proofbundle 1.9.1__tar.gz → 1.9.2__tar.gz

{proofbundle-1.9.1/src/proofbundle.egg-info → proofbundle-1.9.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofbundle
-Version: 1.9.1
+Version: 1.9.2
 Summary: Emit and verify portable cryptographic evidence bundles, offline: Ed25519 + RFC 6962 Merkle + optional SD-JWT.
 Author: Konrad Gruszka
 License: MIT
@@ -55,9 +55,11 @@ Dynamic: license-file
 
 <h1>proofbundle</h1>
 
-**Turn an AI eval result into one portable, offline-verifiable receipt.**
-It proves *who signed these exact bytes* and *that nothing changed since* — not that the number is
-true. Ed25519 + RFC 6962 Merkle, one file, no server, no network.
+**AI eval results need receipts.**
+
+Turn an AI evaluation result into one portable, offline-verifiable receipt. It proves *who signed
+these exact bytes* and *that nothing changed since* — not that the number is true. Ed25519 + RFC 6962
+Merkle, one file, no server, no network.
 
 [![CI](https://github.com/b7n0de/proofbundle/actions/workflows/ci.yml/badge.svg)](https://github.com/b7n0de/proofbundle/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/license-MIT-D6248A.svg)](LICENSE)
@@ -108,6 +110,13 @@ This boundary is the point, not a weakness. A receipt makes a claim **attributab
 and — with pre-registration and per-sample auditing — bounded and spot-checkable**. Full detail:
 **[THREAT_MODEL.md](THREAT_MODEL.md)**.
 
+## In plain language
+
+A proofbundle receipt is the cash-register receipt of an AI test result: it shows who claimed the
+number and that nobody quietly changed it afterwards. It does not show the test was good — the way a
+cash-register receipt does not show the meal was good — but without a receipt there is nothing to
+check at all.
+
 ## How it fits together
 
 ```mermaid
@@ -132,13 +141,16 @@ flowchart LR
 - **Transparency-log interop** — C2SP `tlog-checkpoint` / cosignature / `.tlog-proof`, with
   post-quantum **ML-DSA-44** witness cosignatures. Optional Token-Status-List revocation snapshots.
 - **Per-sample audit** — commit to every sample; an auditor challenges random indices (with a fresh
-  nonce or a **public randomness beacon**, v1.9) and openings must bind to the signed root. Catches
-  1% sample-doctoring with 95% confidence at 300 samples, regardless of run size.
+  nonce or a **public randomness beacon**, v1.9) and openings must bind to the signed root. With
+  such an auditor-supplied or beacon-bound challenge, 300 samples catch 1% sample-doctoring with 95%
+  confidence, regardless of run size — a challenge the issuer chose itself does not give this
+  guarantee.
 - **Pre-registration** — `proofbundle prereg <plan>` commits to the protocol before the run, so
   best-of-many publishing becomes visible.
 - **Integrations** — opt-in inspect_ai end-of-task hook and pytest plugin (emit only when
   `PROOFBUNDLE_EMIT=1` / `--proofbundle`), plus a Hugging Face Community Evals bridge. See
-  [INTEGRATIONS.md](INTEGRATIONS.md).
+  [INTEGRATIONS.md](INTEGRATIONS.md), or the end-to-end walkthrough
+  [docs/INSPECT_HAPPY_PATH.md](docs/INSPECT_HAPPY_PATH.md) — run an eval, get a receipt, verify it offline.
 
 ## Docs
 
@@ -168,7 +180,7 @@ Requires Python 3.10+. The verify path never rolls its own crypto — Ed25519 co
 
 ## Status & scope
 
-Beta, SemVer-committed, 303 tests + a CI mutation gate + property-based parser fuzzing. Correctness
+Beta, SemVer-committed, with a CI test suite behind a mutation gate + property-based parser fuzzing. Correctness
 is anchored to external RFC 6962 vectors and a real Rekor proof, not just its own bundles. It is
 **not** a log service, a full in-toto client, a TEE, a consensus network, or a compliance product
 by itself — it is the small, offline, standards-native receipt layer between them. Security policy:

{proofbundle-1.9.1 → proofbundle-1.9.2}/README.md

@@ -7,9 +7,11 @@
 
 <h1>proofbundle</h1>
 
-**Turn an AI eval result into one portable, offline-verifiable receipt.**
-It proves *who signed these exact bytes* and *that nothing changed since* — not that the number is
-true. Ed25519 + RFC 6962 Merkle, one file, no server, no network.
+**AI eval results need receipts.**
+
+Turn an AI evaluation result into one portable, offline-verifiable receipt. It proves *who signed
+these exact bytes* and *that nothing changed since* — not that the number is true. Ed25519 + RFC 6962
+Merkle, one file, no server, no network.
 
 [![CI](https://github.com/b7n0de/proofbundle/actions/workflows/ci.yml/badge.svg)](https://github.com/b7n0de/proofbundle/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/license-MIT-D6248A.svg)](LICENSE)
@@ -60,6 +62,13 @@ This boundary is the point, not a weakness. A receipt makes a claim **attributab
 and — with pre-registration and per-sample auditing — bounded and spot-checkable**. Full detail:
 **[THREAT_MODEL.md](THREAT_MODEL.md)**.
 
+## In plain language
+
+A proofbundle receipt is the cash-register receipt of an AI test result: it shows who claimed the
+number and that nobody quietly changed it afterwards. It does not show the test was good — the way a
+cash-register receipt does not show the meal was good — but without a receipt there is nothing to
+check at all.
+
 ## How it fits together
 
