proofbundle 3.0.1__tar.gz → 3.1.1__tar.gz

{proofbundle-3.0.1/src/proofbundle.egg-info → proofbundle-3.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofbundle
-Version: 3.0.1
+Version: 3.1.1
 Summary: Emit and verify portable cryptographic evidence bundles, offline: Ed25519 + RFC 6962 Merkle + optional SD-JWT.
 Author: Konrad Gruszka
 License: MIT
@@ -55,8 +55,8 @@ Dynamic: license-file
 <div align="center">
 
 <picture>
-  <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/b7n0de/proofbundle/main/assets/b7n0de-logo-dark.svg">
-  <img alt="b7n0de, Verified AI Work" src="https://raw.githubusercontent.com/b7n0de/proofbundle/main/assets/b7n0de-logo.svg" height="60">
+  <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/b7n0de/proofbundle/main/assets/b7n0de-hase-logo-dark.png">
+  <img alt="b7n0de, Verified AI Work, pink rabbit mascot over the B7N0DE wordmark" src="https://raw.githubusercontent.com/b7n0de/proofbundle/main/assets/b7n0de-hase-logo.png" width="200">
 </picture>
 
 <h1>proofbundle</h1>
@@ -89,6 +89,7 @@ Merkle, one file, no server, no network.
 - [The problem](#the-problem)
 - [What a receipt proves, and what it doesn't](#what-a-receipt-proves-and-what-it-doesnt)
 - [How it fits together](#how-it-fits-together)
+- [Cite this work](#cite-this-work)
 - [Post-quantum posture](#post-quantum-posture-honest-two-layers)
 - [What's in the box](#whats-in-the-box)
 - [Docs](#docs)
@@ -122,6 +123,13 @@ proofbundle verify receipt.json        # exit 0 = crypto OK, 1 = crypto/verifica
 
 # apply YOUR trust decision — verify makes NO trust decision on its own:
 proofbundle verify receipt.json --policy trust_policy.json   # POLICY: OK | FAIL (exit 3) | NOT_EVALUATED
+
+# start from a shipped TEMPLATE and pin your own signer — offline, no network:
+proofbundle policy instantiate strict-eval-template-v1 \
+  --issuer-key org-eval.pub --policy-id org/strict-eval-v1 --output org.json
+proofbundle verify receipt.json --json --policy org.json --expected-root <b64>
+# → root_authenticity.safeForAutomation: true only when the policy pins a trusted signer AND the
+#   root is authenticated (else false, with automationBlockers naming every reason)
 ```
 
 ## Inspect-native? (METR Task Standard, UK-AISI ecosystem)
@@ -183,6 +191,28 @@ flowchart LR
     style OK fill:#D6248A,stroke:#D6248A,color:#fff
 ```
 
+### Where it sits in the research neighbourhood
+
+proofbundle is a **practical, released, offline verifier — complementary to TEE and zero-knowledge
+approaches**, not a replacement for any of them. It is honest about the line each neighbour crosses
+that a receipt does not. Maturity labels are stated so nothing reads as a settled standard when it is
+a preprint.
+
+| Neighbour | What it contributes that a receipt does not | Maturity | Where proofbundle draws the line |
+|---|---|---|---|
+| **K-Veritas** ([arXiv 2605.08586](https://arxiv.org/abs/2605.08586)) — nonrepudiable experimental results | the academic case for tamper-evident, execution-bound experiment reports | preprint | proofbundle is a released, offline, eval-shaped receipt for exactly this problem, not the only take on it |
+| **Attestable Audits** ([arXiv 2506.23706](https://arxiv.org/abs/2506.23706)) — TEE-verified safety audits | that the computation actually ran, inside a trusted enclave | preprint (research prototype) | a receipt proves authorship + integrity, **not** that the computation was correct — that needs a TEE or independent reproduction |
+| **BenchJack** ([arXiv 2605.12673](https://arxiv.org/abs/2605.12673)) — auditing agent benchmarks | whether the benchmark itself is gameable (reward-hacking) | preprint | a receipt over a gameable benchmark is honestly still just a receipt; it says nothing about whether the eval was well designed |
+| **Evaluation Cards** ([arXiv 2606.09809](https://arxiv.org/abs/2606.09809)) — reporting / interpretation layer | a structured, human-facing account of what a result means | preprint | a receipt can bind a card's integrity, not its quality |
+| in-toto / Sigstore, SCITT / Rekor v2, OpenSSF Model Signing (stable standards / production) | artifact-provenance, public transparency, model-artifact signing | — | see [INTEROP.md](https://github.com/b7n0de/proofbundle/blob/main/INTEROP.md) for the honest tool-by-tool comparison |
+
+## Cite this work
+
+If proofbundle helped your evaluation pipeline, please cite it. Machine-readable metadata is in
+[`CITATION.cff`](https://github.com/b7n0de/proofbundle/blob/main/CITATION.cff); the archival record and
+concept DOI are on Zenodo ([10.5281/zenodo.21230467](https://doi.org/10.5281/zenodo.21230467)), and the
+current design write-up is the Technical Note linked from [b7n0de.com/proofbundle](https://b7n0de.com/proofbundle).
+
 ## Post-quantum posture (honest, two layers)
 
