proofbundle 2.1.0__tar.gz → 3.0.0__tar.gz

{proofbundle-2.1.0/src/proofbundle.egg-info → proofbundle-3.0.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofbundle
-Version: 2.1.0
+Version: 3.0.0
 Summary: Emit and verify portable cryptographic evidence bundles, offline: Ed25519 + RFC 6962 Merkle + optional SD-JWT.
 Author: Konrad Gruszka
 License: MIT
@@ -202,7 +202,8 @@ flowchart LR
 - **Eval receipts** — a signed claim (`metric ⋈ threshold`, `n`, salted model/dataset commitments,
   assurance level, provenance) from your run. See [EVAL_CLAIM.md](https://github.com/b7n0de/proofbundle/blob/main/EVAL_CLAIM.md).
 - **Selective disclosure** — SD-JWT ([RFC 9901](https://datatracker.ietf.org/doc/rfc9901/)) with Key
-  Binding: prove a threshold while withholding the exact score.
+  Binding: prove a threshold while withholding the exact score. Secure-by-default in 3.0.0 (breaking): an
+  unsigned SD-JWT, or one whose disclosures do not bind this bundle, now fails verification (was warn-only).
 - **Transparency-log interop** — C2SP `tlog-checkpoint` / cosignature / `.tlog-proof`, with
   post-quantum **ML-DSA-44** witness cosignatures. Optional Token-Status-List revocation snapshots.
 - **Per-sample audit** — commit to every sample; an auditor challenges random indices (with a fresh
@@ -218,12 +219,34 @@ flowchart LR
   [docs/INSPECT_HAPPY_PATH.md](https://github.com/b7n0de/proofbundle/blob/main/docs/INSPECT_HAPPY_PATH.md) — run an eval, get a receipt, verify it offline.
 - **External time anchors** *(v2.0 beta, the `[anchors]` extra)* — an optional `anchors[]` layer that
   attaches external evidence of *when* a commitment or receipt existed, from a party the producer does not
-  control. Two built-in types verify offline: **RFC 3161** TSA tokens (against a frozen cert chain) and
-  **OpenTimestamps** Bitcoin proofs (honest pending → confirmed lifecycle). A `register_anchor_type`
+  control. Two built-in types verify offline: **RFC 3161** TSA tokens (against a relying-party-supplied TSA
+  root, see the 3.0.0 trust note below) and **OpenTimestamps** Bitcoin proofs (honest pending → confirmed lifecycle). A `register_anchor_type`
   extension interface lets a third party ship its own fail-closed type; two worked examples ship — a
   first-party **`chia-datalayer/v1`** (offline Merkle inclusion of a canonical root under a published Chia
   DataLayer root) and a third-party **`markovian-provenance/v1`** (a wallet-attributable, Bitcoin-anchored
-  stamp). See [docs/ANCHORS.md](https://github.com/b7n0de/proofbundle/blob/main/docs/ANCHORS.md).
+  stamp). **Since 2.1:** a `verify --require-anchor` relying-party gate (optionally narrowed by
+  `--anchor-type`) turns "no verifying anchor of that type" into a failure layered over the crypto result
+  (exit 3, like `--policy`); a pending anchor does not satisfy it unless `--allow-pending`. Plus RFC 3161
+  hardening — the frozen cert chain is validated at the token's own `gen_time`, with optional `policyOid`
+  pinning. **Breaking in 3.0.0:** an anchor's TRUST now comes only from the relying party — supply a TSA
+  root (`--trusted-tsa-root`) or a Bitcoin block header (`--bitcoin-header`), or the equivalent `anchors`
+  policy keys; the bundle's producer-controlled `frozen` block is evidence, never a trust source, so
+  `--require-anchor` without relying-party trust material is unmet (exit 3). An anchor stays detached from
+  the content root, and the `statement` target is RESERVED for decision receipts.
+  See [docs/ANCHORS.md](https://github.com/b7n0de/proofbundle/blob/main/docs/ANCHORS.md).
+- **Universal content root** *(2.1, `jcs-sha256-v1`, [ADR 0002](https://github.com/b7n0de/proofbundle/blob/main/docs/adr/0002-universal-content-root.md))* — one shared primitive now underlies both the
+  decision-receipt path and the in-toto eval-result / test-result / SVR exports: SHA-256 over the RFC 8785
+  (JCS) canonical bytes of the full pre-signature Statement, so a content root survives counter-signing and
+  key rotation. The algorithm is a versioned id signed inside the payload (`contentRootAlg`, default
+  `jcs-sha256-v1`); a verifier re-serializes with exactly the declared algorithm, never falls back, and an
+  unknown algorithm fails closed. Migration is a compatible evolution, not a cutover: absent `contentRootAlg`
+  ⇒ the historic `legacy-sortkeys-json-v0` mode, so every already-signed 2.0.0 receipt keeps verifying
+  byte-for-byte. This is **not** a completed universal migration — a CLI flag to select the algorithm is still
+  deferred. Independent cross-implementation (MarkovianProtocol) interop is now proven for RFC 8785
+  canonicalization + content-root binding (see `conformance/decision/crossimpl/`); the same corpus additionally
+  verifies a confirmed Bitcoin anchor (block 957504) offline. The external fixture currently reports 12 findings
+  against the enforced `decision-receipt/v0.1` validator — recorded as an expected-fail, not hidden — so full
+  schema conformance awaits a further schema-conformant regeneration.
 - **Decision Receipts** *(2.1, vendored `decision-receipt/v0.1` predicate)* — a separate predicate for agent
   *decisions* (not eval metrics): who decided, the proposed action, the policy boundary, digest-bound evidence,
   the verdict (`ALLOW`/`DENY`/`REFUSE`/`ESCALATE`/`DEFER`/`OBSERVE`), and explicitly what was *not* checked.

