proofbundle 3.6.2__tar.gz → 3.7.0__tar.gz

{proofbundle-3.6.2/src/proofbundle.egg-info → proofbundle-3.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofbundle
-Version: 3.6.2
+Version: 3.7.0
 Summary: Emit and verify portable cryptographic evidence bundles, offline: Ed25519 + RFC 6962 Merkle + optional SD-JWT.
 Author: Konrad Gruszka
 License: MIT
@@ -37,6 +37,8 @@ Provides-Extra: chia
 Provides-Extra: experimental
 Provides-Extra: pq
 Requires-Dist: cryptography>=48; extra == "pq"
+Provides-Extra: rootcommit
+Requires-Dist: ecdsa>=0.18; extra == "rootcommit"
 Provides-Extra: formal
 Requires-Dist: z3-solver>=4.12; extra == "formal"
 Provides-Extra: pytest

{proofbundle-3.6.2 → proofbundle-3.7.0}/conformance/README.md

@@ -57,14 +57,17 @@ Bishop-Fox parser-differential defense), a single flipped payload byte fails the
 
 | caseId | proves | does NOT prove |
 |---|---|---|
+| `decision-crossimpl-schema-conformant` | **full end-to-end `decision-receipt/v0.1` conformance cross-impl**: RFC 8785 canonicalization + content-root binding, the predicate validates clean in NORMAL **and** STRICT mode (0 findings), **and** a confirmed Bitcoin anchor at block 958761 (OTS-committed root matches the real block merkle root, independently fetched from blockstream.info + blockchain.info, verified offline) | that the decision was *correct* — the anchor fixes existence and evidence binding, never correctness |
 | `decision-crossimpl-confirmed-anchor-lifecycle` | RFC 8785 canonicalization + content-root binding cross-impl, **and** a confirmed Bitcoin anchor at block 957504 (OTS proof committed root matches the real block merkle root, independently fetched, verified offline) | `decision-receipt/v0.1` schema conformance (predicate reports 12 findings) |
-| `decision-crossimpl-canonicalization-root-binding` | RFC 8785 canonicalization + content-root binding cross-impl | schema conformance (12 findings, expected-fail) **and** a confirmed anchor (still pending) |
-
-Both vectors are contributed by MarkovianProtocol / Colin (audit-anchor), vendored digest-pinned
-as pure data, credited. The gap between "canonicalization proven" and "full v0.1 conformance" is
-recorded in `audit_artifacts/crossimpl_fixture_gap_20260711.md`; a case graduates to a full
-end-to-end `decision-receipt/v0.1` conformance case after a schema-conformant regeneration and a
-confirmed anchor.
+| `decision-crossimpl-canonicalization-root-binding` *(historical — superseded by `decision-crossimpl-schema-conformant`)* | RFC 8785 canonicalization + content-root binding cross-impl | schema conformance (12 findings, expected-fail) **and** a confirmed anchor (still pending) |
+
+All three vectors are contributed by MarkovianProtocol / Colin (audit-anchor), vendored digest-pinned
+as pure data, credited (MIT / SigmaSynth LLC). The gap between "canonicalization proven" and "full v0.1
+conformance", recorded in `audit_artifacts/crossimpl_fixture_gap_20260711.md`, is now closed: **full
+decision-receipt/v0.1 conformance: done (graduated 2026-07-19, block 958761)** with
+`decision-crossimpl-schema-conformant`. The canonicalization-only iteration is retained as a historical
+case (CONFORMANCE.md rule 5, no silent changes: a regeneration is a new case, the old one kept, so its
+historical green run stays reproducible).
 
 ## Adding a case
 

proofbundle-3.7.0/conformance/decision/crossimpl/canonicalization-root-binding/case.json

@@ -0,0 +1,26 @@
+{
+  "caseId": "decision-crossimpl-canonicalization-root-binding",
+  "kind": "decision_crossimpl",
+  "input": "canonicalization-root-binding",
+  "status": "historical",
+  "supersededBy": "decision-crossimpl-schema-conformant",
+  "attribution": "MarkovianProtocol / Colin — audit-anchor@3abe69f (examples/decision-receipt)",
+  "expected": {
+    "jcs_byte_identical": true,
+    "content_roots_match_manifest": true,
+    "evidence_ref_binds_content_root": true,
+    "decision_content_root": "ff05e3e0126e31090511f9e42494bbde4d86c9b1a9a0a9570850c42e8546029b",
+    "evidence_content_root": "323adb188f840e90331c920b32a73f348acc5caea8d40f9a84ea384d46c258d4",
+    "decision_predicate_findings": 12,
+    "schema_conformant": false,
+    "anchor": {
+      "status": "pending",
+      "note": "Re-anchored against the frozen v0.1 URIs; submitted to calendars, not yet confirmed on Bitcoin. No block height. Graduates to a confirmed case after an ots upgrade pins its block."
+    }
+  },
+  "specRefs": [
+    "docs/predicates/decision-receipt.md#7.1",
+    "SPEC.md"
+  ],
+  "rationale": "[HISTORICAL ITERATION — superseded by decision-crossimpl-schema-conformant (graduated 2026-07-19, Bitcoin block 958761); retained per CONFORMANCE.md rule 5 (no silent changes: a regeneration is a new case, the old one kept). Vendored bytes and the expected block are unchanged from acceptance — this case still proves exactly what it did, so its historical green run stays reproducible.] The regenerated fixture against the frozen/vendored v0.1 URIs. It proves RFC 8785 canonicalization and content-root binding cross-implementation: the .jcs bytes are byte-identical with proofbundle's canonical output and both content roots recompute to the MANIFEST values (evidence 323adb18…, decision ff05e3e0…), and the evidenceRef binds the evidence content root. It does NOT prove decision-receipt/v0.1 schema conformance — the predicate reports 12 findings, recorded as an expected-fail rather than hidden — and its anchor is still pending. This is the honest 'what it proves today' case; it graduates to a full end-to-end conformance case after a schema-conformant regeneration and a confirmed Bitcoin anchor."
+}