 ```mermaid
@@ -84,13 +93,16 @@ flowchart LR
 - **Transparency-log interop** — C2SP `tlog-checkpoint` / cosignature / `.tlog-proof`, with
   post-quantum **ML-DSA-44** witness cosignatures. Optional Token-Status-List revocation snapshots.
 - **Per-sample audit** — commit to every sample; an auditor challenges random indices (with a fresh
-  nonce or a **public randomness beacon**, v1.9) and openings must bind to the signed root. Catches
-  1% sample-doctoring with 95% confidence at 300 samples, regardless of run size.
+  nonce or a **public randomness beacon**, v1.9) and openings must bind to the signed root. With
+  such an auditor-supplied or beacon-bound challenge, 300 samples catch 1% sample-doctoring with 95%
+  confidence, regardless of run size — a challenge the issuer chose itself does not give this
+  guarantee.
 - **Pre-registration** — `proofbundle prereg <plan>` commits to the protocol before the run, so
   best-of-many publishing becomes visible.
 - **Integrations** — opt-in inspect_ai end-of-task hook and pytest plugin (emit only when
   `PROOFBUNDLE_EMIT=1` / `--proofbundle`), plus a Hugging Face Community Evals bridge. See
-  [INTEGRATIONS.md](INTEGRATIONS.md).
+  [INTEGRATIONS.md](INTEGRATIONS.md), or the end-to-end walkthrough
+  [docs/INSPECT_HAPPY_PATH.md](docs/INSPECT_HAPPY_PATH.md) — run an eval, get a receipt, verify it offline.
 
 ## Docs
 
@@ -120,7 +132,7 @@ Requires Python 3.10+. The verify path never rolls its own crypto — Ed25519 co
 
 ## Status & scope
 
-Beta, SemVer-committed, 303 tests + a CI mutation gate + property-based parser fuzzing. Correctness
+Beta, SemVer-committed, with a CI test suite behind a mutation gate + property-based parser fuzzing. Correctness
 is anchored to external RFC 6962 vectors and a real Rekor proof, not just its own bundles. It is
 **not** a log service, a full in-toto client, a TEE, a consensus network, or a compliance product
 by itself — it is the small, offline, standards-native receipt layer between them. Security policy:

{proofbundle-1.9.1 → proofbundle-1.9.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "proofbundle"
-version = "1.9.1"
+version = "1.9.2"
 description = "Emit and verify portable cryptographic evidence bundles, offline: Ed25519 + RFC 6962 Merkle + optional SD-JWT."
 readme = "README.md"
 requires-python = ">=3.10"