 proofbundle is **not** "quantum-proof" or "quantum-safe" as a whole. It combines two cryptographic layers

{proofbundle-3.0.1 → proofbundle-3.1.1}/README.md

@@ -1,8 +1,8 @@
 <div align="center">
 
 <picture>
-  <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/b7n0de/proofbundle/main/assets/b7n0de-logo-dark.svg">
-  <img alt="b7n0de, Verified AI Work" src="https://raw.githubusercontent.com/b7n0de/proofbundle/main/assets/b7n0de-logo.svg" height="60">
+  <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/b7n0de/proofbundle/main/assets/b7n0de-hase-logo-dark.png">
+  <img alt="b7n0de, Verified AI Work, pink rabbit mascot over the B7N0DE wordmark" src="https://raw.githubusercontent.com/b7n0de/proofbundle/main/assets/b7n0de-hase-logo.png" width="200">
 </picture>
 
 <h1>proofbundle</h1>
@@ -35,6 +35,7 @@ Merkle, one file, no server, no network.
 - [The problem](#the-problem)
 - [What a receipt proves, and what it doesn't](#what-a-receipt-proves-and-what-it-doesnt)
 - [How it fits together](#how-it-fits-together)
+- [Cite this work](#cite-this-work)
 - [Post-quantum posture](#post-quantum-posture-honest-two-layers)
 - [What's in the box](#whats-in-the-box)
 - [Docs](#docs)
@@ -68,6 +69,13 @@ proofbundle verify receipt.json        # exit 0 = crypto OK, 1 = crypto/verifica
 
 # apply YOUR trust decision — verify makes NO trust decision on its own:
 proofbundle verify receipt.json --policy trust_policy.json   # POLICY: OK | FAIL (exit 3) | NOT_EVALUATED
+
+# start from a shipped TEMPLATE and pin your own signer — offline, no network:
+proofbundle policy instantiate strict-eval-template-v1 \
+  --issuer-key org-eval.pub --policy-id org/strict-eval-v1 --output org.json
+proofbundle verify receipt.json --json --policy org.json --expected-root <b64>
+# → root_authenticity.safeForAutomation: true only when the policy pins a trusted signer AND the
+#   root is authenticated (else false, with automationBlockers naming every reason)
 ```
 
 ## Inspect-native? (METR Task Standard, UK-AISI ecosystem)
@@ -129,6 +137,28 @@ flowchart LR
     style OK fill:#D6248A,stroke:#D6248A,color:#fff
 ```
 
