proofbundle 3.0.0__tar.gz → 3.1.0__tar.gz

{proofbundle-3.0.0/src/proofbundle.egg-info → proofbundle-3.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofbundle
-Version: 3.0.0
+Version: 3.1.0
 Summary: Emit and verify portable cryptographic evidence bundles, offline: Ed25519 + RFC 6962 Merkle + optional SD-JWT.
 Author: Konrad Gruszka
 License: MIT
@@ -55,8 +55,8 @@ Dynamic: license-file
 <div align="center">
 
 <picture>
-  <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/b7n0de/proofbundle/main/assets/b7n0de-logo-dark.svg">
-  <img alt="b7n0de, Verified AI Work" src="https://raw.githubusercontent.com/b7n0de/proofbundle/main/assets/b7n0de-logo.svg" height="60">
+  <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/b7n0de/proofbundle/main/assets/b7n0de-hase-logo-dark.png">
+  <img alt="b7n0de, Verified AI Work, pink rabbit mascot over the B7N0DE wordmark" src="https://raw.githubusercontent.com/b7n0de/proofbundle/main/assets/b7n0de-hase-logo.png" width="200">
 </picture>
 
 <h1>proofbundle</h1>
@@ -75,12 +75,29 @@ Merkle, one file, no server, no network.
 [![DOI](https://zenodo.org/badge/DOI/10.5281/zenodo.21230467.svg)](https://doi.org/10.5281/zenodo.21230467)
 [![Ruff](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/ruff/main/assets/badge/v2.json)](https://github.com/astral-sh/ruff)
 [![Mutation tested](https://img.shields.io/badge/tests-mutation_gated-D6248A.svg)](https://github.com/b7n0de/proofbundle/blob/main/scripts/mutation_check.py)
-<!-- SLSA / PEP 740 attestation badges follow once the first attested release lands, see RELEASE.md. -->
+[![PyPI attestations](https://img.shields.io/badge/PyPI-PEP_740_attested-D6248A.svg)](https://pypi.org/project/proofbundle/#files)
+[![SLSA provenance](https://img.shields.io/badge/SLSA-build_provenance-D6248A.svg)](https://slsa.dev/spec/v1.0/provenance)
 
 **Reviewing this for adoption?** Start with the 30-minute adversarial audit path: **[docs/REVIEWERS.md](https://github.com/b7n0de/proofbundle/blob/main/docs/REVIEWERS.md)**.
 
 </div>
 
+## Contents
+
+- [60-second try](#60-second-try-offline)
+- [Inspect-native?](#inspect-native-metr-task-standard-uk-aisi-ecosystem)
+- [The problem](#the-problem)
+- [What a receipt proves, and what it doesn't](#what-a-receipt-proves-and-what-it-doesnt)
+- [How it fits together](#how-it-fits-together)
+- [Cite this work](#cite-this-work)
+- [Post-quantum posture](#post-quantum-posture-honest-two-layers)
+- [What's in the box](#whats-in-the-box)
+- [Docs](#docs)
+- [Install](#install)
+- [Status, scope and roadmap](#status-scope-and-roadmap)
+- [Contributing](#contributing)
+- [License](#license)
+
 ## 60-second try (offline)
 
 ```bash
@@ -91,21 +108,9 @@ git clone https://github.com/b7n0de/proofbundle && cd proofbundle
 pip install -e ".[eval,inspect]" && make demo   # or `make full-demo` for log -> receipt -> verify
 ```
 
-## The problem
-
-Every AI eval number you read — a safety benchmark, a capability score, a leaderboard entry — is an
-**unverifiable claim**. You trust the lab. There's no portable way to check, offline, that a result
-was signed by a stated party, hasn't been altered, and covers the samples it claims.
-
-proofbundle is that check. It's a small MIT-licensed Python tool (a compact, auditable trusted core,
-depends only on [`cryptography`](https://cryptography.io)) that turns a result into a signed
-receipt anyone can verify from a single file — and it's honest about the line it does not cross.
-
-## What the demo shows
-
-You'll see an honest receipt verify `=> OK`, then six independent tampers each verify `FAILED`, then
-a swapped sample get caught — all in memory. `proofbundle demo` exits non-zero if any tamper slips through,
-so it's also a self-test. Full walkthrough: **[docs/DEMO.md](https://github.com/b7n0de/proofbundle/blob/main/docs/DEMO.md)**.
+The demo runs entirely in memory: an honest receipt verifies `=> OK`, six independent tampers each
+verify `FAILED`, and a swapped sample gets caught. `proofbundle demo` exits non-zero if any tamper
+slips through, so it doubles as a self-test. Full walkthrough: **[docs/DEMO.md](https://github.com/b7n0de/proofbundle/blob/main/docs/DEMO.md)**.
 
 ```bash
 # verify a real hosted receipt without writing any code:
@@ -120,7 +125,7 @@ proofbundle verify receipt.json        # exit 0 = crypto OK, 1 = crypto/verifica
 proofbundle verify receipt.json --policy trust_policy.json   # POLICY: OK | FAIL (exit 3) | NOT_EVALUATED
 ```
 
