proofbundle 3.1.2__tar.gz → 3.2.0__tar.gz

{proofbundle-3.1.2/src/proofbundle.egg-info → proofbundle-3.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofbundle
-Version: 3.1.2
+Version: 3.2.0
 Summary: Emit and verify portable cryptographic evidence bundles, offline: Ed25519 + RFC 6962 Merkle + optional SD-JWT.
 Author: Konrad Gruszka
 License: MIT
@@ -127,9 +127,11 @@ proofbundle verify receipt.json --policy trust_policy.json   # POLICY: OK | FAIL
 # start from a shipped TEMPLATE and pin your own signer — offline, no network:
 proofbundle policy instantiate strict-eval-template-v1 \
   --issuer-key org-eval.pub --policy-id org/strict-eval-v1 --output org.json
-proofbundle verify receipt.json --json --policy org.json --expected-root <b64>
-# → root_authenticity.safeForAutomation: true only when the policy pins a trusted signer AND the
-#   root is authenticated (else false, with automationBlockers naming every reason)
+proofbundle verify receipt.json --json --policy org.json \
+  --expected-root <b64> --expected-tree-size <n>   # or: --trusted-checkpoint note.txt --checkpoint-vkey <vkey>
+# → root_authenticity.safeForAutomation: true only when the policy pins a trusted signer AND root
+#   plus tree size are authenticated ATOMICALLY from one source (a root-bytes-only pin is
+#   rootTrustLevel: ROOT_BYTES_ONLY — never automation-safe; automationBlockers names every reason)
 ```
 
 ## Inspect-native? (METR Task Standard, UK-AISI ecosystem)
@@ -298,6 +300,10 @@ roadmap.
   a signed outcome is self-assertion. See
   [docs/predicates/decision-receipt.md](https://github.com/b7n0de/proofbundle/blob/main/docs/predicates/decision-receipt.md)
   and [ADR 0001](https://github.com/b7n0de/proofbundle/blob/main/docs/adr/0001-decision-receipt-separate-predicate.md).
+  That signed outcome is the `action-outcome/v0.1` predicate (EXPERIMENTAL, 3.2.0): an executor signs what was
+  actually done, bound by content root to the Decision Receipt, with role separation (executor ≠ decision maker)
+  and `execution_proven` only when an effect digest backs an `executed` status. See
+  [docs/predicates/action-outcome.md](https://github.com/b7n0de/proofbundle/blob/main/docs/predicates/action-outcome.md).
 
 ## Docs
 

{proofbundle-3.1.2 → proofbundle-3.2.0}/README.md

@@ -73,9 +73,11 @@ proofbundle verify receipt.json --policy trust_policy.json   # POLICY: OK | FAIL
 # start from a shipped TEMPLATE and pin your own signer — offline, no network:
 proofbundle policy instantiate strict-eval-template-v1 \
   --issuer-key org-eval.pub --policy-id org/strict-eval-v1 --output org.json
-proofbundle verify receipt.json --json --policy org.json --expected-root <b64>
-# → root_authenticity.safeForAutomation: true only when the policy pins a trusted signer AND the
-#   root is authenticated (else false, with automationBlockers naming every reason)
+proofbundle verify receipt.json --json --policy org.json \
+  --expected-root <b64> --expected-tree-size <n>   # or: --trusted-checkpoint note.txt --checkpoint-vkey <vkey>
+# → root_authenticity.safeForAutomation: true only when the policy pins a trusted signer AND root
+#   plus tree size are authenticated ATOMICALLY from one source (a root-bytes-only pin is
+#   rootTrustLevel: ROOT_BYTES_ONLY — never automation-safe; automationBlockers names every reason)
 ```
 
 ## Inspect-native? (METR Task Standard, UK-AISI ecosystem)
@@ -244,6 +246,10 @@ roadmap.
   a signed outcome is self-assertion. See
   [docs/predicates/decision-receipt.md](https://github.com/b7n0de/proofbundle/blob/main/docs/predicates/decision-receipt.md)
   and [ADR 0001](https://github.com/b7n0de/proofbundle/blob/main/docs/adr/0001-decision-receipt-separate-predicate.md).
+  That signed outcome is the `action-outcome/v0.1` predicate (EXPERIMENTAL, 3.2.0): an executor signs what was
+  actually done, bound by content root to the Decision Receipt, with role separation (executor ≠ decision maker)
+  and `execution_proven` only when an effect digest backs an `executed` status. See
+  [docs/predicates/action-outcome.md](https://github.com/b7n0de/proofbundle/blob/main/docs/predicates/action-outcome.md).
 
