proofbundle 3.1.0__tar.gz → 3.1.2__tar.gz

{proofbundle-3.1.0/src/proofbundle.egg-info → proofbundle-3.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofbundle
-Version: 3.1.0
+Version: 3.1.2
 Summary: Emit and verify portable cryptographic evidence bundles, offline: Ed25519 + RFC 6962 Merkle + optional SD-JWT.
 Author: Konrad Gruszka
 License: MIT
@@ -123,6 +123,13 @@ proofbundle verify receipt.json        # exit 0 = crypto OK, 1 = crypto/verifica
 
 # apply YOUR trust decision — verify makes NO trust decision on its own:
 proofbundle verify receipt.json --policy trust_policy.json   # POLICY: OK | FAIL (exit 3) | NOT_EVALUATED
+
+# start from a shipped TEMPLATE and pin your own signer — offline, no network:
+proofbundle policy instantiate strict-eval-template-v1 \
+  --issuer-key org-eval.pub --policy-id org/strict-eval-v1 --output org.json
+proofbundle verify receipt.json --json --policy org.json --expected-root <b64>
+# → root_authenticity.safeForAutomation: true only when the policy pins a trusted signer AND the
+#   root is authenticated (else false, with automationBlockers naming every reason)
 ```
 
 ## Inspect-native? (METR Task Standard, UK-AISI ecosystem)

{proofbundle-3.1.0 → proofbundle-3.1.2}/README.md

@@ -69,6 +69,13 @@ proofbundle verify receipt.json        # exit 0 = crypto OK, 1 = crypto/verifica
 
 # apply YOUR trust decision — verify makes NO trust decision on its own:
 proofbundle verify receipt.json --policy trust_policy.json   # POLICY: OK | FAIL (exit 3) | NOT_EVALUATED
+
+# start from a shipped TEMPLATE and pin your own signer — offline, no network:
+proofbundle policy instantiate strict-eval-template-v1 \
+  --issuer-key org-eval.pub --policy-id org/strict-eval-v1 --output org.json
+proofbundle verify receipt.json --json --policy org.json --expected-root <b64>
+# → root_authenticity.safeForAutomation: true only when the policy pins a trusted signer AND the
+#   root is authenticated (else false, with automationBlockers naming every reason)
 ```
 
 ## Inspect-native? (METR Task Standard, UK-AISI ecosystem)

{proofbundle-3.1.0 → proofbundle-3.1.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "proofbundle"
-version = "3.1.0"
+version = "3.1.2"
 description = "Emit and verify portable cryptographic evidence bundles, offline: Ed25519 + RFC 6962 Merkle + optional SD-JWT."
 readme = "README.md"
 requires-python = ">=3.10"

{proofbundle-3.1.0 → proofbundle-3.1.2}/src/proofbundle/__init__.py

@@ -13,7 +13,7 @@ from __future__ import annotations
 
 from typing import TYPE_CHECKING
 
-__version__ = "3.1.0"
+__version__ = "3.1.2"
 
 # The `proofbundle/v0.1` normative spec revision this build implements — kept in sync with the
 # `Revision:` line at the top of SPEC.md by tests/test_docs_truth.py (WP-B1, closes #28). Bump

{proofbundle-3.1.0 → proofbundle-3.1.2}/src/proofbundle/bundle.py

@@ -33,7 +33,27 @@ from .signature import verify_ed25519
 from .sdjwt import verify_sd_jwt
 
 __all__ = ["SCHEMA", "verify_bundle", "load_bundle", "recompute_merkle_root_b64",
-           "root_authenticity_summary"]
+           "root_authenticity_summary", "AUTOMATION_BLOCKER_REASONS"]
+
+# AP-1 §5.3: the human-legible reason for each automationBlockers enum value. Kept HERE, next to the
+# blocker logic in root_authenticity_summary, so the human `SAFE_FOR_AUTOMATION` line and the JSON flag
+# can never drift apart (one source of truth — Iteration F). A blocker with no entry falls back to its
+# raw enum string, so a future blocker is never silently unexplained.
+AUTOMATION_BLOCKER_REASONS = {
+    "CRYPTO_FAILED": "Cryptographic verification did not pass",
+    "ROOT_NOT_AUTHENTICATED": "The Merkle root was not authenticated against a relying-party value "
+                              "(--expected-root or a policy trusted_roots entry)",
+    "POLICY_NOT_EVALUATED": "No trust policy was evaluated (supply --policy to authorise a signer)",
+    "POLICY_FAILED": "The supplied trust policy was not satisfied",
+    "SIGNER_NOT_PINNED": "The trust policy pins no trusted signer identity (attributes to nobody)",
+    "TEMPLATE_NOT_INSTANTIATED": "The trust policy is a raw template (requiresIdentityOverlay:true) — "
+                                 "instantiate it with a signer identity before depending on it for automation",
+    "POLICY_EXPIRED": "The trust policy has expired (its valid_until is in the past)",
+    "POLICY_WARNINGS_PRESENT": "The trust policy carries a warning that blocks automation",
+    "ANCHOR_REQUIRED_FAILED": "A required external time anchor did not verify",
+    "PUBLIC_TRANSPARENCY_REQUIRED_FAILED": "A required public-transparency proof did not verify",
+    "REPLAY_BINDING_REQUIRED_FAILED": "A required replay/audience binding did not verify",
+}
 