-## Inspect-native? (METR Task Standard / UK-AISI ecosystem)
+## Inspect-native? (METR Task Standard, UK-AISI ecosystem)
 
 The receipt layer runs directly on [Inspect AI](https://inspect.aisi.org.uk/) — and the proof is
 reproducible offline in minutes:
@@ -135,7 +140,22 @@ In your own pipeline the end-of-task hook signs every run automatically. Walkthr
 **[docs/INSPECT_HAPPY_PATH.md](https://github.com/b7n0de/proofbundle/blob/main/docs/INSPECT_HAPPY_PATH.md)** · worked example:
 **[examples/inspect_receipt.py](https://github.com/b7n0de/proofbundle/blob/main/examples/inspect_receipt.py)**.
 
-## What a receipt proves — and what it doesn't
+## The problem
+
+Every AI eval number you read — a safety benchmark, a capability score, a leaderboard entry — is an
+**unverifiable claim**. You trust the lab. There's no portable way to check, offline, that a result
+was signed by a stated party, hasn't been altered, and covers the samples it claims.
+
+proofbundle is that check. It's a small MIT-licensed Python tool (a compact, auditable trusted core,
+depends only on [`cryptography`](https://cryptography.io)) that turns a result into a signed
+receipt anyone can verify from a single file — and it's honest about the line it does not cross.
+
+In plain language: a proofbundle receipt is the cash-register receipt of an AI test result. It shows
+who claimed the number and that nobody quietly changed it afterwards. It does not show the test was
+good — the way a cash-register receipt does not show the meal was good — but without a receipt there
+is nothing to check at all.
+
+## What a receipt proves, and what it doesn't
 
 | ✅ It proves | ❌ It does **not** prove |
 |---|---|
@@ -149,6 +169,43 @@ This boundary is the point, not a weakness. A receipt makes a claim **attributab
 and — with pre-registration and per-sample auditing — bounded and spot-checkable**. Full detail:
 **[THREAT_MODEL.md](https://github.com/b7n0de/proofbundle/blob/main/THREAT_MODEL.md)**.
 
+## How it fits together
+
+*(diagram renders on GitHub — [view it there](https://github.com/b7n0de/proofbundle#how-it-fits-together); PyPI shows the source)*
+
+```mermaid
+flowchart LR
+    H["eval harness<br/>inspect_ai · lm-eval · promptfoo · pytest"] --> A["adapter → signed claim<br/>salted commitments · provenance · samples root"]
+    A --> R["receipt<br/>one portable file"]
+    R --> V{{"proofbundle verify — offline"}}
+    V --> C["signature · Merkle inclusion · SD-JWT/KB ·<br/>witness quorum · status list · sample openings"]
+    C --> OK(["CRYPTO: OK / FAILED"])
+    style V fill:#D6248A,stroke:#D6248A,color:#fff
+    style OK fill:#D6248A,stroke:#D6248A,color:#fff
+```
+
+### Where it sits in the research neighbourhood
+
+proofbundle is a **practical, released, offline verifier — complementary to TEE and zero-knowledge
+approaches**, not a replacement for any of them. It is honest about the line each neighbour crosses
+that a receipt does not. Maturity labels are stated so nothing reads as a settled standard when it is
+a preprint.
+
+| Neighbour | What it contributes that a receipt does not | Maturity | Where proofbundle draws the line |
+|---|---|---|---|
+| **K-Veritas** ([arXiv 2605.08586](https://arxiv.org/abs/2605.08586)) — nonrepudiable experimental results | the academic case for tamper-evident, execution-bound experiment reports | preprint | proofbundle is a released, offline, eval-shaped receipt for exactly this problem, not the only take on it |
+| **Attestable Audits** ([arXiv 2506.23706](https://arxiv.org/abs/2506.23706)) — TEE-verified safety audits | that the computation actually ran, inside a trusted enclave | preprint (research prototype) | a receipt proves authorship + integrity, **not** that the computation was correct — that needs a TEE or independent reproduction |
+| **BenchJack** ([arXiv 2605.12673](https://arxiv.org/abs/2605.12673)) — auditing agent benchmarks | whether the benchmark itself is gameable (reward-hacking) | preprint | a receipt over a gameable benchmark is honestly still just a receipt; it says nothing about whether the eval was well designed |
+| **Evaluation Cards** ([arXiv 2606.09809](https://arxiv.org/abs/2606.09809)) — reporting / interpretation layer | a structured, human-facing account of what a result means | preprint | a receipt can bind a card's integrity, not its quality |
+| in-toto / Sigstore, SCITT / Rekor v2, OpenSSF Model Signing (stable standards / production) | artifact-provenance, public transparency, model-artifact signing | — | see [INTEROP.md](https://github.com/b7n0de/proofbundle/blob/main/INTEROP.md) for the honest tool-by-tool comparison |
+
+## Cite this work
+
+If proofbundle helped your evaluation pipeline, please cite it. Machine-readable metadata is in
+[`CITATION.cff`](https://github.com/b7n0de/proofbundle/blob/main/CITATION.cff); the archival record and
+concept DOI are on Zenodo ([10.5281/zenodo.21230467](https://doi.org/10.5281/zenodo.21230467)), and the
+current design write-up is the Technical Note linked from [b7n0de.com/proofbundle](https://b7n0de.com/proofbundle).
+
 ## Post-quantum posture (honest, two layers)
 