{proofbundle-2.1.0 → proofbundle-3.0.0}/README.md

@@ -148,7 +148,8 @@ flowchart LR
 - **Eval receipts** — a signed claim (`metric ⋈ threshold`, `n`, salted model/dataset commitments,
   assurance level, provenance) from your run. See [EVAL_CLAIM.md](https://github.com/b7n0de/proofbundle/blob/main/EVAL_CLAIM.md).
 - **Selective disclosure** — SD-JWT ([RFC 9901](https://datatracker.ietf.org/doc/rfc9901/)) with Key
-  Binding: prove a threshold while withholding the exact score.
+  Binding: prove a threshold while withholding the exact score. Secure-by-default in 3.0.0 (breaking): an
+  unsigned SD-JWT, or one whose disclosures do not bind this bundle, now fails verification (was warn-only).
 - **Transparency-log interop** — C2SP `tlog-checkpoint` / cosignature / `.tlog-proof`, with
   post-quantum **ML-DSA-44** witness cosignatures. Optional Token-Status-List revocation snapshots.
 - **Per-sample audit** — commit to every sample; an auditor challenges random indices (with a fresh
@@ -164,12 +165,34 @@ flowchart LR
   [docs/INSPECT_HAPPY_PATH.md](https://github.com/b7n0de/proofbundle/blob/main/docs/INSPECT_HAPPY_PATH.md) — run an eval, get a receipt, verify it offline.
 - **External time anchors** *(v2.0 beta, the `[anchors]` extra)* — an optional `anchors[]` layer that
   attaches external evidence of *when* a commitment or receipt existed, from a party the producer does not
-  control. Two built-in types verify offline: **RFC 3161** TSA tokens (against a frozen cert chain) and
-  **OpenTimestamps** Bitcoin proofs (honest pending → confirmed lifecycle). A `register_anchor_type`
+  control. Two built-in types verify offline: **RFC 3161** TSA tokens (against a relying-party-supplied TSA
+  root, see the 3.0.0 trust note below) and **OpenTimestamps** Bitcoin proofs (honest pending → confirmed lifecycle). A `register_anchor_type`
   extension interface lets a third party ship its own fail-closed type; two worked examples ship — a
   first-party **`chia-datalayer/v1`** (offline Merkle inclusion of a canonical root under a published Chia
   DataLayer root) and a third-party **`markovian-provenance/v1`** (a wallet-attributable, Bitcoin-anchored
-  stamp). See [docs/ANCHORS.md](https://github.com/b7n0de/proofbundle/blob/main/docs/ANCHORS.md).
+  stamp). **Since 2.1:** a `verify --require-anchor` relying-party gate (optionally narrowed by
+  `--anchor-type`) turns "no verifying anchor of that type" into a failure layered over the crypto result
+  (exit 3, like `--policy`); a pending anchor does not satisfy it unless `--allow-pending`. Plus RFC 3161
+  hardening — the frozen cert chain is validated at the token's own `gen_time`, with optional `policyOid`
+  pinning. **Breaking in 3.0.0:** an anchor's TRUST now comes only from the relying party — supply a TSA
+  root (`--trusted-tsa-root`) or a Bitcoin block header (`--bitcoin-header`), or the equivalent `anchors`
+  policy keys; the bundle's producer-controlled `frozen` block is evidence, never a trust source, so
+  `--require-anchor` without relying-party trust material is unmet (exit 3). An anchor stays detached from
+  the content root, and the `statement` target is RESERVED for decision receipts.
+  See [docs/ANCHORS.md](https://github.com/b7n0de/proofbundle/blob/main/docs/ANCHORS.md).
+- **Universal content root** *(2.1, `jcs-sha256-v1`, [ADR 0002](https://github.com/b7n0de/proofbundle/blob/main/docs/adr/0002-universal-content-root.md))* — one shared primitive now underlies both the
+  decision-receipt path and the in-toto eval-result / test-result / SVR exports: SHA-256 over the RFC 8785
+  (JCS) canonical bytes of the full pre-signature Statement, so a content root survives counter-signing and
+  key rotation. The algorithm is a versioned id signed inside the payload (`contentRootAlg`, default
+  `jcs-sha256-v1`); a verifier re-serializes with exactly the declared algorithm, never falls back, and an
+  unknown algorithm fails closed. Migration is a compatible evolution, not a cutover: absent `contentRootAlg`
+  ⇒ the historic `legacy-sortkeys-json-v0` mode, so every already-signed 2.0.0 receipt keeps verifying
+  byte-for-byte. This is **not** a completed universal migration — a CLI flag to select the algorithm is still
+  deferred. Independent cross-implementation (MarkovianProtocol) interop is now proven for RFC 8785
+  canonicalization + content-root binding (see `conformance/decision/crossimpl/`); the same corpus additionally
+  verifies a confirmed Bitcoin anchor (block 957504) offline. The external fixture currently reports 12 findings
+  against the enforced `decision-receipt/v0.1` validator — recorded as an expected-fail, not hidden — so full
+  schema conformance awaits a further schema-conformant regeneration.
 - **Decision Receipts** *(2.1, vendored `decision-receipt/v0.1` predicate)* — a separate predicate for agent
   *decisions* (not eval metrics): who decided, the proposed action, the policy boundary, digest-bound evidence,
   the verdict (`ALLOW`/`DENY`/`REFUSE`/`ESCALATE`/`DEFER`/`OBSERVE`), and explicitly what was *not* checked.