 
 def _issuer_requires_holder_binding(sd_part: str) -> bool:
@@ -70,6 +90,27 @@ _MERKLE_KEYS = {"hash_alg", "leaf_index", "tree_size", "inclusion_proof_b64", "r
 _SD_KEYS = {"compact", "issuer_public_key_b64"}
 
 
+def _sd_jwt_carries_eval_root_commitment(sd_payload) -> bool:
+    """N1 (audit 2026-07-13; discriminator hardened after pre-land L1 review): True iff an SD-JWT issuer
+    payload carries the eval-binding ROOT COMMITMENT (``receipt.root_b64``, a non-empty base64 string)
+    that ``check_binds_bundle`` binds against — i.e. it CLAIMS to be anchored to a proofbundle merkle
+    root. That commitment is the exact cross-receipt substitution vector, so it (NOT a heuristic
+    word-match on generic keys like ``passed``/``suite``/``threshold``) is what marks an eval SD-JWT
+    grafted onto a non-eval payload. `issue_sd_jwt` always writes ``receipt.root_b64`` always-open, so a
+    genuine eval SD-JWT is caught even if its ``passed``/``threshold`` facts are moved into selective
+    disclosures; a generic SD-JWT-VC (``iss``/``vct``, no receipt commitment) is not an eval graft and
+    stays in scope (backward-compatible). Residual (documented, out of scope): a SELF-SIGNED credential
+    that hides even ``receipt.root_b64`` in a disclosure asserts no always-open anchoring claim and cannot
+    forge a trusted-issuer graft (the genuine emitter never does this)."""
+    if not isinstance(sd_payload, dict):
+        return False
+    receipt = sd_payload.get("receipt")
+    # Fire on the PRESENCE of a receipt.root_b64 string, INCLUDING "" (L1 pre-land audit F3): an empty root
+    # commits nothing concrete, but "an eval-shaped commitment present yet evading N1" should not exist. A
+    # generic SD-JWT-VC has no receipt object at all, so this never false-refuses one.
+    return isinstance(receipt, dict) and isinstance(receipt.get("root_b64"), str)
+
+
 def _b64d(value: str, field: str) -> bytes:
     try:
         return base64.b64decode(value, validate=True)
@@ -350,6 +391,25 @@ def verify_bundle(bundle: Union[dict, str], *, expected_aud=None, expected_nonce
                     "sd_jwt_vc disclosures do NOT bind this bundle (reason: unbound/mismatch — cross-receipt "
                     "substitution; the SD-JWT's passed/threshold/comparator/suite/issuer/root differ from the "
                     "signed claim)")
+            elif _sd_jwt_carries_eval_root_commitment(_sd_p):
+                # N1 (audit 2026-07-13, L1 live PoC; discriminator hardened after pre-land L1 review): an
+                # EVAL SD-JWT (issue_sd_jwt writes the always-open root commitment receipt.root_b64) MUST
+                # bind to a proofbundle/eval-claim/v0.1 payload — check_binds_bundle above is the only
+                # binding for it. Grafted onto a NON-eval payload it has nothing to bind against, so
+                # previously the exact same issuer-valid eval SD-JWT verified CRYPTO: OK on ANY
+                # opaque-payload bundle (cross-receipt substitution, sd_jwt_ok stayed true, zero operator
+                # signal). Fail-closed (Reifegradpolitik §0.6: never a silent PASS for insecure legacy
+                # behaviour). Keying on receipt.root_b64 (the real substitution vector) rather than a
+                # word-match on generic keys catches a graft even when passed/threshold are moved into
+                # disclosures, and never false-refuses a GENERIC SD-JWT-VC (iss/vct, no receipt commitment,
+                # e.g. examples/example_bundle.json), which carries no eval anchoring claim and is out of
+                # scope (backward-compatible).
+                result.add(
+                    "sd-jwt-bundle-binding", False,
+                    "sd_jwt_vc carries an eval-claim root commitment (receipt.root_b64) but the signed "
+                    "payload is not a proofbundle/eval-claim/v0.1 claim, so that anchoring claim cannot be "
+                    "bound to this bundle (reason: unbindable eval SD-JWT — a valid issuer signature does not "
+                    "make an unbound eval anchoring claim belong to this receipt; refused fail-closed)")
 