+### Where it sits in the research neighbourhood
+
+proofbundle is a **practical, released, offline verifier — complementary to TEE and zero-knowledge
+approaches**, not a replacement for any of them. It is honest about the line each neighbour crosses
+that a receipt does not. Maturity labels are stated so nothing reads as a settled standard when it is
+a preprint.
+
+| Neighbour | What it contributes that a receipt does not | Maturity | Where proofbundle draws the line |
+|---|---|---|---|
+| **K-Veritas** ([arXiv 2605.08586](https://arxiv.org/abs/2605.08586)) — nonrepudiable experimental results | the academic case for tamper-evident, execution-bound experiment reports | preprint | proofbundle is a released, offline, eval-shaped receipt for exactly this problem, not the only take on it |
+| **Attestable Audits** ([arXiv 2506.23706](https://arxiv.org/abs/2506.23706)) — TEE-verified safety audits | that the computation actually ran, inside a trusted enclave | preprint (research prototype) | a receipt proves authorship + integrity, **not** that the computation was correct — that needs a TEE or independent reproduction |
+| **BenchJack** ([arXiv 2605.12673](https://arxiv.org/abs/2605.12673)) — auditing agent benchmarks | whether the benchmark itself is gameable (reward-hacking) | preprint | a receipt over a gameable benchmark is honestly still just a receipt; it says nothing about whether the eval was well designed |
+| **Evaluation Cards** ([arXiv 2606.09809](https://arxiv.org/abs/2606.09809)) — reporting / interpretation layer | a structured, human-facing account of what a result means | preprint | a receipt can bind a card's integrity, not its quality |
+| in-toto / Sigstore, SCITT / Rekor v2, OpenSSF Model Signing (stable standards / production) | artifact-provenance, public transparency, model-artifact signing | — | see [INTEROP.md](https://github.com/b7n0de/proofbundle/blob/main/INTEROP.md) for the honest tool-by-tool comparison |
+
+## Cite this work
+
+If proofbundle helped your evaluation pipeline, please cite it. Machine-readable metadata is in
+[`CITATION.cff`](https://github.com/b7n0de/proofbundle/blob/main/CITATION.cff); the archival record and
+concept DOI are on Zenodo ([10.5281/zenodo.21230467](https://doi.org/10.5281/zenodo.21230467)), and the
+current design write-up is the Technical Note linked from [b7n0de.com/proofbundle](https://b7n0de.com/proofbundle).
+
 ## Post-quantum posture (honest, two layers)
 
 proofbundle is **not** "quantum-proof" or "quantum-safe" as a whole. It combines two cryptographic layers

{proofbundle-3.0.1 → proofbundle-3.1.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "proofbundle"
-version = "3.0.1"
+version = "3.1.1"
 description = "Emit and verify portable cryptographic evidence bundles, offline: Ed25519 + RFC 6962 Merkle + optional SD-JWT."
 readme = "README.md"
 requires-python = ">=3.10"
@@ -100,7 +100,7 @@ proofbundle = "proofbundle.pytest_plugin"
 where = ["src"]
 
 [tool.setuptools.package-data]
-proofbundle = ["py.typed", "eee_eval_schema.json"]
+proofbundle = ["py.typed", "eee_eval_schema.json", "policies/*.json"]
 
 [tool.ruff]
 line-length = 100

{proofbundle-3.0.1 → proofbundle-3.1.1}/src/proofbundle/__init__.py

@@ -13,7 +13,7 @@ from __future__ import annotations
 
 from typing import TYPE_CHECKING
 
-__version__ = "3.0.1"
+__version__ = "3.1.1"
 
 # The `proofbundle/v0.1` normative spec revision this build implements — kept in sync with the
 # `Revision:` line at the top of SPEC.md by tests/test_docs_truth.py (WP-B1, closes #28). Bump

{proofbundle-3.0.1 → proofbundle-3.1.1}/src/proofbundle/bundle.py

@@ -22,7 +22,8 @@ malformed exit code, not a crash.
 from __future__ import annotations
 
 import base64
-from typing import Union
+import hmac
+from typing import Optional, Union
 
 from . import merkle
 from ._strict_json import loads_strict
@@ -31,7 +32,28 @@ from .kbjwt import holder_key_from_cnf, split_key_binding, verify_key_binding
 from .signature import verify_ed25519
 from .sdjwt import verify_sd_jwt
 