 ## Docs
 

{proofbundle-3.1.2 → proofbundle-3.2.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "proofbundle"
-version = "3.1.2"
+version = "3.2.0"
 description = "Emit and verify portable cryptographic evidence bundles, offline: Ed25519 + RFC 6962 Merkle + optional SD-JWT."
 readme = "README.md"
 requires-python = ">=3.10"

{proofbundle-3.1.2 → proofbundle-3.2.0}/src/proofbundle/__init__.py

@@ -13,12 +13,12 @@ from __future__ import annotations
 
 from typing import TYPE_CHECKING
 
-__version__ = "3.1.2"
+__version__ = "3.2.0"
 
 # The `proofbundle/v0.1` normative spec revision this build implements — kept in sync with the
 # `Revision:` line at the top of SPEC.md by tests/test_docs_truth.py (WP-B1, closes #28). Bump
 # both together whenever SPEC.md's normative text changes (not on every package release).
-SPEC_REVISION = "2026-07-11"
+SPEC_REVISION = "2026-07-13"
 
 __all__ = [
     "__version__",
@@ -47,6 +47,23 @@ __all__ = [
     "beacon_audit_challenge",
     "canonicalize_statement",
     "statement_content_root",
+    "resolve_hash_alg",
+    "compute_dual_hash",
+    "verify_dual_hash",
+    "build_evidence_pack",
+    "verify_evidence_pack",
+    "ots_upgraded_proof_is_self_contained",
+    "build_initial_sequence",
+    "renew_timestamp",
+    "renew_hashtree",
+    "verify_sequence",
+    "last_ats",
+    "evaluate_renewal_policy",
+    "ArchiveTimeStamp",
+    "RenewalPolicy",
+    "verify_mldsa",
+    "verify_slhdsa",
+    "verify_hybrid",
     "VerificationResult",
     "Check",
     "ProofBundleError",
@@ -75,6 +92,23 @@ _LAZY = {
     "beacon_audit_challenge": ".beacon",
     "canonicalize_statement": ".canonical",
     "statement_content_root": ".canonical",
+    "resolve_hash_alg": ".hashalg",
+    "compute_dual_hash": ".hashalg",
+    "verify_dual_hash": ".hashalg",
+    "build_evidence_pack": ".evidence_pack",
+    "verify_evidence_pack": ".evidence_pack",
+    "ots_upgraded_proof_is_self_contained": ".evidence_pack",
+    "build_initial_sequence": ".renewal",
+    "renew_timestamp": ".renewal",
+    "renew_hashtree": ".renewal",
+    "verify_sequence": ".renewal",
+    "last_ats": ".renewal",
+    "evaluate_renewal_policy": ".renewal",
+    "ArchiveTimeStamp": ".renewal",
+    "RenewalPolicy": ".renewal",
+    "verify_mldsa": ".pqsig",
+    "verify_slhdsa": ".pqsig",
+    "verify_hybrid": ".pqsig",
 }
 
 if TYPE_CHECKING:  # static analysers + IDEs see the real names/types; runtime stays lazy
@@ -88,6 +122,13 @@ if TYPE_CHECKING:  # static analysers + IDEs see the real names/types; runtime s
                             verify_sample_opening)
     from .beacon import beacon_audit_challenge
     from .canonical import canonicalize_statement, statement_content_root
+    from .hashalg import compute_dual_hash, resolve_hash_alg, verify_dual_hash
+    from .evidence_pack import (build_evidence_pack, ots_upgraded_proof_is_self_contained,
+                                verify_evidence_pack)
+    from .renewal import (ArchiveTimeStamp, RenewalPolicy, build_initial_sequence,
+                          evaluate_renewal_policy, last_ats, renew_hashtree, renew_timestamp,
+                          verify_sequence)
+    from .pqsig import verify_hybrid, verify_mldsa, verify_slhdsa
     from .prereg import prereg_hash, verify_prereg
     from .statuslist import verify_status_snapshot
     from .tlogproof import verify_tlog_proof

{proofbundle-3.1.2 → proofbundle-3.2.0}/src/proofbundle/anchors_chia_add.py

@@ -19,13 +19,41 @@ import os
 import shutil
 import subprocess
 import time
-from typing import Optional
+from contextlib import contextmanager
+from pathlib import Path
+from typing import Iterator, Optional
 
 from .anchors_chia import ANCHOR_TYPE, verify_offline_merkle
 
 _CHIA_BIN = os.getenv("CHIA_CLI", shutil.which("chia") or "chia")
 