{proofbundle-1.9.1 → proofbundle-1.9.2}/src/proofbundle/__init__.py

@@ -13,7 +13,7 @@ from __future__ import annotations
 
 from typing import TYPE_CHECKING
 
-__version__ = "1.9.1"
+__version__ = "1.9.2"
 
 __all__ = [
     "__version__",

{proofbundle-1.9.1 → proofbundle-1.9.2}/src/proofbundle/bundle.py

@@ -153,6 +153,7 @@ def verify_bundle(bundle: Union[dict, str], *, expected_aud=None, expected_nonce
 
     # 3. optional SD-JWT selective disclosure credential
     sd = bundle.get("sd_jwt_vc")
+    kb_binding_checked = False   # F4: did a KB-JWT (the aud/nonce carrier) actually get verified?
     if sd is not None:
         sd = _require_dict(sd, "sd_jwt_vc")
         _reject_unknown(sd, _SD_KEYS, "sd_jwt_vc")
@@ -186,6 +187,7 @@ def verify_bundle(bundle: Union[dict, str], *, expected_aud=None, expected_nonce
             if kb is not None:
                 kb_res = verify_key_binding(compact, expected_aud=expected_aud, expected_nonce=expected_nonce)
                 result.add("sd-jwt-key-binding", kb_res["ok"], kb_res["detail"])
+                kb_binding_checked = True
             elif _issuer_requires_holder_binding(sd_part):
                 result.add(
                     "sd-jwt-key-binding", False,
@@ -206,6 +208,18 @@ def verify_bundle(bundle: Union[dict, str], *, expected_aud=None, expected_nonce
                     "binding is unverifiable, refusing (fail-closed; supply "
                     "sd_jwt_vc.issuer_public_key_b64)")
 
+    # F4 (v1.9.2, fail-closed): supplying expected_aud/expected_nonce asks for RFC 9901 §7.3
+    # replay/audience binding. A bundle with no verifiable KB-JWT (no sd_jwt_vc at all, or an
+    # sd_jwt_vc without a Key Binding JWT) carries nothing to bind to — returning OK anyway is a
+    # downgrade trap: the verifier believes the presentation was bound to its aud/nonce when it was
+    # not. Refuse the binding it asked for but cannot be enforced. Verifiers that pass no expected_*
+    # are unaffected (backward-compatible: the check only fires when a binding was actually requested).
+    if (expected_aud is not None or expected_nonce is not None) and not kb_binding_checked:
+        result.add(
+            "sd-jwt-key-binding", False,
+            "expected_aud/expected_nonce were supplied but the bundle carries no verifiable Key "
+            "Binding JWT — the requested replay/audience binding cannot be enforced (fail-closed)")
+
     return result
 
 

{proofbundle-1.9.1 → proofbundle-1.9.2}/src/proofbundle/evalclaim.py

@@ -269,6 +269,14 @@ def decode_eval_claim(bundle, *, expected_context: Optional[str] = None) -> Opti
         claim = load_claim_text(payload.decode("utf-8"))
         if claim.get("schema") != EVAL_CLAIM_SCHEMA:
             return None
+        # F3 (v1.9.2): the exact key set is a VERIFY-path invariant, not only an emit-side one.
+        # emit_eval_receipt enforces _REQUIRED/_OPTIONAL at emit, but a hand-signed claim bypasses
+        # that path — a decoded claim missing a required field or carrying an unknown one was
+        # previously ACCEPTED here (the emit-vs-verify asymmetry class this project documents; the
+        # module comment on _REQUIRED, "decode/validate reject anything else", was aspirational on
+        # this path). Reject fail-closed, mirroring the emit-side check.
+        if (_REQUIRED - set(claim)) or (set(claim) - _REQUIRED - _OPTIONAL):
+            return None
         # Issuer binding: the claim's issuer must be the key that signed the bundle.
         sig_pub_b64 = bundle["signature"]["public_key_b64"]
         want = "ed25519:" + base64.b64encode(base64.b64decode(sig_pub_b64)).decode("ascii")