-__all__ = ["SCHEMA", "verify_bundle", "load_bundle", "recompute_merkle_root_b64"]
+__all__ = ["SCHEMA", "verify_bundle", "load_bundle", "recompute_merkle_root_b64",
+           "root_authenticity_summary", "AUTOMATION_BLOCKER_REASONS"]
+
+# AP-1 §5.3: the human-legible reason for each automationBlockers enum value. Kept HERE, next to the
+# blocker logic in root_authenticity_summary, so the human `SAFE_FOR_AUTOMATION` line and the JSON flag
+# can never drift apart (one source of truth — Iteration F). A blocker with no entry falls back to its
+# raw enum string, so a future blocker is never silently unexplained.
+AUTOMATION_BLOCKER_REASONS = {
+    "CRYPTO_FAILED": "Cryptographic verification did not pass",
+    "ROOT_NOT_AUTHENTICATED": "The Merkle root was not authenticated against a relying-party value "
+                              "(--expected-root or a policy trusted_roots entry)",
+    "POLICY_NOT_EVALUATED": "No trust policy was evaluated (supply --policy to authorise a signer)",
+    "POLICY_FAILED": "The supplied trust policy was not satisfied",
+    "SIGNER_NOT_PINNED": "The trust policy pins no trusted signer identity (attributes to nobody)",
+    "TEMPLATE_NOT_INSTANTIATED": "The trust policy is a raw template (requiresIdentityOverlay:true) — "
+                                 "instantiate it with a signer identity before depending on it for automation",
+    "POLICY_EXPIRED": "The trust policy has expired (its valid_until is in the past)",
+    "POLICY_WARNINGS_PRESENT": "The trust policy carries a warning that blocks automation",
+    "ANCHOR_REQUIRED_FAILED": "A required external time anchor did not verify",
+    "PUBLIC_TRANSPARENCY_REQUIRED_FAILED": "A required public-transparency proof did not verify",
+    "REPLAY_BINDING_REQUIRED_FAILED": "A required replay/audience binding did not verify",
+}
 
 
 def _issuer_requires_holder_binding(sd_part: str) -> bool:
@@ -68,6 +90,27 @@ _MERKLE_KEYS = {"hash_alg", "leaf_index", "tree_size", "inclusion_proof_b64", "r
 _SD_KEYS = {"compact", "issuer_public_key_b64"}
 
 
+def _sd_jwt_carries_eval_root_commitment(sd_payload) -> bool:
+    """N1 (audit 2026-07-13; discriminator hardened after pre-land L1 review): True iff an SD-JWT issuer
+    payload carries the eval-binding ROOT COMMITMENT (``receipt.root_b64``, a non-empty base64 string)
+    that ``check_binds_bundle`` binds against — i.e. it CLAIMS to be anchored to a proofbundle merkle
+    root. That commitment is the exact cross-receipt substitution vector, so it (NOT a heuristic
+    word-match on generic keys like ``passed``/``suite``/``threshold``) is what marks an eval SD-JWT
+    grafted onto a non-eval payload. `issue_sd_jwt` always writes ``receipt.root_b64`` always-open, so a
+    genuine eval SD-JWT is caught even if its ``passed``/``threshold`` facts are moved into selective
+    disclosures; a generic SD-JWT-VC (``iss``/``vct``, no receipt commitment) is not an eval graft and
+    stays in scope (backward-compatible). Residual (documented, out of scope): a SELF-SIGNED credential
+    that hides even ``receipt.root_b64`` in a disclosure asserts no always-open anchoring claim and cannot
+    forge a trusted-issuer graft (the genuine emitter never does this)."""
+    if not isinstance(sd_payload, dict):
+        return False
+    receipt = sd_payload.get("receipt")
+    # Fire on the PRESENCE of a receipt.root_b64 string, INCLUDING "" (L1 pre-land audit F3): an empty root
+    # commits nothing concrete, but "an eval-shaped commitment present yet evading N1" should not exist. A
+    # generic SD-JWT-VC has no receipt object at all, so this never false-refuses one.
+    return isinstance(receipt, dict) and isinstance(receipt.get("root_b64"), str)
+
+
 def _b64d(value: str, field: str) -> bytes:
     try:
         return base64.b64decode(value, validate=True)
@@ -134,7 +177,9 @@ def load_bundle(path: str) -> dict:
         return loads_strict(handle.read())
 
 
-def verify_bundle(bundle: Union[dict, str], *, expected_aud=None, expected_nonce=None) -> VerificationResult:
+def verify_bundle(bundle: Union[dict, str], *, expected_aud=None, expected_nonce=None,
+                  expected_root_b64: Optional[str] = None,
+                  expected_tree_size: Optional[int] = None) -> VerificationResult:
     """Verify an evidence bundle (a dict or a path to a JSON file).
 