proofbundle-3.7.0/conformance/decision/crossimpl/schema-conformant/MANIFEST.json

@@ -0,0 +1,13 @@
+{
+  "rule": "anchor root = SHA-256 over RFC 8785 (JCS) canonical statement bytes (content root); signatures are a separate layer.",
+  "predicate_uri": "https://b7n0de.com/proofbundle/predicates/decision-receipt/v0.1",
+  "evidence_uri": "https://b7n0de.com/attestation/eval-result/v0.1",
+  "evidence_content_root_sha256": "323adb188f840e90331c920b32a73f348acc5caea8d40f9a84ea384d46c258d4",
+  "decision_content_root_sha256": "97e1d74b810a9fea454ac890c0e17f8a401fb4abbf42827a39aea30846de2fb5",
+  "anchored_file": "decision_receipt.jcs",
+  "evidenceRefs_bind_to": "evidence content root (survives re-signing / counter-signing / key rotation)",
+  "note": "predicateType URIs frozen against proofbundle v2.1.0 (2026-07-10); they are inside the anchored bytes.",
+  "parameters_file": "parameters.json",
+  "parameters_digest_sha256": "6bb2b8c062d77a0369a13e291e1c3f3171ee656cb935f5e24c76298d91b77e84",
+  "fixture_note": "conformance fixture: the acme-intent-classifier scenario is illustrative, not a production decision"
+}

proofbundle-3.7.0/conformance/decision/crossimpl/schema-conformant/case.json

@@ -0,0 +1,42 @@
+{
+  "caseId": "decision-crossimpl-schema-conformant",
+  "kind": "decision_crossimpl",
+  "input": "schema-conformant",
+  "attribution": "MarkovianProtocol / Colin — audit-anchor@ff6a000 (examples/decision-receipt). MIT License, Copyright (c) 2026 SigmaSynth LLC. Vendored as pure data; no local edits to the vendored bytes.",
+  "expected": {
+    "jcs_byte_identical": true,
+    "content_roots_match_manifest": true,
+    "evidence_ref_binds_content_root": true,
+    "decision_content_root": "97e1d74b810a9fea454ac890c0e17f8a401fb4abbf42827a39aea30846de2fb5",
+    "evidence_content_root": "323adb188f840e90331c920b32a73f348acc5caea8d40f9a84ea384d46c258d4",
+    "decision_predicate_findings": 0,
+    "schema_conformant": true,
+    "anchor": {
+      "height": 958761,
+      "status": "confirmed",
+      "frozen": {
+        "bitcoinBlockHeaderMerkleRootsByHeight": {
+          "958761": "a8e521caf1a50d99240c1808c276cd75e3a3f24f292836593908a16a3ea24f8c"
+        }
+      },
+      "independent_source": {
+        "provider": "blockstream.info + blockchain.info",
+        "block_hash": "00000000000000000001b882ed05ae87bce809336f7cc3d52947c1c128b34dd2",
+        "merkle_root_display_be": "8c4fa23e6aa10839593628294ff2a3e375cd76c208180c24990da5f1ca21e5a8",
+        "note": "Block 958761 header independently fetched from two providers (blockstream.info and blockchain.info), same block hash and merkle root. The frozen value is the block-internal (little-endian) merkle root that OpenTimestamps commits to; it is the byte-reverse of the big-endian value block explorers display. Fetched once, offline-verifiable forever against any Bitcoin block header for height 958761."
+      },
+      "rpTrust": {
+        "bitcoinBlockHeaderMerkleRootsByHeight": {
+          "958761": "a8e521caf1a50d99240c1808c276cd75e3a3f24f292836593908a16a3ea24f8c"
+        }
+      },
+      "_wp_a1_note": "WP-A1: bitcoinBlockHeaderMerkleRootsByHeight under rpTrust is RELYING-PARTY trust (independently sourced from independent_source above); frozen is kept as producer evidence only and is NEVER trusted. A confirmed verdict requires the relying-party header. The same OTS proof WITHOUT the relying-party header reports needs_rp_trust, not confirmed."
+    }
+  },
+  "specRefs": [
+    "docs/predicates/decision-receipt.md#7.1",
+    "docs/ANCHORS.md",
+    "SPEC.md"
+  ],
+  "rationale": "The first full end-to-end decision-receipt/v0.1 conformance case in the corpus: a second, independent implementation (MarkovianProtocol / audit-anchor) produces a decision-receipt statement pair whose .jcs bytes are byte-identical with proofbundle's RFC 8785 canonical output, whose content roots recompute to the MANIFEST values (evidence 323adb18…, decision 97e1d74b…), whose evidenceRef binds the evidence content root, whose predicate validates clean against decision-receipt/v0.1 in NORMAL and STRICT mode (0 findings — schema-conformant), and whose OpenTimestamps proof carries a confirmed BitcoinBlockHeaderAttestation at height 958761 (the OTS-committed merkle root matches the real block merkle root independently fetched from blockstream.info and blockchain.info, verified offline against the relying-party header, never by contacting a calendar). This GRADUATES the canonicalization-only cross-impl iteration: it supersedes decision-crossimpl-canonicalization-root-binding (regenerated 3abe69f, decision root ff05e3e0…, schema expected-fail with 12 findings, anchor pending), which is retained as a historical iteration per CONFORMANCE.md rule 5 (no silent changes; a regeneration is a new case, the old one kept). Colin re-anchored once more (a35dee8 -> ff6a000) against the enforced schema and confirmed the Bitcoin anchor. Vendored digest-pinned as pure data, credited (MIT / SigmaSynth LLC)."
+}