{proofbundle-2.1.0 → proofbundle-3.0.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "proofbundle"
-version = "2.1.0"
+version = "3.0.0"
 description = "Emit and verify portable cryptographic evidence bundles, offline: Ed25519 + RFC 6962 Merkle + optional SD-JWT."
 readme = "README.md"
 requires-python = ">=3.10"
@@ -22,6 +22,9 @@ keywords = [
     "rfc6962",
 ]
 classifiers = [
+    # Stays Beta until the funded external security review passes (Owner decision E1, 2026-07-12):
+    # "stable is evidenced, not asserted". The move to "5 - Production/Stable" is a separate,
+    # audit-gated milestone (see docs/GRANT_MILESTONES.md), never claimed pre-audit.
     "Development Status :: 4 - Beta",
     "Intended Audience :: Developers",
     "License :: OSI Approved :: MIT License",

{proofbundle-2.1.0 → proofbundle-3.0.0}/src/proofbundle/__init__.py

@@ -13,12 +13,12 @@ from __future__ import annotations
 
 from typing import TYPE_CHECKING
 
-__version__ = "2.1.0"
+__version__ = "3.0.0"
 
 # The `proofbundle/v0.1` normative spec revision this build implements — kept in sync with the
 # `Revision:` line at the top of SPEC.md by tests/test_docs_truth.py (WP-B1, closes #28). Bump
 # both together whenever SPEC.md's normative text changes (not on every package release).
-SPEC_REVISION = "2026-07-10"
+SPEC_REVISION = "2026-07-11"
 
 __all__ = [
     "__version__",

proofbundle-3.0.0/src/proofbundle/_strict_json.py

@@ -0,0 +1,72 @@
+"""Duplicate-key-rejecting JSON parsing — the one strict parser for every verify path (WP-C1).
+
+``json.loads`` silently keeps the LAST occurrence of a duplicated key (last-wins). On a verify
+path that is a classic parser differential (Bishop Fox 2021; the exact bug class behind several
+JWT/JOSE CVEs): two implementations parsing the same bytes can disagree about which ``root_b64``
+or ``sig_b64`` they verified, so "cross-verifier consensus" silently stops meaning one thing.
+RFC 8785 (JCS) forbids duplicate keys outright, and the DSSE statement paths already reject them
+INDIRECTLY (a duplicated payload cannot be byte-equal to its own canonical re-serialization) —
+but the native bundle path accepted them silently, and an explicit reject with a clear message
+beats an incidental byte-mismatch everywhere.
+
+Converted paths: the native bundle (``load_bundle``, the HF ``pb1.`` token), the DSSE statement
+verifiers (eval-result / test-result / SVR / decision), the trust-policy loader, the per-sample
+disclosure record, the chia-datalayer and markovian anchor envelopes, the status-list token, the
+enclave EAT, and every ``json.load`` in the CLI. Emit-side inputs (a claim/predicate file the
+caller authored) use it too — a duplicate key in something about to be signed is at best an
+authoring bug, at worst an attempted differential.
+
+Resolved 2026-07-12 (F12, release-audit): the SD-JWT/KB-JWT payload sites in ``sdjwt.py`` /
+``kbjwt.py``, ``bundle._issuer_requires_holder_binding``, ``sdjwt_issue._jwt_payload`` and
+``evalclaim.sd_jwt_hidden_count`` now parse with ``loads_strict`` too, each routed fail-closed —
+a duplicate ``cnf`` is rejected, and ``_issuer_requires_holder_binding`` returns True on a duplicate
+(binding REQUIRED), never the inverted "no holder binding required". Keys that differ only by Unicode normalization
+(NFC/NFD) or a BOM are DISTINCT JSON keys by spec and stay distinct here — normalization games are
+a downstream concern of the field validators, not of the parser.
+
+Stdlib-only (``object_pairs_hook``), so the base install keeps rejecting duplicates without any
+extra. The hook fires for every nested object (including objects inside arrays), so duplicates are
+rejected at ANY depth.
+"""
+from __future__ import annotations
+
+import json
+from typing import Any, Union
+
+from .errors import BundleFormatError
+
+__all__ = ["loads_strict"]
+
+
+def _reject_duplicate_keys(pairs: list) -> dict:
+    obj: dict = {}
+    for key, value in pairs:
+        if key in obj:
+            raise BundleFormatError(
+                f"duplicate JSON key {key!r} — rejected fail-closed (a duplicated key parses "
+                "differently across JSON implementations; parser-differential guard, WP-C1)")
+        obj[key] = value
+    return obj
+
+
+def loads_strict(text: Union[str, bytes]) -> Any:
+    """``json.loads`` that rejects duplicate object keys at any nesting depth.
+
+    Raises :class:`BundleFormatError` for a duplicate key (fail-closed, clear message), maps
+    ``RecursionError`` from pathologically deep nesting to the same documented malformed-input
+    error, and maps the ``int``/``str`` conversion-limit ``ValueError`` from a JSON integer literal
+    with more than ``sys.get_int_max_str_digits()`` digits (CWE-674 / CVE-2020-10735) to it too —
+    never a raw traceback — mirroring :func:`proofbundle.bundle.load_bundle`. Ordinary JSON syntax
+    errors keep raising ``ValueError`` (``json.JSONDecodeError``) so existing ``except (ValueError,
+    ...)`` handling at the call sites stays correct."""
+    try:
+        return json.loads(text, object_pairs_hook=_reject_duplicate_keys)
+    except RecursionError as exc:
+        raise BundleFormatError("JSON nesting is too deep") from exc
+    except ValueError as exc:
+        # The int<->str conversion cap raises a plain ValueError DURING parsing (not a JSONDecodeError),
+        # which a pre-auth caller without a broad `except ValueError` would surface as a raw traceback.
+        # Map only that specific case; a normal JSONDecodeError keeps raising ValueError as documented.
+        if "integer string conversion" in str(exc):
+            raise BundleFormatError("JSON integer literal is implausibly long (fail-closed)") from exc
+        raise