 proofbundle is **not** "quantum-proof" or "quantum-safe" as a whole. It combines two cryptographic layers
@@ -173,28 +230,6 @@ On the witness side, C2SP checkpoints already carry post-quantum **ML-DSA-44** (
 (`proofbundle[pq]`); a post-quantum *payload* signature — crypto-agility for the receipt itself — is on the
 roadmap.
 
-## In plain language
-
-A proofbundle receipt is the cash-register receipt of an AI test result: it shows who claimed the
-number and that nobody quietly changed it afterwards. It does not show the test was good — the way a
-cash-register receipt does not show the meal was good — but without a receipt there is nothing to
-check at all.
-
-## How it fits together
-
-*(diagram renders on GitHub — [view it there](https://github.com/b7n0de/proofbundle#how-it-fits-together); PyPI shows the source)*
-
-```mermaid
-flowchart LR
-    H["eval harness<br/>inspect_ai · lm-eval · promptfoo · pytest"] --> A["adapter → signed claim<br/>salted commitments · provenance · samples root"]
-    A --> R["receipt<br/>one portable file"]
-    R --> V{{"proofbundle verify — offline"}}
-    V --> C["signature · Merkle inclusion · SD-JWT/KB ·<br/>witness quorum · status list · sample openings"]
-    C --> OK(["CRYPTO: OK / FAILED"])
-    style V fill:#D6248A,stroke:#D6248A,color:#fff
-    style OK fill:#D6248A,stroke:#D6248A,color:#fff
-```
-
 ## What's in the box
 
 - **Core** — Ed25519 signature + RFC 6962 / 9162 Merkle inclusion, verified fully offline. Checks a
@@ -285,7 +320,7 @@ pip install "proofbundle[pq]"           # verify ML-DSA-44 (post-quantum) witnes
 Requires Python 3.10+. The verify path never rolls its own crypto — Ed25519 comes from
 `cryptography`; Merkle hashing is RFC 6962.
 
-## Status & scope
+## Status, scope and roadmap
 
 Beta, SemVer-committed, with a CI test suite behind a mutation gate + property-based parser fuzzing. Correctness
 is anchored to external RFC 6962 vectors and a real Rekor proof, not just its own bundles. It is
@@ -293,6 +328,13 @@ is anchored to external RFC 6962 vectors and a real Rekor proof, not just its ow
 by itself — it is the small, offline, standards-native receipt layer between them. Security policy:
 [SECURITY.md](https://github.com/b7n0de/proofbundle/blob/main/SECURITY.md).
 
+**Roadmap (stated honestly, all forward-looking):**
+
+- A post-quantum *payload* signature (crypto-agility for the receipt itself) is on the roadmap; today the
+  post-quantum coverage is witness-side ML-DSA-44 cosignatures only.
+- A CLI flag to select the content-root algorithm is still deferred (`jcs-sha256-v1` is the signed default).
+- **Preview:** a TEE-attestation bridge — see [docs/EXPERIMENTAL_ENCLAVE.md](https://github.com/b7n0de/proofbundle/blob/main/docs/EXPERIMENTAL_ENCLAVE.md).
+
 ## Contributing
 
 See [CONTRIBUTING.md](https://github.com/b7n0de/proofbundle/blob/main/CONTRIBUTING.md) and the [Code of Conduct](https://github.com/b7n0de/proofbundle/blob/main/CODE_OF_CONDUCT.md). Good first

{proofbundle-3.0.0 → proofbundle-3.1.0}/README.md

@@ -1,8 +1,8 @@
 <div align="center">
 
 <picture>
-  <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/b7n0de/proofbundle/main/assets/b7n0de-logo-dark.svg">
-  <img alt="b7n0de, Verified AI Work" src="https://raw.githubusercontent.com/b7n0de/proofbundle/main/assets/b7n0de-logo.svg" height="60">
+  <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/b7n0de/proofbundle/main/assets/b7n0de-hase-logo-dark.png">
+  <img alt="b7n0de, Verified AI Work, pink rabbit mascot over the B7N0DE wordmark" src="https://raw.githubusercontent.com/b7n0de/proofbundle/main/assets/b7n0de-hase-logo.png" width="200">
 </picture>
 