proofbundle-3.7.0/conformance/decision/crossimpl/schema-conformant/decision_receipt.jcs

@@ -0,0 +1 @@
+{"_type":"https://in-toto.io/Statement/v1","predicate":{"agent":{"id":"agent://acme/deploy-pipeline","version":"1.4.2"},"decidedAt":"2026-07-09T14:20:00Z","decision":{"reasonCodes":["eval.metrics.above-threshold"],"verdict":"ALLOW"},"decisionChangeConditions":[{"conditionType":"metricRegression","description":"accuracy on holdout-2026-06 below 0.90","requiredEvidenceType":"evalResult"},{"conditionType":"policyChange","description":"any listed notChecked property becomes a release requirement"}],"decisionId":"urn:uuid:87a3e6d6-321c-4ea4-85be-3c9941e600a6","decisionMaker":{"id":"https://github.com/MarkovianProtocol/audit-anchor/decision-gate/v1"},"decisionType":"preActionAuthorization","evidenceRefs":[{"digest":{"sha256":"323adb188f840e90331c920b32a73f348acc5caea8d40f9a84ea384d46c258d4"},"predicateType":"https://b7n0de.com/attestation/eval-result/v0.1","relation":"evalResult"}],"inputSnapshot":[{"digest":{"sha256":"bb8601c1fc3cf1dc3e829652df409b1bdd9e866e18f25bf7750c9f8702096edc"},"name":"deployment input bundle"}],"notChecked":["fairness-subgroup-parity","adversarial-robustness"],"policyBoundary":{"decisionPath":"release.gate.prod.allow","policyDigest":{"sha256":"8c561dd1f0c5eb47c9353a60d573dccda3ee30b1a820ccb08660466a36450be9"},"policyEngine":"audit-anchor","policyId":"release-gate/prod"},"principal":{"id":"workload://acme/release-engineering"},"privacy":{"rawInputsIncluded":false,"redactionProfile":"none-required"},"proposedAction":{"actionType":"model.deploy","parametersDigest":{"sha256":"6bb2b8c062d77a0369a13e291e1c3f3171ee656cb935f5e24c76298d91b77e84"},"target":{"digest":{"sha256":"2f0aea2dae36951bbf0eb604a98041cc78ec55f85bf84bb5a6bea96f38c8922e"},"name":"deploy/acme-intent-classifier@1.4.2"}},"schemaVersion":"0.1.0"},"predicateType":"https://b7n0de.com/proofbundle/predicates/decision-receipt/v0.1","subject":[{"digest":{"sha256":"2f0aea2dae36951bbf0eb604a98041cc78ec55f85bf84bb5a6bea96f38c8922e"},"name":"deploy/acme-intent-classifier@1.4.2"}]}

proofbundle-3.7.0/conformance/decision/crossimpl/schema-conformant/decision_receipt.json