{proofbundle-2.1.0 → proofbundle-3.0.0}/src/proofbundle/adapters/eee.py

@@ -22,10 +22,12 @@ has_unknown_level == true means Unknown and is rejected (not silently mapped to
 from __future__ import annotations
 
 import json
+import re
 from pathlib import Path
 from typing import Optional, Union
 
 from ..evalclaim import build_eval_claim
+from ._provenance import add_provenance
 
 _SCHEMA_PATH = Path(__file__).resolve().parent.parent / "eee_eval_schema.json"
 _SCHEMA_VERSION = "0.2.2"
@@ -95,6 +97,52 @@ def _extract_score(score_details: dict, metric_config: dict) -> str:
     return _num_to_decimal_str(raw)
 
 
+def _model_id_stripped(record: dict) -> dict:
+    """A deep copy of the EEE record with the cleartext model identity removed (WP-I3 privacy fix).
+    Removes ``model_info.id`` and the top-level ``evaluation_id`` (which embeds the id) so a digest
+    over the result cannot be used as a model-id confirmation / enumeration oracle, while still
+    binding every score, timestamp, dataset and metric for tamper-evidence."""
+    import copy  # noqa: PLC0415
+    r = copy.deepcopy(record)
+    if isinstance(r.get("model_info"), dict):
+        r["model_info"].pop("id", None)
+    r.pop("evaluation_id", None)   # format eval_name/model_id/timestamp — embeds the id
+    return r
+
+
+def _record_digest(record: dict) -> str:
+    """``"<alg>:<hex>"`` over the canonical EEE record JSON with the cleartext model identity removed
+    (WP-I3; six-lens review: an UNSALTED digest over a record embedding ``model_info.id`` is a model
+    confirmation/enumeration oracle, so it is stripped first — the digest still binds scores,
+    timestamps, dataset and metrics for tamper-evidence). JCS when the ``[eval]`` extra is present,
+    else a labeled deterministic sort_keys fallback (the label tells a verifier which normalization
+    produced the hex, never a silent difference)."""
+    import hashlib  # noqa: PLC0415
+    stripped = _model_id_stripped(record)
+    try:
+        import rfc8785  # noqa: PLC0415
+        return "sha256-jcs:" + hashlib.sha256(rfc8785.dumps(stripped)).hexdigest()
+    except (ImportError, ValueError, TypeError):
+        canonical = json.dumps(stripped, sort_keys=True, separators=(",", ":"),
+                               ensure_ascii=False).encode("utf-8")
+        return "sha256-sortkeys:" + hashlib.sha256(canonical).hexdigest()
+
+
+def _leaks_model_id(text: str, model_id: str) -> bool:
+    """True iff ``text`` contains the model id or any of its name components (WP-I3 privacy, six-lens
+    review). Case-insensitive; checks the full ``org/name`` id, the bare name after the last '/',
+    and slug variants where '-', '_' and '.' are unified — so 'arc/gpt2/run1' is caught for a model
+    id whose bare name is 'gpt2'."""
+    hay = text.lower()
+    hay_norm = re.sub(r"[-_.]+", "", hay)
+    tokens = {model_id.lower()}
+    bare = model_id.split("/")[-1].lower()
+    if bare:
+        tokens.add(bare)
+        tokens.add(re.sub(r"[-_.]+", "", bare))   # slug-normalized ('gpt-2' -> 'gpt2')
+    return any(t and (t in hay or t in hay_norm) for t in tokens)
+
+
 def from_eee_dataset(source: Union[str, Path, dict], *, comparator: str, threshold: str,
                      timestamp: Optional[str] = None, eval_index: int = 0, metric_name: Optional[str] = None,
                      model_salt: Optional[bytes] = None, dataset_salt: Optional[bytes] = None,
@@ -149,6 +197,20 @@ def from_eee_dataset(source: Union[str, Path, dict], *, comparator: str, thresho
         raise EEEAdapterError("no timestamp: pass timestamp= or set retrieved_timestamp/evaluation_timestamp")
 
     provenance = {"source": "every_eval_ever", "eee_schema_version": record.get("schema_version") or _SCHEMA_VERSION}
+    # WP-I3: bind the receipt to the EXACT source record — the only adapter without a provenance
+    # binding. sha256 over the RFC-8785 (JCS) canonical record JSON with the cleartext model identity
+    # stripped first (see _record_digest — the digest binds scores/timestamps/dataset for
+    # tamper-evidence but is not a model-id oracle). Same "<alg>:<hex>" label scheme as
+    # adapters/_provenance.config_hash, but note it uses NO domain-separation tag (the label
+    # distinguishes it); it is provenance metadata, never a security commitment.
+    provenance["eee_record_sha256"] = _record_digest(record)
+    # the RESULT-level id is traceability metadata; the TOP-level evaluation_id embeds the model id
+    # in cleartext and stays deliberately excluded. Guard the result id: drop it if ANY model-name
+    # component appears (six-lens review: the exact full-repo-id substring test missed the bare
+    # name and slug variants — 'arc/gpt2/run1' leaked 'gpt2'). Case-insensitive over a token set.
+    _rid = chosen.get("evaluation_result_id")
+    if isinstance(_rid, str) and _rid and not _leaks_model_id(_rid, str(model_id)):
+        add_provenance(provenance, run_id=_rid)
     if eval_library.get("name"):
         provenance["harness"] = str(eval_library["name"])
     if eval_library.get("version"):