 <h1>proofbundle</h1>
@@ -21,12 +21,29 @@ Merkle, one file, no server, no network.
 [![DOI](https://zenodo.org/badge/DOI/10.5281/zenodo.21230467.svg)](https://doi.org/10.5281/zenodo.21230467)
 [![Ruff](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/ruff/main/assets/badge/v2.json)](https://github.com/astral-sh/ruff)
 [![Mutation tested](https://img.shields.io/badge/tests-mutation_gated-D6248A.svg)](https://github.com/b7n0de/proofbundle/blob/main/scripts/mutation_check.py)
-<!-- SLSA / PEP 740 attestation badges follow once the first attested release lands, see RELEASE.md. -->
+[![PyPI attestations](https://img.shields.io/badge/PyPI-PEP_740_attested-D6248A.svg)](https://pypi.org/project/proofbundle/#files)
+[![SLSA provenance](https://img.shields.io/badge/SLSA-build_provenance-D6248A.svg)](https://slsa.dev/spec/v1.0/provenance)
 
 **Reviewing this for adoption?** Start with the 30-minute adversarial audit path: **[docs/REVIEWERS.md](https://github.com/b7n0de/proofbundle/blob/main/docs/REVIEWERS.md)**.
 
 </div>
 
+## Contents
+
+- [60-second try](#60-second-try-offline)
+- [Inspect-native?](#inspect-native-metr-task-standard-uk-aisi-ecosystem)
+- [The problem](#the-problem)
+- [What a receipt proves, and what it doesn't](#what-a-receipt-proves-and-what-it-doesnt)
+- [How it fits together](#how-it-fits-together)
+- [Cite this work](#cite-this-work)
+- [Post-quantum posture](#post-quantum-posture-honest-two-layers)
+- [What's in the box](#whats-in-the-box)
+- [Docs](#docs)
+- [Install](#install)
+- [Status, scope and roadmap](#status-scope-and-roadmap)
+- [Contributing](#contributing)
+- [License](#license)
+
 ## 60-second try (offline)
 
 ```bash
@@ -37,21 +54,9 @@ git clone https://github.com/b7n0de/proofbundle && cd proofbundle
 pip install -e ".[eval,inspect]" && make demo   # or `make full-demo` for log -> receipt -> verify
 ```
 
-## The problem
-
-Every AI eval number you read — a safety benchmark, a capability score, a leaderboard entry — is an
-**unverifiable claim**. You trust the lab. There's no portable way to check, offline, that a result
-was signed by a stated party, hasn't been altered, and covers the samples it claims.
-
-proofbundle is that check. It's a small MIT-licensed Python tool (a compact, auditable trusted core,
-depends only on [`cryptography`](https://cryptography.io)) that turns a result into a signed
-receipt anyone can verify from a single file — and it's honest about the line it does not cross.
-
-## What the demo shows
-
-You'll see an honest receipt verify `=> OK`, then six independent tampers each verify `FAILED`, then
-a swapped sample get caught — all in memory. `proofbundle demo` exits non-zero if any tamper slips through,
-so it's also a self-test. Full walkthrough: **[docs/DEMO.md](https://github.com/b7n0de/proofbundle/blob/main/docs/DEMO.md)**.
+The demo runs entirely in memory: an honest receipt verifies `=> OK`, six independent tampers each
+verify `FAILED`, and a swapped sample gets caught. `proofbundle demo` exits non-zero if any tamper
+slips through, so it doubles as a self-test. Full walkthrough: **[docs/DEMO.md](https://github.com/b7n0de/proofbundle/blob/main/docs/DEMO.md)**.
 
 ```bash
 # verify a real hosted receipt without writing any code:
@@ -66,7 +71,7 @@ proofbundle verify receipt.json        # exit 0 = crypto OK, 1 = crypto/verifica
 proofbundle verify receipt.json --policy trust_policy.json   # POLICY: OK | FAIL (exit 3) | NOT_EVALUATED
 ```
 
-## Inspect-native? (METR Task Standard / UK-AISI ecosystem)
+## Inspect-native? (METR Task Standard, UK-AISI ecosystem)
 
 The receipt layer runs directly on [Inspect AI](https://inspect.aisi.org.uk/) — and the proof is
 reproducible offline in minutes:
@@ -81,7 +86,22 @@ In your own pipeline the end-of-task hook signs every run automatically. Walkthr
 **[docs/INSPECT_HAPPY_PATH.md](https://github.com/b7n0de/proofbundle/blob/main/docs/INSPECT_HAPPY_PATH.md)** · worked example:
 **[examples/inspect_receipt.py](https://github.com/b7n0de/proofbundle/blob/main/examples/inspect_receipt.py)**.
 
