on their own; hiding comes from the salted disclosure wrapping them, which is
+why they go INSIDE the leaf, never beside it.
+"""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+from typing import List
+
+
+def samples_from_lm_eval_jsonl(path) -> List[dict]:
+    """Read an lm-evaluation-harness ``--log_samples`` JSONL (samples_<task>_*.jsonl) into leaf
+    records: (doc_id, filter, doc/prompt/target hashes, filtered responses, metric values).
+
+    Sorted by (doc_id, filter). Metric values are stringified (leaves are transport artifacts;
+    numeric canonicalization stays out of the commitment)."""
+    records = []
+    for line_no, line in enumerate(Path(path).read_text(encoding="utf-8").splitlines(), 1):
+        if not line.strip():
+            continue
+        try:
+            row = json.loads(line)
+        except json.JSONDecodeError as exc:
+            raise ValueError(f"line {line_no}: not valid JSON") from exc
+        if not isinstance(row, dict) or "doc_id" not in row:
+            raise ValueError(f"line {line_no}: not an lm-eval sample row")
+        doc_id = row.get("doc_id")
+        if isinstance(doc_id, bool) or not isinstance(doc_id, int):
+            raise ValueError(f"line {line_no}: doc_id missing or not an integer")
+        metrics = row.get("metrics") or []
+        rec = {"id": doc_id, "epoch": 1, "filter": str(row.get("filter", "none")),
+               "doc_hash": str(row.get("doc_hash", "")),
+               "prompt_hash": str(row.get("prompt_hash", "")),
+               "target_hash": str(row.get("target_hash", "")),
+               "filtered_resps": [str(r) for r in (row.get("filtered_resps") or [])],
+               "metrics": {m: str(row[m]) for m in metrics if m in row}}
+        records.append(rec)
+    if not records:
+        raise ValueError("no sample rows found")
+    records.sort(key=lambda r: (r["id"], r["filter"]))
+    return records
+
+
+def samples_from_promptfoo_results(path) -> List[dict]:
+    """Read a promptfoo results.json (summary v3) into leaf records:
+    (testIdx, promptIdx, provider, success, score). Sorted by (testIdx, promptIdx, provider)."""
+    data = json.loads(Path(path).read_text(encoding="utf-8"))
+    summary = data.get("results")
+    if not isinstance(summary, dict) or summary.get("version") != 3:
+        raise ValueError("not a promptfoo v3 output file (see adapters.promptfoo)")
+    records = []
+    for i, row in enumerate(summary.get("results") or []):
+        if not isinstance(row, dict):
+            raise ValueError(f"results[{i}] is not an object")
+        test_idx, prompt_idx = row.get("testIdx"), row.get("promptIdx")
+        for name, val in (("testIdx", test_idx), ("promptIdx", prompt_idx)):
+            if isinstance(val, bool) or not isinstance(val, int):
+                raise ValueError(f"results[{i}].{name} missing or not an integer")
+        success = row.get("success")
+        if not isinstance(success, bool):
+            raise ValueError(f"results[{i}].success missing or not a boolean")
+        prov = row.get("provider")
+        provider = str(prov.get("id")) if isinstance(prov, dict) else str(prov or "unknown")
+        records.append({"id": test_idx, "epoch": 1, "prompt_idx": prompt_idx,
+                        "provider": provider, "success": success,
+                        "score": str(row.get("score", ""))})
+    if not records:
+        raise ValueError("no result rows found")
+    records.sort(key=lambda r: (r["id"], r["prompt_idx"], r["provider"]))
+    return records

{proofbundle-1.4.0 → proofbundle-1.8.0}/src/proofbundle/bundle.py

@@ -132,7 +132,9 @@ def verify_bundle(bundle: Union[dict, str], *, expected_aud=None, expected_nonce
     # 2. merkle inclusion of the payload
     mk = _require_dict(_require(bundle, "merkle", "merkle"), "merkle")
     _reject_unknown(mk, _MERKLE_KEYS, "merkle")
-    hash_alg = mk.get("hash_alg", "sha256-rfc6962")
+    # v1.6 (external review): hash_alg is REQUIRED — the emitter always writes it, and a
+    # silent default is exactly where a future multi-alg version would hide an alg-confusion.
+    hash_alg = _require(mk, "hash_alg", "merkle.hash_alg")
     if hash_alg != "sha256-rfc6962":
         raise UnsupportedError(f"merkle hash_alg {hash_alg!r} not supported in v0.1")
     leaf_index = _require_int(mk, "leaf_index", "merkle.leaf_index")
@@ -189,6 +191,20 @@ def verify_bundle(bundle: Union[dict, str], *, expected_aud=None, expected_nonce
                     "sd-jwt-key-binding", False,
                     "issuer bound a holder key (cnf) but the presentation carries NO Key Binding JWT — "
                     "required proof-of-possession is missing (bearer downgrade, RFC 9901 §4.3)")
+        elif not sd_res.get("sig_checked"):
+            # v1.6 fail-closed (external review, CRITICAL): gating holder-binding on issuer
+            # verification opened a KEY-OMISSION downgrade — strip the KB-JWT AND drop
+            # issuer_public_key_b64, and a cnf-bound credential silently passed as a bearer
+            # token. A `cnf`-carrying SD-JWT whose issuer cannot be verified is REFUSED, never
+            # "structure-only passed". SD-JWTs without `cnf` keep the documented no-key
+            # backward-compat path unchanged.
+            sd_part, _ = split_key_binding(compact)
+            if _issuer_requires_holder_binding(sd_part):
+                result.add(
+                    "sd-jwt-key-binding", False,
+                    "SD-JWT declares a cnf holder key but NO issuer key was supplied — holder "
+                    "binding is unverifiable, refusing (fail-closed; supply "
+                    "sd_jwt_vc.issuer_public_key_b64)")
 
     return result
 
@@ -208,9 +224,9 @@ def recompute_merkle_root_b64(bundle: Union[dict, str]) -> dict:
         raise BundleFormatError("bundle must be a JSON object")
     payload = _b64d(_require(bundle, "payload_b64", "payload_b64"), "payload_b64")
     mk = _require_dict(_require(bundle, "merkle", "merkle"), "merkle")
-    # Validate hash_alg the same way verify_bundle does — recompute must not apply SHA-256/RFC-6962 primitives
-    # to a bundle that declares a different algorithm (audit LOW #11/#14).
-    hash_alg = mk.get("hash_alg", "sha256-rfc6962")
+    # Validate hash_alg the SAME way verify_bundle does — REQUIRED, not silently defaulted (release-review #13:
+    # the docstring claimed strict-as-verify_bundle but this defaulted a missing hash_alg; verify_bundle _require's it).
+    hash_alg = _require(mk, "hash_alg", "merkle.hash_alg")
     if hash_alg != "sha256-rfc6962":
         raise UnsupportedError(f"merkle hash_alg {hash_alg!r} not supported in v0.1")
     leaf_index = _require_int(mk, "leaf_index", "merkle.leaf_index")