{proofbundle-2.1.0 → proofbundle-3.0.0}/src/proofbundle/anchors.py

@@ -144,9 +144,29 @@ def statement_content_root(payload_bytes: bytes) -> bytes:
     return canonical.statement_content_root(bytes(payload_bytes))
 
 
-def verify_anchor(anchor: dict, *, target_roots: dict, now: Optional[int] = None) -> dict:
+def _call_verifier(fn: Callable, proof: bytes, canonical_root: bytes, *,
+                   frozen: dict, now: Optional[int], rp_trust: Optional[dict]) -> dict:
+    """Dispatch to an anchor verifier, backward-compatibly. WP-A1 added the ``rp_trust`` kwarg (relying-
+    party trust material); a third-party verifier registered before A-1 accepts only ``(proof, root, *,
+    frozen, now)``. Pass ``rp_trust`` only when the verifier's signature accepts it (or takes ``**kwargs``),
+    so pre-A1 extension verifiers keep working — they simply never see RP trust (their own trust model)."""
+    import inspect  # noqa: PLC0415
+    kw: dict = {"frozen": frozen, "now": now}
+    try:
+        params = inspect.signature(fn).parameters
+        if "rp_trust" in params or any(p.kind is inspect.Parameter.VAR_KEYWORD for p in params.values()):
+            kw["rp_trust"] = rp_trust
+    except (ValueError, TypeError):   # a builtin/C callable with no introspectable signature
+        pass
+    return fn(proof, canonical_root, **kw)
+
+
+def verify_anchor(anchor: dict, *, target_roots: dict, now: Optional[int] = None,
+                  rp_trust: Optional[dict] = None) -> dict:
     """Verify ONE anchor entry, fail-closed. ``target_roots`` maps a target name to its canonical root
-    bytes (only the targets that exist for this receipt). Returns ``{ok, type, target, detail}``."""
+    bytes (only the targets that exist for this receipt). ``rp_trust`` (WP-A1) is the relying-party trust
+    material (TSA roots, Bitcoin block headers) — the ONLY source of trust for a confirmed time anchor;
+    the bundle's own ``frozen`` block is evidence, never trust. Returns ``{ok, type, target, detail}``."""
     _ensure_builtin_types()
     if not isinstance(anchor, dict):
         raise BundleFormatError("each anchor must be a JSON object")
@@ -159,6 +179,13 @@ def verify_anchor(anchor: dict, *, target_roots: dict, now: Optional[int] = None
     if target not in ANCHOR_TARGETS:
         out["detail"] = f"anchor target must be one of {ANCHOR_TARGETS}"
         return out
+    anchored_at = anchor.get("anchoredAt")
+    if anchored_at is not None and not isinstance(anchored_at, str):
+        # WP-A7: anchoredAt is INFORMATIVE, but a non-string value is malformed input, not a
+        # display nicety — fail closed like every other schema violation (detached anchors have no
+        # JSON-schema layer in front of them).
+        out["detail"] = "anchor anchoredAt must be an RFC 3339 string or null (informative only)"
+        return out
     if not isinstance(atype, str) or atype not in _VERIFIERS:
         # Unknown type is a FAIL, not a SKIP — an anchor we cannot check must never pass silently.
         out["detail"] = (f"no verifier registered for anchor type {atype!r} "
@@ -175,7 +202,8 @@ def verify_anchor(anchor: dict, *, target_roots: dict, now: Optional[int] = None
         return out
     proof = _b64d(anchor.get("proof"), "proof")
     try:
-        res = _VERIFIERS[atype](proof, canonical_root, frozen=anchor.get("frozen") or {}, now=now)
+        res = _call_verifier(_VERIFIERS[atype], proof, canonical_root,
+                             frozen=anchor.get("frozen") or {}, now=now, rp_trust=rp_trust)
     except Exception as exc:   # a verifier must be fail-closed; if it raises, treat as FAIL, never pass
         out["detail"] = f"anchor verifier error (fail-closed): {exc}"
         return out
@@ -183,11 +211,26 @@ def verify_anchor(anchor: dict, *, target_roots: dict, now: Optional[int] = None
     out["warn"] = bool(res.get("warn"))
     out["status"] = res.get("status") or ("pass" if out["ok"] else ("warn" if out["warn"] else "fail"))
     out["detail"] = res.get("detail", "")
+    # WP-A1: surface the trust provenance so the relying party can see WHY (and the require gate can only
+    # count RP-trusted anchors). `rp_trusted` True → verified against RP-supplied trust material;
+    # `needs_rp_trust` True → the proof exists but confirming it needs RP material (frozen is not trust);
+    # `frozenEvidence` True → the bundle carried frozen material, reported but never trusted.
+    for _f in ("rp_trusted", "needs_rp_trust", "frozenEvidence"):
+        if _f in res:
+            out[_f] = bool(res.get(_f))
+    # WP-A2: structured trusted time, carried VERBATIM from the type verifier — present only when
+    # the proof genuinely carries it (rfc3161 gen_time; a confirmed Bitcoin height). NEVER guessed,
+    # NEVER derived from the informative anchoredAt field.
+    tt = res.get("trustedTime")
+    if isinstance(tt, dict) and tt.get("source"):
+        out["trustedTime"] = tt
     return out
 