-## What a receipt proves — and what it doesn't
+## The problem
+
+Every AI eval number you read — a safety benchmark, a capability score, a leaderboard entry — is an
+**unverifiable claim**. You trust the lab. There's no portable way to check, offline, that a result
+was signed by a stated party, hasn't been altered, and covers the samples it claims.
+
+proofbundle is that check. It's a small MIT-licensed Python tool (a compact, auditable trusted core,
+depends only on [`cryptography`](https://cryptography.io)) that turns a result into a signed
+receipt anyone can verify from a single file — and it's honest about the line it does not cross.
+
+In plain language: a proofbundle receipt is the cash-register receipt of an AI test result. It shows
+who claimed the number and that nobody quietly changed it afterwards. It does not show the test was
+good — the way a cash-register receipt does not show the meal was good — but without a receipt there
+is nothing to check at all.
+
+## What a receipt proves, and what it doesn't
 
 | ✅ It proves | ❌ It does **not** prove |
 |---|---|
@@ -95,6 +115,43 @@ This boundary is the point, not a weakness. A receipt makes a claim **attributab
 and — with pre-registration and per-sample auditing — bounded and spot-checkable**. Full detail:
 **[THREAT_MODEL.md](https://github.com/b7n0de/proofbundle/blob/main/THREAT_MODEL.md)**.
 
+## How it fits together
+
+*(diagram renders on GitHub — [view it there](https://github.com/b7n0de/proofbundle#how-it-fits-together); PyPI shows the source)*
+
+```mermaid
+flowchart LR
+    H["eval harness<br/>inspect_ai · lm-eval · promptfoo · pytest"] --> A["adapter → signed claim<br/>salted commitments · provenance · samples root"]
+    A --> R["receipt<br/>one portable file"]
+    R --> V{{"proofbundle verify — offline"}}
+    V --> C["signature · Merkle inclusion · SD-JWT/KB ·<br/>witness quorum · status list · sample openings"]
+    C --> OK(["CRYPTO: OK / FAILED"])
+    style V fill:#D6248A,stroke:#D6248A,color:#fff
+    style OK fill:#D6248A,stroke:#D6248A,color:#fff
+```
+
+### Where it sits in the research neighbourhood
+
+proofbundle is a **practical, released, offline verifier — complementary to TEE and zero-knowledge
+approaches**, not a replacement for any of them. It is honest about the line each neighbour crosses
+that a receipt does not. Maturity labels are stated so nothing reads as a settled standard when it is
+a preprint.
+
+| Neighbour | What it contributes that a receipt does not | Maturity | Where proofbundle draws the line |
+|---|---|---|---|
+| **K-Veritas** ([arXiv 2605.08586](https://arxiv.org/abs/2605.08586)) — nonrepudiable experimental results | the academic case for tamper-evident, execution-bound experiment reports | preprint | proofbundle is a released, offline, eval-shaped receipt for exactly this problem, not the only take on it |
+| **Attestable Audits** ([arXiv 2506.23706](https://arxiv.org/abs/2506.23706)) — TEE-verified safety audits | that the computation actually ran, inside a trusted enclave | preprint (research prototype) | a receipt proves authorship + integrity, **not** that the computation was correct — that needs a TEE or independent reproduction |
+| **BenchJack** ([arXiv 2605.12673](https://arxiv.org/abs/2605.12673)) — auditing agent benchmarks | whether the benchmark itself is gameable (reward-hacking) | preprint | a receipt over a gameable benchmark is honestly still just a receipt; it says nothing about whether the eval was well designed |
+| **Evaluation Cards** ([arXiv 2606.09809](https://arxiv.org/abs/2606.09809)) — reporting / interpretation layer | a structured, human-facing account of what a result means | preprint | a receipt can bind a card's integrity, not its quality |
+| in-toto / Sigstore, SCITT / Rekor v2, OpenSSF Model Signing (stable standards / production) | artifact-provenance, public transparency, model-artifact signing | — | see [INTEROP.md](https://github.com/b7n0de/proofbundle/blob/main/INTEROP.md) for the honest tool-by-tool comparison |
+
+## Cite this work
+
+If proofbundle helped your evaluation pipeline, please cite it. Machine-readable metadata is in
+[`CITATION.cff`](https://github.com/b7n0de/proofbundle/blob/main/CITATION.cff); the archival record and
+concept DOI are on Zenodo ([10.5281/zenodo.21230467](https://doi.org/10.5281/zenodo.21230467)), and the
+current design write-up is the Technical Note linked from [b7n0de.com/proofbundle](https://b7n0de.com/proofbundle).
+
 ## Post-quantum posture (honest, two layers)
 
 proofbundle is **not** "quantum-proof" or "quantum-safe" as a whole. It combines two cryptographic layers
@@ -119,28 +176,6 @@ On the witness side, C2SP checkpoints already carry post-quantum **ML-DSA-44** (
 (`proofbundle[pq]`); a post-quantum *payload* signature — crypto-agility for the receipt itself — is on the
 roadmap.
 