@@ -0,0 +1,90 @@
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "subject": [
+    {
+      "name": "deploy/acme-intent-classifier@1.4.2",
+      "digest": {
+        "sha256": "2f0aea2dae36951bbf0eb604a98041cc78ec55f85bf84bb5a6bea96f38c8922e"
+      }
+    }
+  ],
+  "predicateType": "https://b7n0de.com/proofbundle/predicates/decision-receipt/v0.1",
+  "predicate": {
+    "schemaVersion": "0.1.0",
+    "decisionId": "urn:uuid:87a3e6d6-321c-4ea4-85be-3c9941e600a6",
+    "decisionType": "preActionAuthorization",
+    "decidedAt": "2026-07-09T14:20:00Z",
+    "decisionMaker": {
+      "id": "https://github.com/MarkovianProtocol/audit-anchor/decision-gate/v1"
+    },
+    "agent": {
+      "id": "agent://acme/deploy-pipeline",
+      "version": "1.4.2"
+    },
+    "principal": {
+      "id": "workload://acme/release-engineering"
+    },
+    "proposedAction": {
+      "actionType": "model.deploy",
+      "target": {
+        "name": "deploy/acme-intent-classifier@1.4.2",
+        "digest": {
+          "sha256": "2f0aea2dae36951bbf0eb604a98041cc78ec55f85bf84bb5a6bea96f38c8922e"
+        }
+      },
+      "parametersDigest": {
+        "sha256": "6bb2b8c062d77a0369a13e291e1c3f3171ee656cb935f5e24c76298d91b77e84"
+      }
+    },
+    "inputSnapshot": [
+      {
+        "name": "deployment input bundle",
+        "digest": {
+          "sha256": "bb8601c1fc3cf1dc3e829652df409b1bdd9e866e18f25bf7750c9f8702096edc"
+        }
+      }
+    ],
+    "policyBoundary": {
+      "policyEngine": "audit-anchor",
+      "policyId": "release-gate/prod",
+      "decisionPath": "release.gate.prod.allow",
+      "policyDigest": {
+        "sha256": "8c561dd1f0c5eb47c9353a60d573dccda3ee30b1a820ccb08660466a36450be9"
+      }
+    },
+    "evidenceRefs": [
+      {
+        "relation": "evalResult",
+        "digest": {
+          "sha256": "323adb188f840e90331c920b32a73f348acc5caea8d40f9a84ea384d46c258d4"
+        },
+        "predicateType": "https://b7n0de.com/attestation/eval-result/v0.1"
+      }
+    ],
+    "decision": {
+      "verdict": "ALLOW",
+      "reasonCodes": [
+        "eval.metrics.above-threshold"
+      ]
+    },
+    "notChecked": [
+      "fairness-subgroup-parity",
+      "adversarial-robustness"
+    ],
+    "decisionChangeConditions": [
+      {
+        "conditionType": "metricRegression",
+        "description": "accuracy on holdout-2026-06 below 0.90",
+        "requiredEvidenceType": "evalResult"
+      },
+      {
+        "conditionType": "policyChange",
+        "description": "any listed notChecked property becomes a release requirement"
+      }
+    ],
+    "privacy": {
+      "rawInputsIncluded": false,
+      "redactionProfile": "none-required"
+    }
+  }
+}

proofbundle-3.7.0/conformance/decision/crossimpl/schema-conformant/evidence_eval_result.jcs

@@ -0,0 +1 @@
+{"_type":"https://in-toto.io/Statement/v1","predicate":{"dataset":{"digest":{"sha256":"165dee5e8cd78240bd9232891f0dcdff6f8977ba3f2cb3de4e43709d8077408d"},"name":"holdout-2026-06"},"evaluatedAt":"2026-07-09T14:12:00Z","harness":{"name":"deepeval","version":"3.2.0"},"metrics":{"accuracy":0.947,"auroc":0.981,"f1":0.933}},"predicateType":"https://b7n0de.com/attestation/eval-result/v0.1","subject":[{"digest":{"sha256":"2931a9b8100d45cc2fae06bd150919283a6b7c26a16304ed13e835b6593584f7"},"name":"model/acme-intent-classifier@1.4.2"}]}

proofbundle-3.7.0/conformance/decision/crossimpl/schema-conformant/evidence_eval_result.json

@@ -0,0 +1,30 @@
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "subject": [
+    {
+      "name": "model/acme-intent-classifier@1.4.2",
+      "digest": {
+        "sha256": "2931a9b8100d45cc2fae06bd150919283a6b7c26a16304ed13e835b6593584f7"
+      }
+    }
+  ],
+  "predicateType": "https://b7n0de.com/attestation/eval-result/v0.1",
+  "predicate": {
+    "harness": {
+      "name": "deepeval",
+      "version": "3.2.0"
+    },
+    "dataset": {
+      "name": "holdout-2026-06",
+      "digest": {
+        "sha256": "165dee5e8cd78240bd9232891f0dcdff6f8977ba3f2cb3de4e43709d8077408d"
+      }
+    },
+    "metrics": {
+      "accuracy": 0.947,
+      "f1": 0.933,
+      "auroc": 0.981
+    },
+    "evaluatedAt": "2026-07-09T14:12:00Z"
+  }
+}