 
 def verify_anchors(anchors, *, target_roots: dict, require: Optional[str] = None,
-                   allow_pending: bool = False, now: Optional[int] = None) -> dict:
+                   require_target: Optional[str] = None,
+                   allow_pending: bool = False, now: Optional[int] = None,
+                   rp_trust: Optional[dict] = None) -> dict:
     """Verify a receipt's ``anchors``. Missing/empty → SKIP (unless ``require`` is set → FAIL). Present →
     fail-closed PASS/FAIL over every entry. ``require`` is ``None`` | ``'any'`` | a type string; when set,
     at least one anchor of that type (or any) must verify. Returns ``{status, detail, results}`` with
@@ -209,6 +252,11 @@ def verify_anchors(anchors, *, target_roots: dict, require: Optional[str] = None
     ``allow_pending=True`` (CLI ``--require-anchor … --allow-pending``) a pending anchor also satisfies
     the requirement — weaker, and the relying party opted into it explicitly. It never turns a broken
     anchor into a pass: a hard-failing anchor still aggregates to FAIL."""
+    if require_target is not None and require_target not in ANCHOR_TARGETS:
+        raise BundleFormatError(
+            f"require_target must be one of {ANCHOR_TARGETS}, got {require_target!r}")
+    if require_target is not None and not require:
+        require = "any"   # a target requirement IS an anchor requirement (mirrors --anchor-type)
     if not anchors:
         if require:
             return {"status": "FAIL", "require_met": False,
@@ -217,19 +265,28 @@ def verify_anchors(anchors, *, target_roots: dict, require: Optional[str] = None
         return {"status": "SKIP", "detail": "no external time anchors present", "results": []}
     if not isinstance(anchors, list):
         raise BundleFormatError("anchors must be a list")
-    results = [verify_anchor(a, target_roots=target_roots, now=now) for a in anchors]
+    results = [verify_anchor(a, target_roots=target_roots, now=now, rp_trust=rp_trust) for a in anchors]
     if require:   # a warn/pending/inclusion-only anchor never SATISFIES a requirement — only a full one
         want = None if require == "any" else require
+        # WP-A1: matched = ok ∧ ¬warn ∧ type ∧ TARGET. Matching the type alone was a backdating
+        # hole: a relying party demanding pre-registration evidence (--anchor-target
+        # preRegistration) was satisfied by a RECEIPT anchor stamped today — existence-now proves
+        # nothing about existence-before-the-run.
+        def _target_ok(r):
+            return require_target is None or r["target"] == require_target
         if allow_pending:
             matched = [r for r in results
-                       if (r["ok"] or r["warn"]) and (want is None or r["type"] == want)]
+                       if (r["ok"] or r["warn"]) and (want is None or r["type"] == want)
+                       and _target_ok(r)]
         else:
             matched = [r for r in results
-                       if r["ok"] and not r["warn"] and (want is None or r["type"] == want)]
+                       if r["ok"] and not r["warn"] and (want is None or r["type"] == want)
+                       and _target_ok(r)]
         if not matched:
-            detail = (f"--require-anchor {require} (--allow-pending): no verifying or pending anchor of that type"
+            tgt = f" with target {require_target!r}" if require_target is not None else ""
+            detail = (f"--require-anchor {require}{tgt} (--allow-pending): no verifying or pending anchor of that type/target"
                       if allow_pending else
-                      f"--require-anchor {require}: no verifying anchor of that type")
+                      f"--require-anchor {require}{tgt}: no verifying anchor of that type/target")
             return {"status": "FAIL", "require_met": False, "detail": detail, "results": results}
     hard_fail = any(not r["ok"] and not r["warn"] for r in results)
     if hard_fail:

{proofbundle-2.1.0 → proofbundle-3.0.0}/src/proofbundle/anchors_chia.py

@@ -26,7 +26,6 @@ Never raises for an ordinary bad proof.
 from __future__ import annotations
 
 import hashlib
-import json
 from typing import Optional
 
 ANCHOR_TYPE = "chia-datalayer/v1"
@@ -179,7 +178,8 @@ def verify_chia_datalayer(proof: bytes, canonical_root: bytes, *, frozen: Option
     # exception types (ValueError, ...) misses RecursionError (deeply nested JSON), MemoryError, or a TypeError
     # from a non-bytes canonical_root — all of which a caller-controlled proof could trigger. Catch everything.
     try:
-        proof_obj = json.loads(bytes(proof).decode("utf-8"))
+        from ._strict_json import loads_strict  # noqa: PLC0415 — WP-C1: dup keys fail-closed
+        proof_obj = loads_strict(bytes(proof).decode("utf-8"))
         if not isinstance(proof_obj, dict):
             return {"ok": False, "warn": False, "status": "fail", "detail": "chia-datalayer proof JSON must be an object"}
         res = verify_offline_merkle(proof_obj, bytes(canonical_root))

{proofbundle-2.1.0 → proofbundle-3.0.0}/src/proofbundle/anchors_markovian.py

@@ -8,8 +8,8 @@ NOT wired into the built-in set (``_ensure_builtin_types``) — a third-party ty
 **What it proves.** A ``markovian-provenance/v1`` stamp is an *issuer-attributable* commitment: it binds
 the committed data to a wallet via ``merkle_root = sha256(data_hash ":" salt ":" wallet)``, and the data
 itself is Bitcoin-anchored with OpenTimestamps. A verified anchor therefore says: *the target canonical
-root was committed by wallet W and existed by the OTS-attested Bitcoin block time.* The time is trustless
-(Bitcoin); the issuer binding is self-consistent inside the stamp envelope.
+root was committed by wallet W and existed by the OTS-attested Bitcoin block time.* The time is
+trust-minimized (Bitcoin PoW time); the issuer binding is self-consistent inside the stamp envelope.
 