-## In plain language
-
-A proofbundle receipt is the cash-register receipt of an AI test result: it shows who claimed the
-number and that nobody quietly changed it afterwards. It does not show the test was good — the way a
-cash-register receipt does not show the meal was good — but without a receipt there is nothing to
-check at all.
-
-## How it fits together
-
-*(diagram renders on GitHub — [view it there](https://github.com/b7n0de/proofbundle#how-it-fits-together); PyPI shows the source)*
-
-```mermaid
-flowchart LR
-    H["eval harness<br/>inspect_ai · lm-eval · promptfoo · pytest"] --> A["adapter → signed claim<br/>salted commitments · provenance · samples root"]
-    A --> R["receipt<br/>one portable file"]
-    R --> V{{"proofbundle verify — offline"}}
-    V --> C["signature · Merkle inclusion · SD-JWT/KB ·<br/>witness quorum · status list · sample openings"]
-    C --> OK(["CRYPTO: OK / FAILED"])
-    style V fill:#D6248A,stroke:#D6248A,color:#fff
-    style OK fill:#D6248A,stroke:#D6248A,color:#fff
-```
-
 ## What's in the box
 
 - **Core** — Ed25519 signature + RFC 6962 / 9162 Merkle inclusion, verified fully offline. Checks a
@@ -231,7 +266,7 @@ pip install "proofbundle[pq]"           # verify ML-DSA-44 (post-quantum) witnes
 Requires Python 3.10+. The verify path never rolls its own crypto — Ed25519 comes from
 `cryptography`; Merkle hashing is RFC 6962.
 
-## Status & scope
+## Status, scope and roadmap
 
 Beta, SemVer-committed, with a CI test suite behind a mutation gate + property-based parser fuzzing. Correctness
 is anchored to external RFC 6962 vectors and a real Rekor proof, not just its own bundles. It is
@@ -239,6 +274,13 @@ is anchored to external RFC 6962 vectors and a real Rekor proof, not just its ow
 by itself — it is the small, offline, standards-native receipt layer between them. Security policy:
 [SECURITY.md](https://github.com/b7n0de/proofbundle/blob/main/SECURITY.md).
 
+**Roadmap (stated honestly, all forward-looking):**
+
+- A post-quantum *payload* signature (crypto-agility for the receipt itself) is on the roadmap; today the
+  post-quantum coverage is witness-side ML-DSA-44 cosignatures only.
+- A CLI flag to select the content-root algorithm is still deferred (`jcs-sha256-v1` is the signed default).
+- **Preview:** a TEE-attestation bridge — see [docs/EXPERIMENTAL_ENCLAVE.md](https://github.com/b7n0de/proofbundle/blob/main/docs/EXPERIMENTAL_ENCLAVE.md).
+
 ## Contributing
 
 See [CONTRIBUTING.md](https://github.com/b7n0de/proofbundle/blob/main/CONTRIBUTING.md) and the [Code of Conduct](https://github.com/b7n0de/proofbundle/blob/main/CODE_OF_CONDUCT.md). Good first

{proofbundle-3.0.0 → proofbundle-3.1.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "proofbundle"
-version = "3.0.0"
+version = "3.1.0"
 description = "Emit and verify portable cryptographic evidence bundles, offline: Ed25519 + RFC 6962 Merkle + optional SD-JWT."
 readme = "README.md"
 requires-python = ">=3.10"
@@ -100,7 +100,7 @@ proofbundle = "proofbundle.pytest_plugin"
 where = ["src"]
 
 [tool.setuptools.package-data]
-proofbundle = ["py.typed", "eee_eval_schema.json"]
+proofbundle = ["py.typed", "eee_eval_schema.json", "policies/*.json"]
 
 [tool.ruff]
 line-length = 100

{proofbundle-3.0.0 → proofbundle-3.1.0}/src/proofbundle/__init__.py

@@ -13,7 +13,7 @@ from __future__ import annotations
 
 from typing import TYPE_CHECKING
 
-__version__ = "3.0.0"
+__version__ = "3.1.0"
 
 # The `proofbundle/v0.1` normative spec revision this build implements — kept in sync with the
 # `Revision:` line at the top of SPEC.md by tests/test_docs_truth.py (WP-B1, closes #28). Bump