 
+@contextmanager
+def _anchor_in_progress_lock(lock_path: Optional[str]) -> Iterator[None]:
+    """Advisory 'anchor in progress' marker held around the on-chain batch_update + confirmation.
+
+    While an anchor's wallet-using transaction is submitted and confirmed, write a marker FILE at
+    ``lock_path`` (or the ``PROOFBUNDLE_ANCHOR_LOCK_PATH`` env). A SEPARATE process — e.g. a wallet-switch
+    guard that must not log the wallet out from under the transaction — can treat the file's PRESENCE as
+    'an anchor is running'. Removed on completion; a crash leaves it stale, which a conservative guard
+    treats as still-active (fail-safe, never breaks a possibly-live anchor). No-op when no path is set, so
+    the default anchor flow is unchanged and proofbundle stays free of any consumer-specific naming."""
+    path = lock_path or os.getenv("PROOFBUNDLE_ANCHOR_LOCK_PATH")
+    if not path:
+        yield
+        return
+    p = Path(path)
+    p.parent.mkdir(parents=True, exist_ok=True)
+    p.write_text(str(os.getpid()))
+    try:
+        yield
+    finally:
+        try:
+            p.unlink()
+        except OSError:
+            pass
+
+
 class ChiaRpcError(RuntimeError):
     """A Chia RPC/CLI call failed. Fail-closed: the caller aborts, no partial anchor is written."""
 
@@ -125,11 +153,15 @@ def _wait_confirmed(store_id: str, prev_root: Optional[str], *, timeout: int = 1
 
 def anchor_add(canonical_root_hex: str, *, store_id: str, value_digest_hex: Optional[str] = None,
                target: str = "receipt", network: str = "mainnet", fee: int = 100_000_000,
-               wait: bool = True) -> dict:
+               wait: bool = True, lock_path: Optional[str] = None) -> dict:
     """Full flow: insert ``key=canonicalRoot`` (value = ``value_digest`` or the canonicalRoot itself) into the
     store, wait for on-chain confirmation, then export the anchor. Idempotent: a key already present ("Key
     already present") is treated as "already anchored" and re-exported, not an error. Fail-closed: a network
-    failure raises ChiaRpcError and writes NOTHING partial (the caller keeps its receipt untouched)."""
+    failure raises ChiaRpcError and writes NOTHING partial (the caller keeps its receipt untouched).
+
+    ``lock_path`` (or the ``PROOFBUNDLE_ANCHOR_LOCK_PATH`` env) holds an advisory 'anchor in progress' marker
+    file AUTOMATICALLY around the wallet-using batch_update + confirmation, so a separate wallet-switch guard
+    never logs the wallet out mid-anchor. No path → unchanged behaviour."""
     canonical_root_hex = canonical_root_hex if canonical_root_hex.startswith(("0x", "0X")) else "0x" + canonical_root_hex
     canonical_root = bytes.fromhex(canonical_root_hex[2:])
     if len(canonical_root) != 32:
@@ -137,18 +169,19 @@ def anchor_add(canonical_root_hex: str, *, store_id: str, value_digest_hex: Opti
     value_hex = value_digest_hex or canonical_root_hex
     value_hex = value_hex if value_hex.startswith(("0x", "0X")) else "0x" + value_hex
 
-    prev_root = _rpc("data_layer", "get_root", {"id": store_id}).get("hash")
-    changelist = [{"action": "insert", "key": canonical_root_hex, "value": value_hex}]
-    already = False
-    try:
-        _rpc("data_layer", "batch_update",
-             {"id": store_id, "changelist": changelist, "fee": fee, "submit_on_chain": True})
-    except ChiaRpcError as exc:
-        if "already present" in str(exc).lower():
-            already = True                        # idempotent: the digest is already anchored
-        else:
-            raise                                 # any other failure → clean abort, nothing written
-    if wait and not already:
-        _wait_confirmed(store_id, prev_root)
-    return export_anchor(store_id, canonical_root=canonical_root,
-                         target=target, network=network, value=value_hex)
+    with _anchor_in_progress_lock(lock_path):
+        prev_root = _rpc("data_layer", "get_root", {"id": store_id}).get("hash")
+        changelist = [{"action": "insert", "key": canonical_root_hex, "value": value_hex}]
+        already = False
+        try:
+            _rpc("data_layer", "batch_update",
+                 {"id": store_id, "changelist": changelist, "fee": fee, "submit_on_chain": True})
+        except ChiaRpcError as exc:
+            if "already present" in str(exc).lower():
+                already = True                    # idempotent: the digest is already anchored
+            else:
+                raise                             # any other failure → clean abort, nothing written
+        if wait and not already:
+            _wait_confirmed(store_id, prev_root)
+        return export_anchor(store_id, canonical_root=canonical_root,
+                             target=target, network=network, value=value_hex)