{proofbundle-1.9.1 → proofbundle-1.9.2}/src/proofbundle/statuslist.py

@@ -92,7 +92,7 @@ def verify_status_snapshot(status_list_token: str, *, expected_uri: str, index:
     covers signature + structure + lookup; combining ``ok`` with ``fresh``/``self_issued`` is the
     caller's policy.
     """
-    result = {"ok": False, "status": None, "status_label": None, "fresh": None,
+    result: dict[str, object] = {"ok": False, "status": None, "status_label": None, "fresh": None,
               "self_issued": None, "iat": None, "exp": None, "ttl": None, "detail": ""}
     if receipt_issuer_pubkey is not None:
         # hmac.compare_digest for a constant-time compare of the two public keys (defensive; the

{proofbundle-1.9.1 → proofbundle-1.9.2/src/proofbundle.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofbundle
-Version: 1.9.1
+Version: 1.9.2
 Summary: Emit and verify portable cryptographic evidence bundles, offline: Ed25519 + RFC 6962 Merkle + optional SD-JWT.
 Author: Konrad Gruszka
 License: MIT
@@ -55,9 +55,11 @@ Dynamic: license-file
 
 <h1>proofbundle</h1>
 
-**Turn an AI eval result into one portable, offline-verifiable receipt.**
-It proves *who signed these exact bytes* and *that nothing changed since* — not that the number is
-true. Ed25519 + RFC 6962 Merkle, one file, no server, no network.
+**AI eval results need receipts.**
+
+Turn an AI evaluation result into one portable, offline-verifiable receipt. It proves *who signed
+these exact bytes* and *that nothing changed since* — not that the number is true. Ed25519 + RFC 6962
+Merkle, one file, no server, no network.
 
 [![CI](https://github.com/b7n0de/proofbundle/actions/workflows/ci.yml/badge.svg)](https://github.com/b7n0de/proofbundle/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/license-MIT-D6248A.svg)](LICENSE)
@@ -108,6 +110,13 @@ This boundary is the point, not a weakness. A receipt makes a claim **attributab
 and — with pre-registration and per-sample auditing — bounded and spot-checkable**. Full detail:
 **[THREAT_MODEL.md](THREAT_MODEL.md)**.
 