{proofbundle-3.0.0 → proofbundle-3.1.0}/src/proofbundle/adapters/eee.py

@@ -99,14 +99,27 @@ def _extract_score(score_details: dict, metric_config: dict) -> str:
 
 def _model_id_stripped(record: dict) -> dict:
     """A deep copy of the EEE record with the cleartext model identity removed (WP-I3 privacy fix).
-    Removes ``model_info.id`` and the top-level ``evaluation_id`` (which embeds the id) so a digest
-    over the result cannot be used as a model-id confirmation / enumeration oracle, while still
-    binding every score, timestamp, dataset and metric for tamper-evidence."""
+    Removes ``model_info.id`` and the id-bearing top-level fields (``evaluation_id`` which embeds the
+    id, and ``evaluation_result_id``) so a digest over the result cannot be used as a model-id
+    confirmation / enumeration oracle, while still binding every score, timestamp, dataset and metric
+    for tamper-evidence.
+
+    M2 (6-lens review 2026-07-11): ``evaluation_result_id`` was left IN the digest record while the
+    run_id provenance path already `_leaks_model_id`-guards it — an asymmetry that kept the digest a
+    model-id oracle (the id can correlate to / embed the model). It is a provenance identifier, not a
+    scored/content field, so stripping it from the DIGEST removes the oracle without weakening the
+    tamper-evidence over the actual result content (it stays available for run_id provenance, which
+    applies its own leak guard)."""
     import copy  # noqa: PLC0415
     r = copy.deepcopy(record)
     if isinstance(r.get("model_info"), dict):
         r["model_info"].pop("id", None)
-    r.pop("evaluation_id", None)   # format eval_name/model_id/timestamp — embeds the id
+    r.pop("evaluation_id", None)          # format eval_name/model_id/timestamp — embeds the id
+    # M2: strip the per-result ``evaluation_result_id`` (nested in each ``evaluation_results[*]``) —
+    # it is a provenance id that can embed/correlate the model id (a digest over it is an oracle).
+    for er in r.get("evaluation_results", []) or []:
+        if isinstance(er, dict):
+            er.pop("evaluation_result_id", None)
     return r
 
 

{proofbundle-3.0.0 → proofbundle-3.1.0}/src/proofbundle/bundle.py

@@ -22,7 +22,8 @@ malformed exit code, not a crash.
 from __future__ import annotations
 
 import base64
-from typing import Union
+import hmac
+from typing import Optional, Union
 
 from . import merkle
 from ._strict_json import loads_strict
@@ -31,7 +32,8 @@ from .kbjwt import holder_key_from_cnf, split_key_binding, verify_key_binding
 from .signature import verify_ed25519
 from .sdjwt import verify_sd_jwt
 
-__all__ = ["SCHEMA", "verify_bundle", "load_bundle", "recompute_merkle_root_b64"]
+__all__ = ["SCHEMA", "verify_bundle", "load_bundle", "recompute_merkle_root_b64",
+           "root_authenticity_summary"]
 
 
 def _issuer_requires_holder_binding(sd_part: str) -> bool:
@@ -134,7 +136,9 @@ def load_bundle(path: str) -> dict:
         return loads_strict(handle.read())
 
 
-def verify_bundle(bundle: Union[dict, str], *, expected_aud=None, expected_nonce=None) -> VerificationResult:
+def verify_bundle(bundle: Union[dict, str], *, expected_aud=None, expected_nonce=None,
+                  expected_root_b64: Optional[str] = None,
+                  expected_tree_size: Optional[int] = None) -> VerificationResult:
     """Verify an evidence bundle (a dict or a path to a JSON file).
 
     ``expected_aud`` / ``expected_nonce`` (v1.3): when the bundle carries a Key Binding JWT, these enforce
@@ -142,6 +146,17 @@ def verify_bundle(bundle: Union[dict, str], *, expected_aud=None, expected_nonce
     ``nonce`` MUST match ``expected_nonce``. If omitted, the KB-JWT signature + disclosure binding are still
     checked, but the relying party has NOT bound the presentation to itself/this transaction — a stale or
     cross-audience replay would still verify. A relying party doing challenge-response MUST pass both.
+
+    ``expected_root_b64`` / ``expected_tree_size`` (P0-A, Hardening 3.0.1 §6.2): RELYING-PARTY root
+    authentication. The native Merkle root is NOT part of the signature input (SPEC §5), so the SAME
+    signed payload verifies under DIFFERENT roots — a *coherent one-leaf rewrap* re-anchors the payload
+    at index 0 of a 2-leaf tree with a foreign sibling, and inclusion still holds. Merkle inclusion alone
+    therefore proves CONSISTENCY under the stated root, NOT that the root is authentic. When the relying
+    party supplies an authenticated root / tree size (out of band: a pinned value, a signed checkpoint,
+    the trusted_roots of a policy), these are enforced bit-exactly and a mismatch FAILS (adds the
+    ``root-authenticity`` / ``tree-size`` checks). ``expected_root_b64`` is decoded and compared to the
+    stated root's BYTES (canonicalization-agnostic). Absent, root authenticity stays NOT_EVALUATED and
+    the crypto verdict is unchanged (backward-compatible) — see ``root_authenticity_summary``.
     """
     if isinstance(bundle, str):
         bundle = load_bundle(bundle)
@@ -198,9 +213,28 @@ def verify_bundle(bundle: Union[dict, str], *, expected_aud=None, expected_nonce
     result.add(
         "merkle-inclusion",
         incl_ok,
-        f"anchored at index {leaf_index} of {tree_size}" if incl_ok else "inclusion proof failed",
+        f"anchored at index {leaf_index} of {tree_size} (Merkle-consistent under the STATED root)"
+        if incl_ok else "inclusion proof failed",
     )
 