{proofbundle-3.1.2 → proofbundle-3.2.0}/src/proofbundle/bundle.py

@@ -43,12 +43,18 @@ AUTOMATION_BLOCKER_REASONS = {
     "CRYPTO_FAILED": "Cryptographic verification did not pass",
     "ROOT_NOT_AUTHENTICATED": "The Merkle root was not authenticated against a relying-party value "
                               "(--expected-root or a policy trusted_roots entry)",
+    "TREE_CONTEXT_NOT_AUTHENTICATED": "Root and tree size were not authenticated ATOMICALLY from one "
+                                      "source (a signed checkpoint via --trusted-checkpoint / policy "
+                                      "trusted_checkpoints, or an --expected-root + "
+                                      "--expected-tree-size pair) — a root-bytes-only pin cannot "
+                                      "detect a tree-size/leaf-index relabel (A-P0-1)",
     "POLICY_NOT_EVALUATED": "No trust policy was evaluated (supply --policy to authorise a signer)",
     "POLICY_FAILED": "The supplied trust policy was not satisfied",
     "SIGNER_NOT_PINNED": "The trust policy pins no trusted signer identity (attributes to nobody)",
     "TEMPLATE_NOT_INSTANTIATED": "The trust policy is a raw template (requiresIdentityOverlay:true) — "
                                  "instantiate it with a signer identity before depending on it for automation",
     "POLICY_EXPIRED": "The trust policy has expired (its valid_until is in the past)",
+    "POLICY_NOT_YET_VALID": "The trust policy is not yet valid (its valid_from is in the future)",
     "POLICY_WARNINGS_PRESENT": "The trust policy carries a warning that blocks automation",
     "ANCHOR_REQUIRED_FAILED": "A required external time anchor did not verify",
     "PUBLIC_TRANSPARENCY_REQUIRED_FAILED": "A required public-transparency proof did not verify",
@@ -433,9 +439,12 @@ def root_authenticity_summary(result: VerificationResult, *,
                               signer_trusted: Optional[bool] = None,
                               policy_warnings: Optional[list] = None,
                               policy_expired: Optional[bool] = None,
+                              policy_not_yet_valid: Optional[bool] = None,
                               requires_identity_overlay: Optional[bool] = None,
                               public_transparency_ok: Optional[bool] = None,
-                              replay_ok: Optional[bool] = None) -> dict:
+                              replay_ok: Optional[bool] = None,
+                              tree_context_authenticated: Optional[bool] = None,
+                              checkpoint_authenticity: Optional[str] = None) -> dict:
     """Structured root-authenticity verdicts (P0-A §6.3), derived from a completed VerificationResult.
 