     ``expected_aud`` / ``expected_nonce`` (v1.3): when the bundle carries a Key Binding JWT, these enforce
@@ -142,6 +187,17 @@ def verify_bundle(bundle: Union[dict, str], *, expected_aud=None, expected_nonce
     ``nonce`` MUST match ``expected_nonce``. If omitted, the KB-JWT signature + disclosure binding are still
     checked, but the relying party has NOT bound the presentation to itself/this transaction — a stale or
     cross-audience replay would still verify. A relying party doing challenge-response MUST pass both.
+
+    ``expected_root_b64`` / ``expected_tree_size`` (P0-A, Hardening 3.0.1 §6.2): RELYING-PARTY root
+    authentication. The native Merkle root is NOT part of the signature input (SPEC §5), so the SAME
+    signed payload verifies under DIFFERENT roots — a *coherent one-leaf rewrap* re-anchors the payload
+    at index 0 of a 2-leaf tree with a foreign sibling, and inclusion still holds. Merkle inclusion alone
+    therefore proves CONSISTENCY under the stated root, NOT that the root is authentic. When the relying
+    party supplies an authenticated root / tree size (out of band: a pinned value, a signed checkpoint,
+    the trusted_roots of a policy), these are enforced bit-exactly and a mismatch FAILS (adds the
+    ``root-authenticity`` / ``tree-size`` checks). ``expected_root_b64`` is decoded and compared to the
+    stated root's BYTES (canonicalization-agnostic). Absent, root authenticity stays NOT_EVALUATED and
+    the crypto verdict is unchanged (backward-compatible) — see ``root_authenticity_summary``.
     """
     if isinstance(bundle, str):
         bundle = load_bundle(bundle)
@@ -198,9 +254,28 @@ def verify_bundle(bundle: Union[dict, str], *, expected_aud=None, expected_nonce
     result.add(
         "merkle-inclusion",
         incl_ok,
-        f"anchored at index {leaf_index} of {tree_size}" if incl_ok else "inclusion proof failed",
+        f"anchored at index {leaf_index} of {tree_size} (Merkle-consistent under the STATED root)"
+        if incl_ok else "inclusion proof failed",
     )
 
+    # 2b. P0-A (§6.2): relying-party root authentication. The stated root is NOT signed, so inclusion
+    # alone does not authenticate it; only a bit-exact match against a root/size the relying party
+    # obtained out of band does. Adds a check ONLY when the RP supplies an expectation — absent, root
+    # authenticity is NOT_EVALUATED and the verdict is unchanged (backward-compatible).
+    if expected_root_b64 is not None:
+        exp_root = _b64d(expected_root_b64, "expected_root_b64")
+        root_ok = hmac.compare_digest(root, exp_root)
+        result.add("root-authenticity", root_ok,
+                   "stated root matches the expected authenticated root" if root_ok
+                   else "stated root does NOT match the expected root — possible root/rewrap substitution")
+    if expected_tree_size is not None:
+        # strict: a real int only — reject bool (1==True) and float (1==1.0), matching _require_int.
+        size_ok = (isinstance(expected_tree_size, int) and not isinstance(expected_tree_size, bool)
+                   and tree_size == expected_tree_size)
+        result.add("tree-size", size_ok,
+                   f"tree_size {tree_size} matches the expected size" if size_ok
+                   else f"tree_size {tree_size} != expected {expected_tree_size} — possible tree-size substitution")
+
     # 3. optional SD-JWT selective disclosure credential
     sd = bundle.get("sd_jwt_vc")
     kb_binding_checked = False   # F4: did a KB-JWT (the aud/nonce carrier) actually get verified?
@@ -316,6 +391,25 @@ def verify_bundle(bundle: Union[dict, str], *, expected_aud=None, expected_nonce
                     "sd_jwt_vc disclosures do NOT bind this bundle (reason: unbound/mismatch — cross-receipt "
                     "substitution; the SD-JWT's passed/threshold/comparator/suite/issuer/root differ from the "
                     "signed claim)")
+            elif _sd_jwt_carries_eval_root_commitment(_sd_p):
+                # N1 (audit 2026-07-13, L1 live PoC; discriminator hardened after pre-land L1 review): an
+                # EVAL SD-JWT (issue_sd_jwt writes the always-open root commitment receipt.root_b64) MUST
+                # bind to a proofbundle/eval-claim/v0.1 payload — check_binds_bundle above is the only
+                # binding for it. Grafted onto a NON-eval payload it has nothing to bind against, so
+                # previously the exact same issuer-valid eval SD-JWT verified CRYPTO: OK on ANY
+                # opaque-payload bundle (cross-receipt substitution, sd_jwt_ok stayed true, zero operator
+                # signal). Fail-closed (Reifegradpolitik §0.6: never a silent PASS for insecure legacy
+                # behaviour). Keying on receipt.root_b64 (the real substitution vector) rather than a
+                # word-match on generic keys catches a graft even when passed/threshold are moved into
+                # disclosures, and never false-refuses a GENERIC SD-JWT-VC (iss/vct, no receipt commitment,
+                # e.g. examples/example_bundle.json), which carries no eval anchoring claim and is out of
+                # scope (backward-compatible).
+                result.add(
+                    "sd-jwt-bundle-binding", False,
+                    "sd_jwt_vc carries an eval-claim root commitment (receipt.root_b64) but the signed "
+                    "payload is not a proofbundle/eval-claim/v0.1 claim, so that anchoring claim cannot be "
+                    "bound to this bundle (reason: unbindable eval SD-JWT — a valid issuer signature does not "
+                    "make an unbound eval anchoring claim belong to this receipt; refused fail-closed)")
 