+    # 2b. P0-A (§6.2): relying-party root authentication. The stated root is NOT signed, so inclusion
+    # alone does not authenticate it; only a bit-exact match against a root/size the relying party
+    # obtained out of band does. Adds a check ONLY when the RP supplies an expectation — absent, root
+    # authenticity is NOT_EVALUATED and the verdict is unchanged (backward-compatible).
+    if expected_root_b64 is not None:
+        exp_root = _b64d(expected_root_b64, "expected_root_b64")
+        root_ok = hmac.compare_digest(root, exp_root)
+        result.add("root-authenticity", root_ok,
+                   "stated root matches the expected authenticated root" if root_ok
+                   else "stated root does NOT match the expected root — possible root/rewrap substitution")
+    if expected_tree_size is not None:
+        # strict: a real int only — reject bool (1==True) and float (1==1.0), matching _require_int.
+        size_ok = (isinstance(expected_tree_size, int) and not isinstance(expected_tree_size, bool)
+                   and tree_size == expected_tree_size)
+        result.add("tree-size", size_ok,
+                   f"tree_size {tree_size} matches the expected size" if size_ok
+                   else f"tree_size {tree_size} != expected {expected_tree_size} — possible tree-size substitution")
+
     # 3. optional SD-JWT selective disclosure credential
     sd = bundle.get("sd_jwt_vc")
     kb_binding_checked = False   # F4: did a KB-JWT (the aud/nonce carrier) actually get verified?
@@ -332,6 +366,54 @@ def verify_bundle(bundle: Union[dict, str], *, expected_aud=None, expected_nonce
     return result
 
 
+def root_authenticity_summary(result: VerificationResult, *,
+                              policy_authenticated_root: Optional[bool] = None,
+                              policy_ok: Optional[bool] = None,
+                              anchor_ok: Optional[bool] = None) -> dict:
+    """Structured root-authenticity verdicts (P0-A §6.3), derived from a completed VerificationResult.
+
+    Separates what Merkle inclusion actually proves from what it does NOT, as three-state strings so a
+    consumer never mistakes 'not checked' for 'passed':
+
+      payloadSignature   PASS/FAIL         — the payload is signed by the stated key
+      merkleConsistency  PASS/FAIL         — the payload is Merkle-consistent under the STATED root
+      rootAuthenticity   PASS/FAIL/NOT_EVALUATED — was the stated root authenticated against a
+                         relying-party value (``expected_root``, or a policy's ``trusted_roots``)?
+      publicTransparency NOT_EVALUATED     — a public-log receipt is the separate §10 profile
+      safeForAutomation  bool              — True ONLY if the whole crypto verdict passed, the root was
+                                             affirmatively authenticated, AND no supplied trust policy /
+                                             anchor requirement FAILED (§6.3: root authenticity AND policy)
+
+    ``policy_authenticated_root`` folds the policy layer's root verdict in when no explicit
+    ``root-authenticity`` check ran (e.g. the root matched a policy ``trusted_roots`` entry).
+    ``policy_ok`` / ``anchor_ok`` are the relying-party gate verdicts (True/False/None=not-evaluated); a
+    FAILED gate makes ``safeForAutomation`` false even when the root itself authenticated, so a consumer
+    keying off this flag can never auto-trust a bundle its own policy rejected.
+    """
+    by = {c.name: c.ok for c in result.checks}
+
+    def _tri(name: str) -> str:
+        return "PASS" if by.get(name) else ("FAIL" if name in by else "NOT_EVALUATED")
+
+    if "root-authenticity" in by:
+        root_auth = "PASS" if by["root-authenticity"] else "FAIL"
+    elif policy_authenticated_root is True:
+        root_auth = "PASS"
+    elif policy_authenticated_root is False:
+        root_auth = "FAIL"
+    else:
+        root_auth = "NOT_EVALUATED"
+    safe = (bool(result.ok) and root_auth == "PASS"
+            and policy_ok is not False and anchor_ok is not False)
+    return {
+        "payloadSignature": _tri("ed25519-signature"),
+        "merkleConsistency": _tri("merkle-inclusion"),
+        "rootAuthenticity": root_auth,
+        "publicTransparency": "NOT_EVALUATED",
+        "safeForAutomation": safe,
+    }
+
+
 def recompute_merkle_root_b64(bundle: Union[dict, str]) -> dict:
     """Recompute the Merkle root from the bundle's own payload + inclusion proof (v1.2, issue #2).