     Separates what Merkle inclusion actually proves from what it does NOT, as three-state strings so a
@@ -473,6 +482,28 @@ def root_authenticity_summary(result: VerificationResult, *,
         root_auth = "FAIL"
     else:
         root_auth = "NOT_EVALUATED"
+
+    # A-P0-1 §5.3: the differentiated tree-context verdicts. `root_auth` above is the root-BYTES
+    # verdict; TREE_CONTEXT_AUTHENTICITY additionally requires that root and tree_size were
+    # authenticated ATOMICALLY from one source (a signed checkpoint, a policy trusted_checkpoints
+    # match, or an RP-supplied root+size PAIR). A naked root pin reaches at most
+    # ROOT_BYTES_AUTHENTICITY: PASS — never TREE_CONTEXT_AUTHENTICITY: PASS (§5.5).
+    if tree_context_authenticated is True:
+        tree_context = "PASS"
+    elif tree_context_authenticated is False:
+        tree_context = "FAIL"
+    else:
+        tree_context = "NOT_EVALUATED"
+    cp_auth = checkpoint_authenticity if checkpoint_authenticity in ("PASS", "FAIL") \
+        else "NOT_EVALUATED"
+    if tree_context == "PASS" and cp_auth == "PASS":
+        root_trust_level = "CHECKPOINT"
+    elif tree_context == "PASS":
+        root_trust_level = "ROOT_AND_TREE_SIZE_PINNED"
+    elif root_auth == "PASS":
+        root_trust_level = "ROOT_BYTES_ONLY"
+    else:
+        root_trust_level = "NONE"
     # P0-B (audit 2026-07-13): the former `policy_ok is not False` let policy_ok=None (no policy
     # evaluated) through → a crypto-valid, root-pinned receipt looked automation-safe though NO trusted
     # signer was ever authorised. safeForAutomation is now a GLOBAL trust verdict: policy_ok must be True
@@ -492,24 +523,35 @@ def root_authenticity_summary(result: VerificationResult, *,
         blockers.append("CRYPTO_FAILED")
     if root_auth != "PASS":
         blockers.append("ROOT_NOT_AUTHENTICATED")
+    if tree_context != "PASS":
+        # A-P0-1 §5.4: safeForAutomation requires the ATOMIC (root, tree_size) authentication —
+        # root bytes alone cannot detect the 2→3-leaf relabel, so they never authorise automation.
+        blockers.append("TREE_CONTEXT_NOT_AUTHENTICATED")
     if policy_ok is None:
         blockers.append("POLICY_NOT_EVALUATED")
     elif policy_ok is False:
         blockers.append("POLICY_FAILED")
-    elif requires_identity_overlay:
+    elif signer_trusted is not True and not requires_identity_overlay:
+        blockers.append("SIGNER_NOT_PINNED")   # policy passed but pins no trusted identity (attributes to nobody)
+    elif signer_trusted is True and policy_warnings:
+        blockers.append("POLICY_WARNINGS_PRESENT")   # signer pinned yet the policy still warns (forward-compat)
+    if requires_identity_overlay:
         # AP-2 §6.2 (L2 pre-land audit): a RAW template (requiresIdentityOverlay:true) is never automation-safe
         # — reported as its OWN blocker, not SIGNER_NOT_PINNED, which would be factually wrong when the template
-        # actually does match a signer (the real reason is the un-cleared template-lifecycle flag).
+        # actually does match a signer (the real reason is the un-cleared template-lifecycle flag). Independent
+        # of the policy_ok chain since A-P0-2: the eval path now FAILS a raw template (policy:not_template →
+        # POLICY_FAILED), and the honest template blocker must still be reported alongside it.
         blockers.append("TEMPLATE_NOT_INSTANTIATED")
-    elif signer_trusted is not True:
-        blockers.append("SIGNER_NOT_PINNED")   # policy passed but pins no trusted identity (attributes to nobody)
-    elif policy_warnings:
-        blockers.append("POLICY_WARNINGS_PRESENT")   # signer pinned yet the policy still warns (forward-compat)
     # AP-2 §6.4 lifecycle: an EXPIRED policy is unsafe to automate on even if it otherwise passed (a stale
     # signer pin the relying party has since rotated away from). Independent of the signer/warning chain so
     # it is reported alongside, never in place of, another reason.
     if policy_expired is True:
         blockers.append("POLICY_EXPIRED")
+    # A-P0-2 not-before mirror (Lens-2/3/4/6 review): a policy whose valid_from is in the FUTURE at the
+    # real current time is not in force, so a crypto-valid receipt under it is not automation-safe even
+    # when historically verified — the symmetric case to POLICY_EXPIRED. Reported at current time.
+    if policy_not_yet_valid is True:
+        blockers.append("POLICY_NOT_YET_VALID")
     if anchor_ok is False:
         blockers.append("ANCHOR_REQUIRED_FAILED")
     if public_transparency_ok is False:
@@ -519,7 +561,14 @@ def root_authenticity_summary(result: VerificationResult, *,
     return {
         "payloadSignature": _tri("ed25519-signature"),
         "merkleConsistency": _tri("merkle-inclusion"),
+        # A-P0-1 §5.3: differentiated statuses. `rootAuthenticity` is kept as a WIRE-COMPAT ALIAS of
+        # the root-BYTES verdict (it never asserted more than bytes); the undifferentiated reading
+        # of it as full root trust is retired — automation keys off treeContextAuthenticity.
         "rootAuthenticity": root_auth,
+        "rootBytesAuthenticity": root_auth,
+        "treeContextAuthenticity": tree_context,
+        "checkpointAuthenticity": cp_auth,
+        "rootTrustLevel": root_trust_level,
         "publicTransparency": "NOT_EVALUATED",
         "safeForAutomation": not blockers,
         "automationBlockers": blockers,