{proofbundle-3.6.2 → proofbundle-3.7.0}/conformance/manifest.json

@@ -4,6 +4,7 @@
   "cases": [
     "decision/crossimpl/confirmed-anchor-lifecycle",
     "decision/crossimpl/canonicalization-root-binding",
+    "decision/crossimpl/schema-conformant",
     "bundle/valid-minimal",
     "bundle/duplicate-json-key",
     "bundle/tampered-payload",

{proofbundle-3.6.2 → proofbundle-3.7.0}/conformance/relation/generate_vectors.py

@@ -634,7 +634,7 @@ def main() -> None:
                          related_pubs=[x_pub, x_pub], policy="policy.json",
                          kind="outcome_relation", attribution=loek, cross_format_id="xfmt-t3-decoy"))
 
-    # 15) wrong-payloadType target (Berkeley audit — Rust payloadType fail-open regression, 3.5.0):
+    # 15) wrong-payloadType target (adversarial deep audit — Rust payloadType fail-open regression, 3.5.0):
     #     a SAME-KEY related target whose DSSE envelope carries the WRONG payloadType (validly signed
     #     over a foreign type). Python _load_related pins the in-toto payloadType (cli.py:1241-1242), so
     #     the target is attached-but-unverified -> lineage FAIL, exit 2; the independent Rust verifier
@@ -653,7 +653,7 @@ def main() -> None:
                base_case("relation-wrong-payloadtype-target",
                          {"exitCode": 2, "lineage": "FAIL",
                           "errorContains": "relation:target_verification_failed"},
-                         "payloadType type-confusion (Berkeley audit, Rust fail-open regression): a "
+                         "payloadType type-confusion (adversarial deep audit, Rust fail-open regression): a "
                          "same-key related target signed under the WRONG payloadType is "
                          "attached-but-unverified. Python pins the in-toto payloadType in _load_related "
                          "and the independent Rust verifier now pins it too (verify_dsse "

{proofbundle-3.6.2 → proofbundle-3.7.0}/conformance/relation/wrong-payloadtype-target/case.json

@@ -13,7 +13,7 @@
     "docs/predicates/relation.md",
     "docs/design/RELATION_V01_DESIGN.md"
   ],
-  "rationale": "payloadType type-confusion (Berkeley audit, Rust fail-open regression): a same-key related target signed under the WRONG payloadType is attached-but-unverified. Python pins the in-toto payloadType in _load_related and the independent Rust verifier now pins it too (verify_dsse expected_payload_type) — BOTH reject (exit 2, lineage FAIL). Before the fix the Rust relation path authenticated the foreign-type envelope (exit 0, VERIFIED): the differential vector that proves the pin.",
+  "rationale": "payloadType type-confusion (adversarial deep audit, Rust fail-open regression): a same-key related target signed under the WRONG payloadType is attached-but-unverified. Python pins the in-toto payloadType in _load_related and the independent Rust verifier now pins it too (verify_dsse expected_payload_type) — BOTH reject (exit 2, lineage FAIL). Before the fix the Rust relation path authenticated the foreign-type envelope (exit 0, VERIFIED): the differential vector that proves the pin.",
   "testKeys": "fresh throwaway keys, generated by conformance/relation/generate_vectors.py",
   "related": [
     "related_t.json"

{proofbundle-3.6.2 → proofbundle-3.7.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "proofbundle"
-version = "3.6.2"
+version = "3.7.0"
 description = "Emit and verify portable cryptographic evidence bundles, offline: Ed25519 + RFC 6962 Merkle + optional SD-JWT."
 readme = "README.md"
 requires-python = ">=3.10"
@@ -72,6 +72,12 @@ experimental = []
 # cryptography build with OpenSSL 3.5+ (default PyPI wheels since 48.0.0). Verify-only by default;
 # the emit helper needs the same. Ed25519 paths never require this.
 pq = ["cryptography>=48"]
+# rootcommit/v2-sig SIGNATURE verification (proofbundle.anchors_rootcommit): EIP-191 personal_sign recovery
+# to the bound operator wallet. Needs a pure-python secp256k1 recovery backend (`ecdsa`); keccak-256 comes
+# from pycryptodome(x), already present via the [anchors] OTS lib. Verify-only, offline, no C build. The v1
+# verify and the v2-sig BINDING check need only [anchors]; without this extra the v2-sig signature outcomes
+# honestly skip (sig_ok None / status no_sig_lib), never a silent pass. `pip install proofbundle[rootcommit]`.
+rootcommit = ["ecdsa>=0.18"]
 # EXPERIMENTAL: the versioned formal model of the relation-lineage ladder (Fundament F3, formal/model.py).
 # z3-solver enables the z3-EXTENDED symbolic proof (higher symbolic arity than bounded enumeration can
 # reach). Without it the model still runs a complete bounded-enumeration proof — the extra only adds the