     # F4 (v1.9.2, fail-closed): supplying expected_aud/expected_nonce asks for RFC 9901 §7.3
     # replay/audience binding. A bundle with no verifiable KB-JWT (no sd_jwt_vc at all, or an
@@ -369,7 +429,13 @@ def verify_bundle(bundle: Union[dict, str], *, expected_aud=None, expected_nonce
 def root_authenticity_summary(result: VerificationResult, *,
                               policy_authenticated_root: Optional[bool] = None,
                               policy_ok: Optional[bool] = None,
-                              anchor_ok: Optional[bool] = None) -> dict:
+                              anchor_ok: Optional[bool] = None,
+                              signer_trusted: Optional[bool] = None,
+                              policy_warnings: Optional[list] = None,
+                              policy_expired: Optional[bool] = None,
+                              requires_identity_overlay: Optional[bool] = None,
+                              public_transparency_ok: Optional[bool] = None,
+                              replay_ok: Optional[bool] = None) -> dict:
     """Structured root-authenticity verdicts (P0-A §6.3), derived from a completed VerificationResult.
 
     Separates what Merkle inclusion actually proves from what it does NOT, as three-state strings so a
@@ -381,14 +447,18 @@ def root_authenticity_summary(result: VerificationResult, *,
                          relying-party value (``expected_root``, or a policy's ``trusted_roots``)?
       publicTransparency NOT_EVALUATED     — a public-log receipt is the separate §10 profile
       safeForAutomation  bool              — True ONLY if the whole crypto verdict passed, the root was
-                                             affirmatively authenticated, AND no supplied trust policy /
-                                             anchor requirement FAILED (§6.3: root authenticity AND policy)
+                                             affirmatively authenticated, AND a supplied trust policy
+                                             PASSED with a real signer pin (P0-B, audit 2026-07-13)
+      automationBlockers list[str]         — every reason safeForAutomation is false, so a consumer
+                                             keying off the flag sees exactly WHY (fail-closed)
 
     ``policy_authenticated_root`` folds the policy layer's root verdict in when no explicit
     ``root-authenticity`` check ran (e.g. the root matched a policy ``trusted_roots`` entry).
-    ``policy_ok`` / ``anchor_ok`` are the relying-party gate verdicts (True/False/None=not-evaluated); a
-    FAILED gate makes ``safeForAutomation`` false even when the root itself authenticated, so a consumer
-    keying off this flag can never auto-trust a bundle its own policy rejected.
+    ``policy_ok`` / ``anchor_ok`` are the relying-party gate verdicts (True/False/None=not-evaluated).
+    P0-B: ``safeForAutomation`` is a GLOBAL trust verdict, so ``policy_ok`` must be True (a policy that
+    passed) — ``None`` (no policy evaluated) can never make it true. ``policy_warnings`` (the vacuous
+    'attributes to nobody' lint) forces it false too: a policy that pins no signer authorises no
+    identity, so a crypto-valid, root-pinned receipt under it is NOT automation-safe.
     """
     by = {c.name: c.ok for c in result.checks}
 