 **Composition, not reinvention.** The Bitcoin time proof is delegated verbatim to the built-in
 ``opentimestamps`` verifier (:func:`proofbundle.anchors_ots.verify_opentimestamps`), inheriting its exact
@@ -31,7 +31,6 @@ from __future__ import annotations
 import base64
 import binascii
 import hashlib
-import json
 from typing import Optional
 
 ANCHOR_TYPE = "markovian-provenance/v1"
@@ -42,7 +41,7 @@ def _fail(status: str, detail: str) -> dict:
 
 
 def verify_markovian(proof: bytes, canonical_root: bytes, *, frozen: dict,
-                     now: Optional[int] = None) -> dict:
+                     now: Optional[int] = None, rp_trust: Optional[dict] = None) -> dict:
     """Fail-closed verifier for a ``markovian-provenance/v1`` anchor. Returns {ok, warn, status, detail}.
 
     Steps (any doubt -> not ok; never raises for an ordinary bad proof):
@@ -54,13 +53,17 @@ def verify_markovian(proof: bytes, canonical_root: bytes, *, frozen: dict,
     The final status/warn mirror the OTS verifier (pending / upgraded_unverified / confirmed); a PASS also
     names the committing wallet and Markovian chain height.
     """
-    # 1. parse
+    # 1. parse (WP-C1: strict — a duplicated key in the envelope is a parser differential over
+    # which wallet/merkle_root was committed; BundleFormatError keeps the never-raise contract)
     try:
-        env = json.loads(proof.decode("utf-8"))
+        from ._strict_json import loads_strict  # noqa: PLC0415
+        env = loads_strict(proof.decode("utf-8"))
         if not isinstance(env, dict):
             raise ValueError("envelope is not a JSON object")
     except (UnicodeDecodeError, ValueError) as exc:
         return _fail("malformed", f"markovian proof is not valid JSON: {exc}")
+    except Exception as exc:   # BundleFormatError (dup key) → clean fail, never a raise
+        return _fail("malformed", f"markovian proof rejected: {exc}")
 
     # 2. schema
     if env.get("schema") != ANCHOR_TYPE:
@@ -102,17 +105,31 @@ def verify_markovian(proof: bytes, canonical_root: bytes, *, frozen: dict,
         return _fail("no_lib",
                      "markovian anchor needs proofbundle[anchors] (opentimestamps) for the Bitcoin proof")
 
-    ots_res = verify_opentimestamps(ots_proof, canonical_root, frozen=frozen, now=now)
+    # WP-A1: forward the relying-party trust material so the composed Bitcoin proof is confirmed only
+    # against RP-supplied block headers, never the bundle's frozen ones.
+    ots_res = verify_opentimestamps(ots_proof, canonical_root, frozen=frozen, now=now, rp_trust=rp_trust)
     who = f"Markovian wallet {wallet}"
     chain = env.get("block_height")
     chain_part = f", Markovian chain block {chain}" if chain is not None else ""
+    # WP-A1: carry the composed OTS proof's trust-provenance fields verbatim so a relying party keying on
+    # rp_trusted / needs_rp_trust / frozenEvidence sees the same truth for a markovian anchor.
+    def _with_provenance(out: dict) -> dict:
+        for _f in ("rp_trusted", "needs_rp_trust", "frozenEvidence"):
+            if _f in ots_res:
+                out[_f] = bool(ots_res.get(_f))
+        return out
+
     if ots_res.get("ok"):
-        return {"ok": True, "warn": False, "status": "confirmed",
-                "detail": f"canonical root committed by {who}{chain_part}; {ots_res.get('detail', '')}"}
+        out = {"ok": True, "warn": False, "status": "confirmed",
+               "detail": f"canonical root committed by {who}{chain_part}; {ots_res.get('detail', '')}"}
+        if isinstance(ots_res.get("trustedTime"), dict):   # WP-A2: delegate verbatim (compose)
+            out["trustedTime"] = ots_res["trustedTime"]
+        return _with_provenance(out)
     # not a full anchor yet — carry the OTS lifecycle status/warn verbatim, framed as Markovian
-    return {"ok": False, "warn": bool(ots_res.get("warn")), "status": ots_res.get("status", "fail"),
-            "detail": f"markovian stamp envelope valid ({who}{chain_part}) but Bitcoin proof not verified: "
-                      f"{ots_res.get('detail', '')}"}
+    return _with_provenance(
+        {"ok": False, "warn": bool(ots_res.get("warn")), "status": ots_res.get("status", "fail"),
+         "detail": f"markovian stamp envelope valid ({who}{chain_part}) but Bitcoin proof not verified: "
+                   f"{ots_res.get('detail', '')}"})
 
 
 def register() -> None:

{proofbundle-2.1.0 → proofbundle-3.0.0}/src/proofbundle/anchors_ots.py

@@ -34,11 +34,18 @@ def _classify(timestamp):
 