{proofbundle-3.6.2 → proofbundle-3.7.0}/scripts/findings_register.py

@@ -88,7 +88,7 @@ def _resolve_current(findings: list) -> tuple[dict, list, list, set]:
     The prior version SILENTLY DROPPED a finding whenever it carried ANY ``superseded_by`` string — even a
     DANGLING link (target id absent), a SELF-supersession (superseded_by == own id) or a non-string id —
     which let a validly-signed register hide an open P0 behind a bogus supersession and still report 0 open
-    (a fail-open the Berkeley gate reproduced). Now a finding is legitimately superseded ONLY by a PRESENT,
+    (a fail-open the adversarial deep-gate reproduced). Now a finding is legitimately superseded ONLY by a PRESENT,
     DIFFERENT id; a dangling/self supersession, a non-string/empty id, or a non-dict entry is an ANOMALY that
     is NEVER dropped (the caller fails closed on any anomaly), so no finding can vanish from the count."""
     ids_present = {f["id"] for f in findings

{proofbundle-3.6.2 → proofbundle-3.7.0}/scripts/mutation_check.py

@@ -367,7 +367,7 @@ MUTATIONS = [
     # (iv) require_relation_target equality check disabled (the DECOY parent slips through): killed by
     #      test_decoy_parent_fails_closed / decoy-parent conformance vectors.
     ("src/proofbundle/relation.py",
-     "        if e.get(\"targetDigest\") not in set(allowed):",
+     "        if not (isinstance(_td, str) and _td in set(allowed)):",
      "        if False:",
      "require_relation_target: parent equality check disabled (decoy parent passes)", True),
     # (v) targetSubjectDigest gegenpruefung inverted (O2 no longer catches a lying subject): killed by
@@ -395,6 +395,38 @@ MUTATIONS = [
      "        r[\"crypto_ok\"] and r[\"structure_ok\"] and r[\"predicate_type_ok\"]",
      "        r[\"structure_ok\"] and r[\"predicate_type_ok\"]",
      "relation-statement: cryptoValid dropped from aggregate ok (lattice violation)", True),
+    # 3.6.3 never-raise residual (adversarial re-audit r7) — three new fail-closed guards on
+    # direct-low-level-API sinks. Each disabled guard re-opens a raw type-confusion crash caught by
+    # tests/test_never_raise_surface_family_property.py::test_round5_nested_config_subfield_regression
+    # (R7-1/R7-2/R7-3 pins). Generator-hardening: a future rewrite that drops one goes red HERE.
+    # R7-1 — verify_relationship_edges subject_hex non-str coercion (unhashable {subject_hex} seed).
+    ("src/proofbundle/relation.py",
+     "    subject_hex = subject_hex if isinstance(subject_hex, str) else None",
+     "    subject_hex = subject_hex",
+     "relation: R7-1 subject_hex non-str coercion disabled (unhashable cycle-seed crash)", True),
+    # R7-2 — evaluate_relations_policy non-dict edges-element filter (three sinks: relation/signer/target).
+    ("src/proofbundle/relation.py",
+     "    edges = [e for e in edges if isinstance(e, dict)]",
+     "    edges = list(edges)",
+     "relation: R7-2 non-dict edges-element filter disabled (e.get crash on all three sinks)", True),
+    # R7-3 — _authenticate_trusted_checkpoint non-dict entry guard (entry.get before its own try/except).
+    ("src/proofbundle/policy.py",
+     "    if not isinstance(entry, dict):\n        return False, \"trusted checkpoint entry not an object\"",
+     "    if False:\n        return False, \"trusted checkpoint entry not an object\"",
+     "policy: R7-3 non-dict trusted_checkpoint entry guard disabled (entry.get crash)", True),
+    # R7-2b (adversarial re-audit siblings, iter 1 -> 2) — three more evaluate_relations_policy sinks.
+    ("src/proofbundle/relation.py",
+     "    lineage_result = lineage_result if isinstance(lineage_result, dict) else {}",
+     "    lineage_result = lineage_result",
+     "relation: R7-2b non-dict lineage_result coercion disabled (reject_superseded .get crash)", True),
+    ("src/proofbundle/relation.py",
+     "        rule = signer.get(_rel) if isinstance(_rel, str) else None",
+     "        rule = signer.get(_rel)",
+     "relation: R7-2b unhashable relation signer-lookup guard disabled (dict-key TypeError)", True),
+    ("src/proofbundle/relation.py",
+     "        pinned = target_pin.get(_rel) if isinstance(_rel, str) else None",
+     "        pinned = target_pin.get(_rel)",
+     "relation: R7-2b unhashable relation target-lookup guard disabled (dict-key TypeError)", True),
 ]
 
 