@@ -403,14 +473,56 @@ def root_authenticity_summary(result: VerificationResult, *,
         root_auth = "FAIL"
     else:
         root_auth = "NOT_EVALUATED"
-    safe = (bool(result.ok) and root_auth == "PASS"
-            and policy_ok is not False and anchor_ok is not False)
+    # P0-B (audit 2026-07-13): the former `policy_ok is not False` let policy_ok=None (no policy
+    # evaluated) through → a crypto-valid, root-pinned receipt looked automation-safe though NO trusted
+    # signer was ever authorised. safeForAutomation is now a GLOBAL trust verdict: policy_ok must be True
+    # AND carry no vacuous 'attributes to nobody' warning. Every failed condition is surfaced in
+    # automationBlockers (fail-closed, so the flag is never a silent yes).
+    # P0-B / AP-1 §5 (audit 2026-07-13): safeForAutomation is a GLOBAL trust verdict. Variant A (strict):
+    # true ONLY when crypto passed, the root was authenticated, a supplied policy PASSED (policy_ok is
+    # True — None/no-policy never qualifies), that policy actually PINS a trusted signer (signer_trusted),
+    # and no required anchor / public-transparency / replay gate FAILED. automationBlockers enumerates
+    # every reason it is false (fail-closed, never a silent yes). NOTE for 3.1.1: public_transparency_ok
+    # and replay_ok are relying-party gates that are None (not-requested) on the current core — the §10
+    # public-transparency policy section is 3.2.0, and replay (aud/nonce) already fails the crypto verdict
+    # (CRYPTO_FAILED) when a required KB-JWT is absent — so these two blockers are defined for forward
+    # compatibility and stay dormant unless a future policy layer supplies a False verdict.
+    blockers: list[str] = []
+    if not bool(result.ok):
+        blockers.append("CRYPTO_FAILED")
+    if root_auth != "PASS":
+        blockers.append("ROOT_NOT_AUTHENTICATED")
+    if policy_ok is None:
+        blockers.append("POLICY_NOT_EVALUATED")
+    elif policy_ok is False:
+        blockers.append("POLICY_FAILED")
+    elif requires_identity_overlay:
+        # AP-2 §6.2 (L2 pre-land audit): a RAW template (requiresIdentityOverlay:true) is never automation-safe
+        # — reported as its OWN blocker, not SIGNER_NOT_PINNED, which would be factually wrong when the template
+        # actually does match a signer (the real reason is the un-cleared template-lifecycle flag).
+        blockers.append("TEMPLATE_NOT_INSTANTIATED")
+    elif signer_trusted is not True:
+        blockers.append("SIGNER_NOT_PINNED")   # policy passed but pins no trusted identity (attributes to nobody)
+    elif policy_warnings:
+        blockers.append("POLICY_WARNINGS_PRESENT")   # signer pinned yet the policy still warns (forward-compat)
+    # AP-2 §6.4 lifecycle: an EXPIRED policy is unsafe to automate on even if it otherwise passed (a stale
+    # signer pin the relying party has since rotated away from). Independent of the signer/warning chain so
+    # it is reported alongside, never in place of, another reason.
+    if policy_expired is True:
+        blockers.append("POLICY_EXPIRED")
+    if anchor_ok is False:
+        blockers.append("ANCHOR_REQUIRED_FAILED")
+    if public_transparency_ok is False:
+        blockers.append("PUBLIC_TRANSPARENCY_REQUIRED_FAILED")
+    if replay_ok is False:
+        blockers.append("REPLAY_BINDING_REQUIRED_FAILED")
     return {
         "payloadSignature": _tri("ed25519-signature"),
         "merkleConsistency": _tri("merkle-inclusion"),
         "rootAuthenticity": root_auth,
         "publicTransparency": "NOT_EVALUATED",
-        "safeForAutomation": safe,
+        "safeForAutomation": not blockers,
+        "automationBlockers": blockers,
     }
 
 