     # F4 (v1.9.2, fail-closed): supplying expected_aud/expected_nonce asks for RFC 9901 §7.3
     # replay/audience binding. A bundle with no verifiable KB-JWT (no sd_jwt_vc at all, or an
@@ -332,6 +426,106 @@ def verify_bundle(bundle: Union[dict, str], *, expected_aud=None, expected_nonce
     return result
 
 
+def root_authenticity_summary(result: VerificationResult, *,
+                              policy_authenticated_root: Optional[bool] = None,
+                              policy_ok: Optional[bool] = None,
+                              anchor_ok: Optional[bool] = None,
+                              signer_trusted: Optional[bool] = None,
+                              policy_warnings: Optional[list] = None,
+                              policy_expired: Optional[bool] = None,
+                              requires_identity_overlay: Optional[bool] = None,
+                              public_transparency_ok: Optional[bool] = None,
+                              replay_ok: Optional[bool] = None) -> dict:
+    """Structured root-authenticity verdicts (P0-A §6.3), derived from a completed VerificationResult.
+
+    Separates what Merkle inclusion actually proves from what it does NOT, as three-state strings so a
+    consumer never mistakes 'not checked' for 'passed':
+
+      payloadSignature   PASS/FAIL         — the payload is signed by the stated key
+      merkleConsistency  PASS/FAIL         — the payload is Merkle-consistent under the STATED root
+      rootAuthenticity   PASS/FAIL/NOT_EVALUATED — was the stated root authenticated against a
+                         relying-party value (``expected_root``, or a policy's ``trusted_roots``)?
+      publicTransparency NOT_EVALUATED     — a public-log receipt is the separate §10 profile
+      safeForAutomation  bool              — True ONLY if the whole crypto verdict passed, the root was
+                                             affirmatively authenticated, AND a supplied trust policy
+                                             PASSED with a real signer pin (P0-B, audit 2026-07-13)
+      automationBlockers list[str]         — every reason safeForAutomation is false, so a consumer
+                                             keying off the flag sees exactly WHY (fail-closed)
+
+    ``policy_authenticated_root`` folds the policy layer's root verdict in when no explicit
+    ``root-authenticity`` check ran (e.g. the root matched a policy ``trusted_roots`` entry).
+    ``policy_ok`` / ``anchor_ok`` are the relying-party gate verdicts (True/False/None=not-evaluated).
+    P0-B: ``safeForAutomation`` is a GLOBAL trust verdict, so ``policy_ok`` must be True (a policy that
+    passed) — ``None`` (no policy evaluated) can never make it true. ``policy_warnings`` (the vacuous
+    'attributes to nobody' lint) forces it false too: a policy that pins no signer authorises no
+    identity, so a crypto-valid, root-pinned receipt under it is NOT automation-safe.
+    """
+    by = {c.name: c.ok for c in result.checks}
+
+    def _tri(name: str) -> str:
+        return "PASS" if by.get(name) else ("FAIL" if name in by else "NOT_EVALUATED")
+
+    if "root-authenticity" in by:
+        root_auth = "PASS" if by["root-authenticity"] else "FAIL"
+    elif policy_authenticated_root is True:
+        root_auth = "PASS"
+    elif policy_authenticated_root is False:
+        root_auth = "FAIL"
+    else:
+        root_auth = "NOT_EVALUATED"
+    # P0-B (audit 2026-07-13): the former `policy_ok is not False` let policy_ok=None (no policy