{proofbundle-3.6.2 → proofbundle-3.7.0}/scripts/rust_parity_registry.json

@@ -185,6 +185,18 @@
       "crosscheck_refs": [],
       "notes": "Fail-closed verifier for a markovian-provenance/v1 external anchor."
     },
+    "proofbundle.anchors_rootcommit.verify_rootcommit_v1": {
+      "status": "PENDING",
+      "rust_subcommands": [],
+      "crosscheck_refs": [],
+      "notes": "Fail-closed second-implementation verifier for the MarkovianProtocol rootcommit/v1 external anchor (Bitcoin OTS over a domain-separated preimage folding the checkpoint root + operator wallet; corpus pinned at 9034202). Python-only, no Rust parity."
+    },
+    "proofbundle.anchors_rootcommit.verify_rootcommit_v2sig": {
+      "status": "PENDING",
+      "rust_subcommands": [],
+      "crosscheck_refs": [],
+      "notes": "Fail-closed second-implementation verifier for the MarkovianProtocol rootcommit/v2-sig external anchor (v1 binding plus an EIP-191/secp256k1 wallet signature over the commitment, signature enforced only with the optional [rootcommit] backend). Python-only, no Rust parity."
+    },
     "proofbundle.anchors_chia.verify_offline_merkle": {
       "status": "PENDING",
       "rust_subcommands": [],

{proofbundle-3.6.2 → proofbundle-3.7.0}/src/proofbundle/__init__.py

@@ -13,7 +13,7 @@ from __future__ import annotations
 
 from typing import TYPE_CHECKING
 
-__version__ = "3.6.2"
+__version__ = "3.7.0"
 
 # The `proofbundle/v0.1` normative spec revision this build implements — kept in sync with the
 # `Revision:` line at the top of SPEC.md by tests/test_docs_truth.py (WP-B1, closes #28). Bump

{proofbundle-3.6.2 → proofbundle-3.7.0}/src/proofbundle/adapters/inspect_ai.py

@@ -12,7 +12,7 @@ commitments (never plaintext in the payload).
 """
 from __future__ import annotations
 
-from typing import Optional
+from typing import Any, Optional
 
 from ..evalclaim import build_eval_claim
 
@@ -64,12 +64,14 @@ def from_inspect_ai_log(path, metric: str, *, comparator: str, threshold: str, t
         raise InspectAdapterError("inspect_ai log missing .eval or .results (empty or malformed log)")
 
     value = None
+    matched_score = None
     for score in (getattr(results, "scores", None) or []):
         metrics = getattr(score, "metrics", None) or {}
         if metric in metrics:
             value = getattr(metrics[metric], "value", None)
+            matched_score = score
             break
-    if value is None:
+    if value is None or matched_score is None:
         raise InspectAdapterError(f"metric {metric!r} not found in any score.metrics of the log")
 
     suite = str(getattr(ev, "task", "inspect_ai"))
@@ -78,7 +80,7 @@ def from_inspect_ai_log(path, metric: str, *, comparator: str, threshold: str, t
     dataset_id = str(getattr(dataset, "name", None) or suite)
 
     # Provenance parity with the lm-eval adapter: inspect_ai exposes the same run provenance for free.
-    provenance = {"harness": "inspect_ai"}
+    provenance: dict[str, Any] = {"harness": "inspect_ai"}
     revision = getattr(ev, "revision", None)
     commit = getattr(revision, "commit", None)
     if commit:
@@ -90,6 +92,30 @@ def from_inspect_ai_log(path, metric: str, *, comparator: str, threshold: str, t
     if tv is not None:
         provenance["task_version"] = str(tv)
 
+    # Bind the metric to the scorer that produced it. Without these fields, a deterministic scorer
+    # and an LLM judge can emit byte-identical claims when their aggregate numbers match. We record
+    # objective identity/configuration facts only; no reliability class is inferred here.
+    scorer = getattr(matched_score, "scorer", None)
+    if scorer:
+        provenance["scorer"] = str(scorer)
+    score_name = getattr(matched_score, "name", None)
+    if score_name:
+        provenance["score_name"] = str(score_name)
+    reducer = getattr(matched_score, "reducer", None)
+    if reducer:
+        provenance["score_reducer"] = str(reducer)
+    scored_samples = getattr(matched_score, "scored_samples", None)
+    unscored_samples = getattr(matched_score, "unscored_samples", None)
+    for name, count in (("scored_samples", scored_samples), ("unscored_samples", unscored_samples)):
+        if isinstance(count, int) and not isinstance(count, bool) and count >= 0:
+            provenance[name] = count
+    params = getattr(matched_score, "params", None)
+    if isinstance(params, dict) and params:
+        from ._provenance import config_hash
+        params_hash = config_hash(params)
+        if params_hash:
+            provenance["scorer_params_hash"] = params_hash
+
     # v1.8 (external review): run-id + config-hash + LOG-NATIVE timestamp so a receipt traces back
     # to the exact run. inspect_ai: eval.run_id (unique run id), eval.created (UTC datetime string),
     # eval.task_args (the config material — no native config hash exists, so we compute one).
@@ -99,9 +125,15 @@ def from_inspect_ai_log(path, metric: str, *, comparator: str, threshold: str, t
                    config=task_args if isinstance(task_args, dict) else None,
                    log_timestamp=getattr(ev, "created", None))
 