{proofbundle-3.1.0 → proofbundle-3.1.2}/src/proofbundle/cli.py

@@ -549,18 +549,54 @@ def _cmd_verify(args: argparse.Namespace) -> int:
     # in when no --expected-root was given. Always separate, so merkle-inclusion is never read as root
     # authentication (additive JSON field + a human line).
     from .bundle import root_authenticity_summary  # noqa: PLC0415
+    # P0-B (audit 2026-07-13): thread the vacuous-policy lint into the summary — a PASSING policy that
+    # pins no signer ('attributes to nobody') must NOT set safeForAutomation. Computed once here, reused
+    # for fields["policy_warnings"] below (no double lint).
+    from .policy import policy_warnings as _policy_warnings  # noqa: PLC0415
+    pol_warns = _policy_warnings(policy) if (policy is not None and policy_ok) else []
+    # AP-1 §5 (+ L2 pre-land review fix): signer_trusted requires an ACTUALLY-PASSED signer-binding check
+    # on THIS (eval/verify) path — a passing `policy:signer_allowed` from evaluate_policy — NOT merely the
+    # absence of the 'attributes to nobody' warning. That warning counts
+    # decision_receipt.trusted_decision_makers as a signer pin, but evaluate_policy (the verify path) never
+    # matches the bundle signer against it (that is the verify-decision path); keying off the warning would
+    # let a decision-maker-only policy FAKE a trusted signer and yield safeForAutomation:true against an
+    # unpinned bundle signer (fail-open). Key off the positive verdict instead.
+    # AP-2 §6.2: a RAW template (requiresIdentityOverlay:true) never qualifies (no identity overlay applied).
+    _signer_checks = [c for c in (policy_result or {}).get("checks", [])
+                      if c.get("name") == "policy:signer_allowed"]
+    signer_matched = bool(_signer_checks) and all(c.get("ok") for c in _signer_checks)
+    signer_trusted = bool(policy_ok) and signer_matched
+    # AP-2 §6.2/§6.4 (L2 pre-land audit): a RAW template (requiresIdentityOverlay:true) and an EXPIRED policy
+    # each force safeForAutomation:false with their OWN honest blocker (TEMPLATE_NOT_INSTANTIATED /
+    # POLICY_EXPIRED) — not a mislabelled SIGNER_NOT_PINNED. signer_trusted now reflects ONLY whether a signer
+    # was actually matched; the template/expiry conditions are surfaced as distinct blockers.
+    _requires_overlay = (policy or {}).get("requiresIdentityOverlay") is True
+    from .policy import policy_expired as _policy_expired  # noqa: PLC0415
+    pol_expired = bool(policy is not None and _policy_expired(policy))
     root_summary = root_authenticity_summary(
         result, policy_authenticated_root=(policy_result or {}).get("root_authenticated"),
-        policy_ok=policy_ok, anchor_ok=anchor_required_ok)
+        policy_ok=policy_ok, anchor_ok=anchor_required_ok,
+        signer_trusted=signer_trusted, policy_warnings=pol_warns, policy_expired=pol_expired,
+        requires_identity_overlay=_requires_overlay)
     fields["root_authenticity"] = root_summary
+    # P0-A (audit 2026-07-13): surface --expected-tree-size as a machine-readable object. The check
+    # itself already runs INDEPENDENTLY in verify_bundle (never gated on --expected-root), so a mismatch
+    # already fails the crypto verdict; this makes status/expected/actual explicit so an integrator can
+    # confirm the gate ran rather than inferring it from a check name. NOT_REQUESTED when the flag is absent.
+    _ets = getattr(args, "expected_tree_size", None)
+    _tsc = next((c for c in result.checks if c.name == "tree-size"), None)
+    fields["treeSizeExpectation"] = {
+        "status": (("PASS" if _tsc.ok else "FAIL") if _tsc is not None else "NOT_REQUESTED"),
+        "expected": _ets,
+        "actual": (bundle.get("merkle") or {}).get("tree_size") if isinstance(bundle, dict) else None,
+    }
     if policy is not None:
         fields["policy_id"] = policy.get("policy_id")
         # WP-TP1: non-fatal honesty warnings (e.g. "attributes to nobody") — exit code unchanged.
         # Mirror the human line (six-lens review): the warning is meaningful only for a PASSING
         # policy (a POLICY: OK that attributes to nobody); on FAIL / crypto-FAIL the FAIL is the
         # message, so the JSON field is empty too — the key stays present for contract stability.
-        from .policy import policy_warnings  # noqa: PLC0415
-        fields["policy_warnings"] = policy_warnings(policy) if policy_ok else []
+        fields["policy_warnings"] = pol_warns   # P0-B: computed once above (no double lint)
     if policy_result is not None:
         fields["policy_checks"] = policy_result["checks"]
     if anchor_report is not None:
@@ -614,6 +650,17 @@ def _cmd_verify(args: argparse.Namespace) -> int:
               f"(payload-signature {root_summary['payloadSignature']}, "
               f"merkle-consistency {root_summary['merkleConsistency']}, "
               f"safe-for-automation {str(root_summary['safeForAutomation']).lower()})")
+        # AP-1 §5.3: a dedicated, human-legible automation verdict — YES, or NO with the reason(s). The
+        # reasons are derived one-for-one from root_summary['automationBlockers'] via the SSOT map, so the
+        # human and JSON forms of safeForAutomation can never disagree (Iteration F).
+        from .bundle import AUTOMATION_BLOCKER_REASONS  # noqa: PLC0415
+        if root_summary["safeForAutomation"]:
+            print("SAFE_FOR_AUTOMATION: YES")
+        else:
+            print("SAFE_FOR_AUTOMATION: NO")
+            print("Reason:")
+            for _blk in root_summary["automationBlockers"]:
+                print(f"  {AUTOMATION_BLOCKER_REASONS.get(_blk, _blk)}")
         if policy is not None and not crypto_ok:
             print("POLICY: NOT_EVALUATED (crypto failed — policy not checked)")
         else:
@@ -963,8 +1010,11 @@ def _cmd_decision_verify(args: argparse.Namespace) -> int:
     policy = None
     if args.policy:
         from .policy import PolicyError, load_policy  # noqa: PLC0415
+        from .policy_profiles import resolve_policy_source  # noqa: PLC0415
         try:
-            policy = load_policy(args.policy)
+            # parity with the eval verify path (L5 audit L5-F3): accept a packaged profile NAME
+            # (e.g. decision-receipt-template-v1), not only a file path, via resolve_policy_source.
+            policy = load_policy(resolve_policy_source(args.policy))
         except PolicyError as exc:
             print(f"ERROR: {exc}", file=sys.stderr)
             return 2
@@ -1151,17 +1201,91 @@ def _cmd_policy_lint(args: argparse.Namespace) -> int:
 