+## In plain language
+
+A proofbundle receipt is the cash-register receipt of an AI test result: it shows who claimed the
+number and that nobody quietly changed it afterwards. It does not show the test was good — the way a
+cash-register receipt does not show the meal was good — but without a receipt there is nothing to
+check at all.
+
 ## How it fits together
 
 ```mermaid
@@ -132,13 +141,16 @@ flowchart LR
 - **Transparency-log interop** — C2SP `tlog-checkpoint` / cosignature / `.tlog-proof`, with
   post-quantum **ML-DSA-44** witness cosignatures. Optional Token-Status-List revocation snapshots.
 - **Per-sample audit** — commit to every sample; an auditor challenges random indices (with a fresh
-  nonce or a **public randomness beacon**, v1.9) and openings must bind to the signed root. Catches
-  1% sample-doctoring with 95% confidence at 300 samples, regardless of run size.
+  nonce or a **public randomness beacon**, v1.9) and openings must bind to the signed root. With
+  such an auditor-supplied or beacon-bound challenge, 300 samples catch 1% sample-doctoring with 95%
+  confidence, regardless of run size — a challenge the issuer chose itself does not give this
+  guarantee.
 - **Pre-registration** — `proofbundle prereg <plan>` commits to the protocol before the run, so
   best-of-many publishing becomes visible.
 - **Integrations** — opt-in inspect_ai end-of-task hook and pytest plugin (emit only when
   `PROOFBUNDLE_EMIT=1` / `--proofbundle`), plus a Hugging Face Community Evals bridge. See
-  [INTEGRATIONS.md](INTEGRATIONS.md).
+  [INTEGRATIONS.md](INTEGRATIONS.md), or the end-to-end walkthrough
+  [docs/INSPECT_HAPPY_PATH.md](docs/INSPECT_HAPPY_PATH.md) — run an eval, get a receipt, verify it offline.
 
 ## Docs
 
@@ -168,7 +180,7 @@ Requires Python 3.10+. The verify path never rolls its own crypto — Ed25519 co
 
 ## Status & scope
 
-Beta, SemVer-committed, 303 tests + a CI mutation gate + property-based parser fuzzing. Correctness
+Beta, SemVer-committed, with a CI test suite behind a mutation gate + property-based parser fuzzing. Correctness
 is anchored to external RFC 6962 vectors and a real Rekor proof, not just its own bundles. It is
 **not** a log service, a full in-toto client, a TEE, a consensus network, or a compliance product
 by itself — it is the small, offline, standards-native receipt layer between them. Security policy:

{proofbundle-1.9.1 → proofbundle-1.9.2}/src/proofbundle.egg-info/SOURCES.txt

@@ -47,11 +47,13 @@ tests/test_beacon.py
 tests/test_bundle.py
 tests/test_bundle_robustness.py
 tests/test_checkpoint.py
+tests/test_claims_hygiene.py
 tests/test_cli.py
 tests/test_cli_eval.py
 tests/test_cosignature.py
 tests/test_cosignature_mldsa.py
 tests/test_demo.py
+tests/test_docs_truth.py
 tests/test_eee.py
 tests/test_emit.py
 tests/test_eval_claim_schema.py

proofbundle-1.9.2/tests/test_claims_hygiene.py

@@ -0,0 +1,48 @@
+"""Claims-hygiene gate — the docs must not carry un-negated overclaims (six-lens review §15)."""
+import importlib.util
+import tempfile
+import unittest
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parents[1]
+_spec = importlib.util.spec_from_file_location("claims_hygiene_check", REPO / "scripts" / "claims_hygiene_check.py")
+ch = importlib.util.module_from_spec(_spec)
+_spec.loader.exec_module(ch)
+
+
+class TestClaimsHygiene(unittest.TestCase):
+    def test_real_docs_are_clean(self):
+        # The shipped docs must pass the gate — this is the tool whose product is honest scoping.
+        self.assertEqual(ch.main(["--json"]), 0, "the repository docs carry an un-negated overclaim")
+
+    def test_un_negated_forbidden_phrase_is_a_violation(self):
+        with tempfile.TemporaryDirectory() as d:
+            for text in ("proofbundle proves correctness of the eval.",
+                         "The receipt is audit-proof.",
+                         "It is quantum-safe.",
+                         "This is the industry standard for receipts.",
+                         "It is compliance ready today."):
+                p = Path(d) / "x.md"
+                p.write_text(text, encoding="utf-8")
+                self.assertTrue(ch.scan_file(p), f"must flag: {text!r}")
+
+    def test_negated_forbidden_phrase_is_allowed(self):
+        with tempfile.TemporaryDirectory() as d:
+            for text in ("A receipt does not prove correctness.",
+                         "proofbundle is not quantum-safe (Ed25519).",
+                         "It never proves the number is true.",
+                         "This is not audit-proof and makes no compliance claim."):