 
 def verify_opentimestamps(proof: bytes, canonical_root: bytes, *, frozen: dict,
-                          now: Optional[int] = None) -> dict:
+                          now: Optional[int] = None, rp_trust: Optional[dict] = None) -> dict:
     """Fail-closed OTS verify. Returns {ok, detail, warn, status}. A pending proof is warn (status
-    'pending'); an upgraded proof with no supplied block header is not-ok-but-not-warn honest report
-    (status 'upgraded_unverified'); an upgraded proof verified against a supplied header is ok (status
-    'confirmed')."""
+    'pending'); an upgraded proof with no RELYING-PARTY block header is not-ok-but-not-warn honest report
+    (status 'needs_rp_trust'); an upgraded proof verified against an RP-supplied header is ok (status
+    'confirmed').
+
+    WP-A1 (Owner-GO, trust from the relying party): the Bitcoin block header that turns an upgraded proof
+    into a CONFIRMED anchor is trust material and MUST come from the relying party (``rp_trust`` — CLI
+    ``--bitcoin-header`` / policy ``anchors.bitcoin_block_headers``), NEVER from the bundle's own ``frozen``
+    block (which the producer controls and could backdate with a self-committed header). A frozen header is
+    reported as EVIDENCE (``frozenEvidence``) but is never trusted. Without RP trust material an upgraded
+    proof is honestly ``needs_rp_trust`` (ok=False), so ``--require-anchor`` is unmet → exit 3."""
     try:
         from opentimestamps.core.serialize import BytesDeserializationContext  # noqa: PLC0415
         from opentimestamps.core.timestamp import DetachedTimestampFile  # noqa: PLC0415
@@ -62,30 +69,47 @@ def verify_opentimestamps(proof: bytes, canonical_root: bytes, *, frozen: dict,
                               "run `ots upgrade`; not a full anchor yet"}
         return {"ok": False, "warn": False, "status": "empty",
                 "detail": "OTS proof has no Bitcoin or pending attestation"}
-    # upgraded: to verify offline we need the block's Merkle root for the attested height, supplied by a
-    # trusted (local pruned) Bitcoin node — proofbundle never fetches it. BitcoinBlockHeaderAttestation's
-    # own check is exactly `attestation_message == block_header.hashMerkleRoot`; we do that comparison
-    # directly against the supplied root (equivalent, and avoids reconstructing a full CBlockHeader).
-    headers = frozen.get("bitcoinBlockHeaderMerkleRootsByHeight") or {}
+    # upgraded: to verify offline we need the block's Merkle root for the attested height. WP-A1: that root
+    # is TRUST material — it must come from the RELYING PARTY (rp_trust.bitcoin_block_headers, i.e. their
+    # own trusted/pruned Bitcoin node), NEVER from the producer-controlled `frozen` block. A frozen header
+    # is surfaced as evidence only. BitcoinBlockHeaderAttestation's own check is exactly
+    # `attestation_message == block_header.hashMerkleRoot`; we do that comparison directly against the
+    # RP-supplied root (equivalent, and avoids reconstructing a full CBlockHeader).
+    rp_headers = (rp_trust or {}).get("bitcoin_block_headers") or {}
+    frozen_headers = frozen.get("bitcoinBlockHeaderMerkleRootsByHeight") or {}
+    if not rp_headers:
+        # no RP trust material → cannot confirm. Frozen alone is NOT trust (it could be a self-committed
+        # backdated header). Honest not-ok report; --require-anchor stays unmet (exit 3).
+        return {"ok": False, "warn": False, "status": "needs_rp_trust", "needs_rp_trust": True,
+                "frozenEvidence": bool(frozen_headers),
+                "detail": f"OTS proof is upgraded (Bitcoin height {heights}) but confirming it needs a "
+                          "relying-party-supplied Bitcoin block header (--bitcoin-header / policy "
+                          "anchors.bitcoin_block_headers). The bundle's own frozen header is producer-"
+                          "controlled evidence, not trust; not claiming a pass"}
     for msg, att in dtf.timestamp.all_attestations():
         height = getattr(att, "height", None)
         if height is None:
             continue
-        merkle_root_hex = headers.get(str(height))
+        merkle_root_hex = rp_headers.get(str(height))
         if not merkle_root_hex:
             continue
         try:
             expected = bytes.fromhex(merkle_root_hex)
         except ValueError:
-            return {"ok": False, "warn": False, "status": "bad_header",
-                    "detail": f"supplied Bitcoin block merkle root for height {height} is not valid hex"}
+            return {"ok": False, "warn": False, "status": "bad_header", "rp_trusted": True,
+                    "detail": f"relying-party Bitcoin block merkle root for height {height} is not valid hex"}
         if msg == expected:
-            return {"ok": True, "warn": False, "status": "confirmed",
+            return {"ok": True, "warn": False, "status": "confirmed", "rp_trusted": True,
+                    # WP-A2: a Bitcoin HEIGHT is the proof's native trusted-time unit — reported
+                    # structured, never converted to a wall-clock guess (the header time is not
+                    # part of the supplied material).
+                    "trustedTime": {"source": "bitcoin_block", "height": height},
                     "detail": f"OTS proof confirmed: committed in the Bitcoin block at height {height} "
-                              "(merkle root supplied by a trusted node)"}
-        return {"ok": False, "warn": False, "status": "block_mismatch",
-                "detail": f"OTS Bitcoin attestation at height {height} does not match the supplied "
-                          "block merkle root"}
-    return {"ok": False, "warn": False, "status": "upgraded_unverified",
-            "detail": f"OTS proof is upgraded (Bitcoin height {heights}) but no block header was supplied "
-                      "— offline verification needs a local (pruned) Bitcoin node; not claiming a pass"}
+                              "(merkle root supplied by the relying party)"}
+        return {"ok": False, "warn": False, "status": "block_mismatch", "rp_trusted": True,
+                "detail": f"OTS Bitcoin attestation at height {height} does not match the relying-party "
+                          "block merkle root (present-and-wrong)"}
+    return {"ok": False, "warn": False, "status": "upgraded_unverified", "needs_rp_trust": True,
+            "frozenEvidence": bool(frozen_headers),
+            "detail": f"OTS proof is upgraded (Bitcoin height {heights}) but the relying party supplied no "
+                      "block header for that height; not claiming a pass"}