 def _cmd_policy_list_profiles(args: argparse.Namespace) -> int:
     from .policy import explain_policy, load_policy  # noqa: PLC0415
-    from .policy_profiles import list_profiles, profile_path  # noqa: PLC0415
+    from .policy_profiles import list_profiles, profile_aliases, profile_path  # noqa: PLC0415
+    aliases = profile_aliases()
+    # canonical -> [deprecated old names] so each canonical row can list what still resolves to it.
+    canonical_aliases: dict = {}
+    for old, canonical in aliases.items():
+        canonical_aliases.setdefault(canonical, []).append(old)
     rows = []
-    for name in list_profiles():
+    for name in list_profiles():   # AP-2 §6.1: canonical names FIRST
+        # load via the packaged file directly (no alias, no deprecation line) for the metadata
         policy = load_policy(profile_path(name))
         rows.append({"name": name, "policy_id": policy.get("policy_id"),
-                    "schema": policy.get("schema"), "pin_count": len(explain_policy(policy))})
+                     "schema": policy.get("schema"), "pin_count": len(explain_policy(policy)),
+                     "deploymentReady": policy.get("deploymentReady"),
+                     "requiresIdentityOverlay": policy.get("requiresIdentityOverlay"),
+                     "is_template": policy.get("requiresIdentityOverlay") is True
+                                    or policy.get("deploymentReady") is False,
+                     "deprecated_aliases": sorted(canonical_aliases.get(name, []))})
     if args.json:
         print(json.dumps(rows, indent=2, ensure_ascii=False))
         return 0
     for row in rows:
-        print(f"{row['name']:22} {row['schema']:32} {row['pin_count']} pin(s)   {row['policy_id']}")
+        kind = "template" if row["is_template"] else "profile "
+        print(f"{row['name']:44} {kind} {row['schema']:32} {row['pin_count']} pin(s)   {row['policy_id']}")
+        if row["deprecated_aliases"]:
+            print(f"{'':44} (deprecated aliases: {', '.join(row['deprecated_aliases'])})")
+    return 0
+
+
+def _read_pubkey_line(text: str) -> str:
+    """Extract a base64 Ed25519 public key from a key file's content: accepts a bare base64 string, an
+    ``ed25519:<b64>`` issuer string, or a JSON object with ``public_key_b64`` / ``issuer_public_key_b64``.
+    Returns the base64 string (empty if none found — the caller fail-closes on that)."""
+    s = text.strip()
+    if s.startswith("{"):
+        try:
+            obj = json.loads(s)
+        except ValueError:
+            return ""
+        return obj.get("public_key_b64") or obj.get("issuer_public_key_b64") or ""
+    if s.startswith("ed25519:"):
+        return s[len("ed25519:"):].strip()
+    return s
+
+
+def _cmd_policy_instantiate(args: argparse.Namespace) -> int:
+    """AP-2 §6.3: turn a shipped template into a deployment-ready org policy, offline. Reads the issuer
+    key file(s) and optional expected-root file, pins them, and writes the instantiated policy JSON."""
+    from .policy import PolicyError  # noqa: PLC0415
+    from .policy_profiles import instantiate_template  # noqa: PLC0415
+    try:
+        keys = []
+        for kf in args.issuer_key:
+            with open(kf, encoding="utf-8") as fh:
+                key = _read_pubkey_line(fh.read())
+            if not key:
+                raise PolicyError(f"issuer key file {kf!r} carries no public key")
+            keys.append(key)
+        expected_root = None
+        if args.expected_root_file:
+            with open(args.expected_root_file, encoding="utf-8") as fh:
+                expected_root = fh.read().strip()
+        inst = instantiate_template(args.template, issuer_keys=keys, policy_id=args.policy_id,
+                                    expected_root=expected_root, valid_until=args.valid_until)
+    except (PolicyError, OSError, ValueError) as exc:
+        if getattr(args, "json", False):
+            print(json.dumps({"ok": False, "error": str(exc)}))
+        else:
+            print(f"ERROR: {exc}", file=sys.stderr)
+        return 2
+    out = json.dumps(inst, indent=2, ensure_ascii=False)
+    if not inst.get("deploymentReady"):
+        # honest, loud: the instance is missing a required field (e.g. an authenticated-root template
+        # instantiated without --expected-root-file). It is written so it can be completed, but it is NOT
+        # production-ready and `policy lint --strict` will refuse it (No-Fake).
+        print("[policy-instantiate] WARNING: result is deploymentReady=false — a required field is "
+              "missing (this template needs --expected-root-file); complete it before deploying.",
+              file=sys.stderr)
+    if args.output and args.output != "-":
+        with open(args.output, "w", encoding="utf-8") as fh:
+            fh.write(out + "\n")
+        print(f"[policy-instantiate] {args.template} -> {args.output}  "
+              f"deploymentReady={inst.get('deploymentReady')}  policy_id={inst.get('policy_id')}",
+              file=sys.stderr)
+    else:
+        print(out)
     return 0
 