+    # evaluated) through → a crypto-valid, root-pinned receipt looked automation-safe though NO trusted
+    # signer was ever authorised. safeForAutomation is now a GLOBAL trust verdict: policy_ok must be True
+    # AND carry no vacuous 'attributes to nobody' warning. Every failed condition is surfaced in
+    # automationBlockers (fail-closed, so the flag is never a silent yes).
+    # P0-B / AP-1 §5 (audit 2026-07-13): safeForAutomation is a GLOBAL trust verdict. Variant A (strict):
+    # true ONLY when crypto passed, the root was authenticated, a supplied policy PASSED (policy_ok is
+    # True — None/no-policy never qualifies), that policy actually PINS a trusted signer (signer_trusted),
+    # and no required anchor / public-transparency / replay gate FAILED. automationBlockers enumerates
+    # every reason it is false (fail-closed, never a silent yes). NOTE for 3.1.1: public_transparency_ok
+    # and replay_ok are relying-party gates that are None (not-requested) on the current core — the §10
+    # public-transparency policy section is 3.2.0, and replay (aud/nonce) already fails the crypto verdict
+    # (CRYPTO_FAILED) when a required KB-JWT is absent — so these two blockers are defined for forward
+    # compatibility and stay dormant unless a future policy layer supplies a False verdict.
+    blockers: list[str] = []
+    if not bool(result.ok):
+        blockers.append("CRYPTO_FAILED")
+    if root_auth != "PASS":
+        blockers.append("ROOT_NOT_AUTHENTICATED")
+    if policy_ok is None:
+        blockers.append("POLICY_NOT_EVALUATED")
+    elif policy_ok is False:
+        blockers.append("POLICY_FAILED")
+    elif requires_identity_overlay:
+        # AP-2 §6.2 (L2 pre-land audit): a RAW template (requiresIdentityOverlay:true) is never automation-safe
+        # — reported as its OWN blocker, not SIGNER_NOT_PINNED, which would be factually wrong when the template
+        # actually does match a signer (the real reason is the un-cleared template-lifecycle flag).
+        blockers.append("TEMPLATE_NOT_INSTANTIATED")
+    elif signer_trusted is not True:
+        blockers.append("SIGNER_NOT_PINNED")   # policy passed but pins no trusted identity (attributes to nobody)
+    elif policy_warnings:
+        blockers.append("POLICY_WARNINGS_PRESENT")   # signer pinned yet the policy still warns (forward-compat)
+    # AP-2 §6.4 lifecycle: an EXPIRED policy is unsafe to automate on even if it otherwise passed (a stale
+    # signer pin the relying party has since rotated away from). Independent of the signer/warning chain so
+    # it is reported alongside, never in place of, another reason.
+    if policy_expired is True:
+        blockers.append("POLICY_EXPIRED")
+    if anchor_ok is False:
+        blockers.append("ANCHOR_REQUIRED_FAILED")
+    if public_transparency_ok is False:
+        blockers.append("PUBLIC_TRANSPARENCY_REQUIRED_FAILED")
+    if replay_ok is False:
+        blockers.append("REPLAY_BINDING_REQUIRED_FAILED")
+    return {
+        "payloadSignature": _tri("ed25519-signature"),
+        "merkleConsistency": _tri("merkle-inclusion"),
+        "rootAuthenticity": root_auth,
+        "publicTransparency": "NOT_EVALUATED",
+        "safeForAutomation": not blockers,
+        "automationBlockers": blockers,
+    }
+
+
 def recompute_merkle_root_b64(bundle: Union[dict, str]) -> dict:
     """Recompute the Merkle root from the bundle's own payload + inclusion proof (v1.2, issue #2).