+                p = Path(d) / "x.md"
+                p.write_text(text, encoding="utf-8")
+                self.assertEqual(ch.scan_file(p), [], f"negated form must be allowed: {text!r}")
+
+    def test_code_fence_and_inline_code_skipped(self):
+        with tempfile.TemporaryDirectory() as d:
+            p = Path(d) / "x.md"
+            p.write_text("```\nproves correctness\n```\nUse `quantum-safe` as a literal flag name.",
+                         encoding="utf-8")
+            self.assertEqual(ch.scan_file(p), [], "code fences / inline code are not prose")
+
+
+if __name__ == "__main__":
+    unittest.main()

{proofbundle-1.9.1 → proofbundle-1.9.2}/tests/test_cli_eval.py

@@ -34,6 +34,31 @@ class TestCliEval(unittest.TestCase):
             self.assertEqual(show.returncode, 0)
             self.assertIn("passed", show.stdout)
 
+    def test_show_eval_malformed_no_raw_traceback(self):
+        # F3 (v1.9.2): show-eval honors the no-raw-traceback contract. A hand-signed receipt missing a
+        # required field is now rejected by decode_eval_claim (SH1), so show-eval prints a clean FAILED
+        # and exits 1 — it never reaches the claim[<required>] field access that previously raised a
+        # raw KeyError outside the try block.
+        import os
+        import tempfile
+
+        from proofbundle import evalclaim as ec
+        from proofbundle.emit import emit_bundle, generate_signer
+        signer = generate_signer()
+        c, _ = ec.build_eval_claim(
+            suite="s", suite_version="v1", metric="acc", comparator=">=", threshold="0.80",
+            score="0.90", n=100, model_id="m", dataset_id="d", issuer="x",
+            timestamp="2026-07-01T12:00:00Z", model_salt=b"0" * 16, dataset_salt=b"1" * 16)
+        good = ec.decode_eval_claim(ec.emit_eval_receipt(c, signer))
+        malformed = {k: v for k, v in good.items() if k != "suite"}   # drop a required field, re-sign by hand
+        with tempfile.TemporaryDirectory() as d:
+            p = os.path.join(d, "bad.json")
+            Path(p).write_text(json.dumps(emit_bundle(ec.canonicalize(malformed), signer)), encoding="utf-8")
+            r = _run("show-eval", p)
+            self.assertEqual(r.returncode, 1, "malformed receipt must exit 1, not crash")
+            self.assertNotIn("Traceback", r.stderr, "show-eval must never emit a raw traceback")
+            self.assertIn("FAILED", r.stderr)
+
 
 if __name__ == "__main__":
     unittest.main()

proofbundle-1.9.2/tests/test_docs_truth.py

@@ -0,0 +1,46 @@
+"""Doc-truth guards — metrics in the docs must not be able to go stale (six-lens review F5/SH4)."""
+import importlib.util
+import re
+import unittest
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parents[1]
+_dl_spec = importlib.util.spec_from_file_location("doc_link_check", REPO / "scripts" / "doc_link_check.py")
+doc_link_check = importlib.util.module_from_spec(_dl_spec)
+_dl_spec.loader.exec_module(doc_link_check)
+
+
+class TestDocsTruth(unittest.TestCase):
+    def test_readme_carries_no_hardcoded_test_count(self):
+        # F5: the README stated "303 tests" while the suite had grown past it. A hardcoded count
+        # goes stale on every added test. Removed (not tracked by hand) — this guard keeps it gone:
+        # a "<N> tests" phrase in the README is a stale-metric regression.
+        readme = (REPO / "README.md").read_text(encoding="utf-8")
+        # ignore fenced code blocks (a CLI sample line is not a prose metric)
+        prose = re.sub(r"```.*?```", "", readme, flags=re.DOTALL)
+        hits = re.findall(r"\b\d+\s+tests?\b", prose, flags=re.IGNORECASE)
+        self.assertEqual(hits, [], f"README carries a hardcoded, stale-prone test count: {hits}")
+
+    def test_citation_version_matches_pyproject(self):
+        # F6/SH4: CITATION.cff stated version 0.7.0 while pyproject shipped 1.9.1 — a stale version
+        # travels into every citation. Pin them together so a release bump cannot drift them apart
+        # (the RELEASE.md checklist requires bumping both).
+        cff = (REPO / "CITATION.cff").read_text(encoding="utf-8")
+        pyproject = (REPO / "pyproject.toml").read_text(encoding="utf-8")
+        cff_v = re.search(r"(?m)^version:\s*([^\s#]+)", cff)
+        py_v = re.search(r'(?m)^version\s*=\s*"([^"]+)"', pyproject)
+        self.assertIsNotNone(cff_v, "CITATION.cff has no version")
+        self.assertIsNotNone(py_v, "pyproject.toml has no version")
+        self.assertEqual(cff_v.group(1).strip('"'), py_v.group(1),