 
@@ -1382,9 +1506,39 @@ def build_parser() -> argparse.ArgumentParser:
     p_lint.add_argument("--json", action="store_true", help="machine readable output")
     p_lint.set_defaults(func=_cmd_policy_lint)
     p_list = psub.add_parser(
-        "list-profiles", help="list the named trust-policy profiles shipped with this package (WP3)")
+        "list-profiles", help="list the named trust-policy profiles shipped with this package (WP3); "
+                              "canonical template names first, deprecated aliases marked")
     p_list.add_argument("--json", action="store_true", help="machine readable output")
     p_list.set_defaults(func=_cmd_policy_list_profiles)
+    p_inst = psub.add_parser(
+        "instantiate", help="AP-2 §6.3: turn a shipped TEMPLATE into a deployment-ready org policy by "
+                            "pinning your signer identity (and root, when required); offline",
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+        epilog="Example:\n"
+               "  proofbundle policy instantiate strict-eval-template-v1 \\\n"
+               "    --issuer-key org-eval.pub --policy-id org/strict-eval-v1 \\\n"
+               "    --output org-strict-eval-v1.json\n"
+               "The result pins the issuer key(s), sets requiresIdentityOverlay=false, and is\n"
+               "deploymentReady=true only when every required field is filled (an authenticated-root\n"
+               "template also needs --expected-root-file). Exit 0 on success, 2 on any error.")
+    p_inst.add_argument("template", help="a template profile name, e.g. strict-eval-template-v1 "
+                                         "(deprecated aliases resolve with a warning)")
+    p_inst.add_argument("--issuer-key", action="append", required=True, metavar="FILE",
+                        help="file with a base64 Ed25519 public key to pin (repeat to pin several)")
+    p_inst.add_argument("--policy-id", required=True,
+                        help="the new policy_id in YOUR organisation namespace (must differ from the "
+                             "template's)")
+    p_inst.add_argument("--expected-root-file", metavar="FILE",
+                        help="file with a base64 merkle root to pin as trusted_roots — REQUIRED for a "
+                             "template that sets merkle.require_authenticated_root, optional otherwise")
+    p_inst.add_argument("--valid-until", metavar="ISO8601",
+                        help="optional expiry stamped onto the instance (e.g. 2027-01-01T00:00:00Z); "
+                             "policy lint --strict fails once it is in the past")
+    p_inst.add_argument("--output", "-o", metavar="FILE",
+                        help="write the instantiated policy JSON here (default: stdout)")
+    p_inst.add_argument("--json", action="store_true",
+                        help="on error, emit a JSON error object instead of a stderr line")
+    p_inst.set_defaults(func=_cmd_policy_instantiate)
 
     prereg = sub.add_parser(
         "prereg",

{proofbundle-3.1.0 → proofbundle-3.1.2}/src/proofbundle/decision.py

@@ -429,16 +429,27 @@ def verify_decision_receipt(envelope: dict, public_key: bytes, *, strict: bool =
         # confirmation is a separate step (resolve_evidence_ref), never implied by evidence_bound.
         if isinstance(ev, list) and ev:
             r["evidence_bound"] = all(isinstance(x, dict) and _is_digest(x.get("digest")) for x in ev)
-        val = predicate.get("validity")
-        if isinstance(val, dict):
-            if expected_audience is not None:
-                r["audience_ok"] = expected_audience in (val.get("audience") or [])
-                if not r["audience_ok"]:
-                    r["errors"].append("audience mismatch (cross-audience replay?)")
-            if expected_nonce is not None:
-                r["nonce_ok"] = val.get("nonce") == expected_nonce
-                if not r["nonce_ok"]:
-                    r["errors"].append("nonce mismatch (replay?)")
+        # 3.1.2 fail-closed fix (audit 2026-07-13, sibling of the eval-path F4 hardening and the decision
+        # template/expiry gates): a relying party who supplies expected_audience/expected_nonce is ASKING for
+        # RFC-9901-§7.3-style replay/audience binding. If the receipt carries NO validity object (or a
+        # non-dict one), the previous `if isinstance(val, dict):` guard SKIPPED the checks entirely →
+        # audience_ok/nonce_ok stayed None → the CLI exit gate (None is not False) let it pass exit 0: a
+        # requested binding silently unenforced (fail-OPEN downgrade). Evaluate against {} instead, so an
+        # absent validity/audience/nonce is a FAIL (fail-closed), never a silent pass.
+        _val = predicate.get("validity")
+        _validity = _val if isinstance(_val, dict) else {}
+        if expected_audience is not None:
+            r["audience_ok"] = expected_audience in (_validity.get("audience") or [])
+            if not r["audience_ok"]:
+                r["errors"].append(
+                    "audience mismatch or absent validity.audience — requested audience binding cannot be "
+                    "enforced (cross-audience replay?, fail-closed)")
+        if expected_nonce is not None:
+            r["nonce_ok"] = _validity.get("nonce") == expected_nonce
+            if not r["nonce_ok"]:
+                r["errors"].append(
+                    "nonce mismatch or absent validity.nonce — requested replay binding cannot be enforced "
+                    "(replay?, fail-closed)")
 