+    # EvalScore.scored_samples is the population the selected metric was actually computed over.
+    # total_samples can include unscored samples, so using it would overstate the signed claim's n.
+    metric_n = (scored_samples if isinstance(scored_samples, int)
+                and not isinstance(scored_samples, bool) and scored_samples >= 0
+                else int(getattr(results, "total_samples", 0) or 0))
+
     return build_eval_claim(
         suite=suite, suite_version=str(getattr(ev, "task_version", "1")),
         metric=metric, comparator=comparator, threshold=threshold, score=_score_str(value),
-        n=int(getattr(results, "total_samples", 0) or 0),
+        n=metric_n,
         model_id=model_id, dataset_id=dataset_id, issuer="", timestamp=timestamp,
         provenance=provenance, model_salt=model_salt, dataset_salt=dataset_salt)

{proofbundle-3.6.2 → proofbundle-3.7.0}/src/proofbundle/adapters/lm_eval.py

@@ -56,12 +56,20 @@ def from_lm_eval_results(path, task: str, metric: str, *, comparator: str, thres
 
     n_samples = data.get("n-samples", {}).get(task, {})
     n = int(n_samples.get("effective") or n_samples.get("original") or res.get("sample_len") or 0)
+    effective_samples = int(n_samples["effective"]) if n_samples.get("effective") is not None else n
+    original_samples = (int(n_samples["original"])
+                        if n_samples.get("original") is not None else effective_samples)
+    if effective_samples < 0 or original_samples < 0:
+        raise ValueError("n-samples effective and original counts must be non-negative")
+    skipped_samples = max(original_samples - effective_samples, 0)
     cfg = data.get("config", {})
     model_id = str(cfg.get("model_name") or cfg.get("model") or "unknown")
     if cfg.get("model_args"):
         model_id = f"{model_id}::{cfg['model_args']}"   # include args so the commitment pins the exact model
 
-    provenance = {"harness": "lm-evaluation-harness", "matched_metric_key": matched}
+    provenance = {"harness": "lm-evaluation-harness", "matched_metric_key": matched,
+                  "effective_samples": effective_samples, "original_samples": original_samples,
+                  "skipped_samples": skipped_samples}
     if data.get("git_hash"):
         provenance["git_hash"] = str(data["git_hash"])
     if data.get("versions", {}).get(task) is not None:

{proofbundle-3.6.2 → proofbundle-3.7.0}/src/proofbundle/anchors.py

@@ -54,7 +54,7 @@ _VERIFIERS: dict[str, Callable] = {}
 
 
 def _as_dict(v):
-    """Berkeley r5 class-fix: Config-Sub-Feld als dict, sonst {} (schliesst das ``_as_dict(x.get(k))``-Loch)."""
+    """adversarial re-audit r5 class-fix: Config-Sub-Feld als dict, sonst {} (schliesst das ``_as_dict(x.get(k))``-Loch)."""
     return v if isinstance(v, dict) else {}
 
 
@@ -123,7 +123,7 @@ def receipt_canonical_root(bundle: dict) -> bytes:
     from ._strict_json import enforce_structural_budget  # noqa: PLC0415 - local import avoids an import cycle
     from .errors import ProofBundleError  # noqa: PLC0415
     try:
-        # Berkeley re-gate round 7: bound depth (<=64) / node count BEFORE rfc8785.dumps recurses — a deeply
+        # adversarial re-audit round 7: bound depth (<=64) / node count BEFORE rfc8785.dumps recurses — a deeply
         # nested bundle made rfc8785.dumps raise a raw RecursionError (a RuntimeError, NOT the ValueError arm
         # below, NOT a ProofBundleError, so it escaped this public verify-path primitive). This mirrors the
         # round-5 fix on the peer canonical.canonicalize_statement / statement_content_root.
@@ -216,7 +216,7 @@ def verify_anchor(anchor: dict, *, target_roots: dict, now: Optional[int] = None
         out["detail"] = (f"no verifier registered for anchor type {atype!r} "
                          "(install proofbundle[anchors] or register the extension type)")
         return out
-    expected_root = _as_dict(target_roots).get(target)  # Berkeley r5: target_roots kwarg (None/int) fail-closed
+    expected_root = _as_dict(target_roots).get(target)  # adversarial re-audit r5: target_roots kwarg (None/int) fail-closed
     if expected_root is None:
         out["detail"] = f"the receipt has no {target} target to anchor against"
         return out
@@ -226,7 +226,7 @@ def verify_anchor(anchor: dict, *, target_roots: dict, now: Optional[int] = None
         out["detail"] = f"canonicalRoot does not match the {target} root (cross-target or tampered)"
         return out
     proof = _b64d(anchor.get("proof"), "proof")
-    # Berkeley re-gate round 6 (defensive): `_as_dict(anchor.get("frozen"))` only replaces a FALSY non-dict; a
+    # adversarial re-audit round 6 (defensive): `_as_dict(anchor.get("frozen"))` only replaces a FALSY non-dict; a
     # TRUTHY non-dict from an attacker bundle ("frozen":"x" / [...]) would reach a verifier's frozen.get(...).
     # The `except Exception` below already fail-closes that, but normalize any non-dict to {} up front so the
     # verifiers never see a wrong type.