+                         "CITATION.cff version must equal pyproject version (bump both together)")
+
+    def test_no_broken_internal_doc_links(self):
+        # SH5: a Markdown link to a local file that 404s reads as abandonment for a tool that sells
+        # reviewability. The shipped docs must have zero broken internal links.
+        out = doc_link_check.check()
+        self.assertGreater(out["checked"], 0, "link checker found no local links to check — is it wired up?")
+        self.assertEqual(out["broken"], [], f"broken internal doc link(s): {out['broken']}")
+
+
+if __name__ == "__main__":
+    unittest.main()

{proofbundle-1.9.1 → proofbundle-1.9.2}/tests/test_evalclaim.py

@@ -52,6 +52,29 @@ class TestEvalClaim(unittest.TestCase):
             self.assertTrue(verify_bundle(bundle).ok, f"{key}={bad}: bundle still signs/verifies")
             self.assertIsNone(decode_eval_claim(bundle), f"{key}={bad}: claim must NOT decode")
 
+    def test_decode_enforces_required_and_unknown_fields(self):
+        # F3 (v1.9.2): the exact key set is a VERIFY-path invariant, not only an emit-side one.
+        # emit_eval_receipt enforces _REQUIRED/_OPTIONAL, but a hand-signed claim (emit_bundle over a
+        # canonicalized dict) bypasses that path — previously such a claim decoded fine (the emit-vs-
+        # verify asymmetry class the project documents). The signature stays valid; only decode rejects.
+        from proofbundle.emit import emit_bundle
+        signer = generate_signer()
+        claim, _ = _claim(signer)
+        good = decode_eval_claim(emit_eval_receipt(claim, signer))
+        self.assertIsNotNone(good)
+        # (a) a claim missing a required field must NOT decode (issuer is checked separately, exclude it)
+        for drop in ("timestamp", "suite", "assurance_level", "n", "comparator"):
+            c = {k: v for k, v in good.items() if k != drop}
+            bundle = emit_bundle(canonicalize(c), signer)
+            self.assertTrue(verify_bundle(bundle).ok, f"drop {drop}: signature must still verify")
+            self.assertIsNone(decode_eval_claim(bundle), f"missing {drop}: claim must NOT decode")
+        # (b) a claim carrying an unknown field must NOT decode
+        c = dict(good)
+        c["totally_unknown_field"] = "x"
+        bundle = emit_bundle(canonicalize(c), signer)
+        self.assertTrue(verify_bundle(bundle).ok, "unknown field: signature must still verify")
+        self.assertIsNone(decode_eval_claim(bundle), "unknown field: claim must NOT decode")
+
     def test_decode_reads_path_once_no_toctou(self):
         # CRITICAL (release review): decode_eval_claim(path) must resolve the path to a dict EXACTLY ONCE and
         # verify + parse the SAME object. A second re-read is a TOCTOU (CWE-367) file-race window that could return

{proofbundle-1.9.1 → proofbundle-1.9.2}/tests/test_kbjwt.py

@@ -266,6 +266,22 @@ class TestBundleIntegration(unittest.TestCase):
         self.assertIn("NO issuer key", kb[0].detail)
         self.assertFalse(result.ok, "cnf-bound SD-JWT without an issuer key must fail the bundle")
 
+    def test_f4_expected_binding_without_kb_jwt_fails_closed(self):
+        # F4 (v1.9.2): supplying expected_aud/expected_nonce requests RFC 9901 §7.3 replay/audience
+        # binding. A bundle with NO verifiable KB-JWT (here: no sd_jwt_vc at all) carries nothing to
+        # bind to — verify must FAIL closed instead of silently returning OK (the downgrade trap: the
+        # verifier believes the presentation was bound to its aud/nonce when nothing bound it). A
+        # verifier that supplies no expected_* is unaffected (backward-compatible).
+        b = emit_bundle(b'{"x":1}', generate_signer())   # plain bundle, no sd_jwt_vc
+        self.assertTrue(verify_bundle(b).ok, "no expected_* → OK (backward-compatible)")
+        for kwargs in ({"expected_aud": "verifier.example"}, {"expected_nonce": "n-1"},
+                       {"expected_aud": "v", "expected_nonce": "n"}):
+            res = verify_bundle(b, **kwargs)
+            self.assertFalse(res.ok, f"{kwargs}: no KB-JWT → must fail closed")
+            kb = [c for c in res.checks if c.name == "sd-jwt-key-binding"]
+            self.assertEqual(len(kb), 1, f"{kwargs}: must record exactly one refused binding check")
+            self.assertFalse(kb[0].ok)
+
     def test_bundle_no_cnf_no_issuer_key_still_backward_compatible(self):
         # The fix must NOT break plain SD-JWTs that carry no cnf and no KB — they verify as
         # structure-only exactly as before (no spurious key-binding verdict).