     # Detached anchors (Fix 2): verify anchor evidence for the statement's OWN content root — sha256 over the
     # EXACT signed payload bytes (never re-canonicalized), computed only once the bytes are authentic+canonical.

proofbundle-3.1.2/src/proofbundle/policies/decision-receipt-template-v1.json

@@ -0,0 +1,24 @@
+{
+  "schema": "proofbundle/trust-policy/v0.2",
+  "policy_id": "proofbundle-policy/decision-receipt-template-v1",
+  "deploymentReady": false,
+  "requiresIdentityOverlay": true,
+  "allowed_schema_versions": [
+    "proofbundle/v0.1"
+  ],
+  "signature": {
+    "allowed_algs": [
+      "ed25519"
+    ]
+  },
+  "decision_receipt": {
+    "accepted_predicate_types": [
+      "https://b7n0de.com/proofbundle/predicates/decision-receipt/v0.1"
+    ],
+    "require_not_checked": true,
+    "require_decision_change_conditions": true,
+    "require_audience": true,
+    "require_nonce": true,
+    "allow_raw_inputs": false
+  }
+}

proofbundle-3.1.2/src/proofbundle/policies/strict-eval-authenticated-root-template-v1.json

@@ -0,0 +1,25 @@
+{
+  "schema": "proofbundle/trust-policy/v0.1",
+  "policy_id": "proofbundle-policy/strict-eval-authenticated-root-template-v1",
+  "deploymentReady": false,
+  "requiresIdentityOverlay": true,
+  "allowed_schema_versions": [
+    "proofbundle/v0.1"
+  ],
+  "signature": {
+    "allowed_algs": [
+      "ed25519"
+    ]
+  },
+  "merkle": {
+    "required_hash_alg": "sha256-rfc6962",
+    "require_authenticated_root": true
+  },
+  "sd_jwt": {
+    "require_key_binding_when_cnf_present": true
+  },
+  "assurance": {
+    "minimum_level": "reproduced",
+    "reject_self_attested_without_prereg": true
+  }
+}

proofbundle-3.1.2/src/proofbundle/policies/strict-eval-template-v1.json

@@ -0,0 +1,24 @@
+{
+  "schema": "proofbundle/trust-policy/v0.1",
+  "policy_id": "proofbundle-policy/strict-eval-template-v1",
+  "deploymentReady": false,
+  "requiresIdentityOverlay": true,
+  "allowed_schema_versions": [
+    "proofbundle/v0.1"
+  ],
+  "signature": {
+    "allowed_algs": [
+      "ed25519"
+    ]
+  },
+  "merkle": {
+    "required_hash_alg": "sha256-rfc6962"
+  },
+  "sd_jwt": {
+    "require_key_binding_when_cnf_present": true
+  },
+  "assurance": {
+    "minimum_level": "reproduced",
+    "reject_self_attested_without_prereg": true
+  }
+}

proofbundle-3.1.2/src/proofbundle/policies/strict-prereg-template-v1.json

@@ -0,0 +1,25 @@
+{
+  "schema": "proofbundle/trust-policy/v0.2",
+  "policy_id": "proofbundle-policy/strict-prereg-template-v1",
+  "deploymentReady": false,
+  "requiresIdentityOverlay": true,
+  "allowed_schema_versions": [
+    "proofbundle/v0.1"
+  ],
+  "signature": {
+    "allowed_algs": [
+      "ed25519"
+    ]
+  },
+  "merkle": {
+    "required_hash_alg": "sha256-rfc6962"
+  },
+  "assurance": {
+    "reject_self_attested_without_prereg": true
+  },
+  "anchors": {
+    "require_anchor": "any",
+    "require_anchor_target": "preRegistration",
+    "allow_pending": false
+  }
+}