proofbundle 3.7.0__tar.gz → 3.8.0__tar.gz

{proofbundle-3.7.0/src/proofbundle.egg-info → proofbundle-3.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofbundle
-Version: 3.7.0
+Version: 3.8.0
 Summary: Emit and verify portable cryptographic evidence bundles, offline: Ed25519 + RFC 6962 Merkle + optional SD-JWT.
 Author: Konrad Gruszka
 License: MIT
@@ -54,9 +54,9 @@ Provides-Extra: inspect
 Requires-Dist: inspect_ai<0.4,>=0.3.112; extra == "inspect"
 Provides-Extra: dev
 Requires-Dist: pytest>=7; extra == "dev"
-Requires-Dist: ruff>=0.5; extra == "dev"
+Requires-Dist: ruff<0.17,>=0.5; extra == "dev"
 Requires-Dist: jsonschema>=4; extra == "dev"
-Requires-Dist: mypy>=1.8; extra == "dev"
+Requires-Dist: mypy<3,>=1.8; extra == "dev"
 Requires-Dist: build>=1; extra == "dev"
 Requires-Dist: hypothesis>=6; extra == "dev"
 Requires-Dist: rfc8785>=0.1.4; extra == "dev"
@@ -86,11 +86,48 @@ Merkle, one file, no server, no network.
 [![Python](https://img.shields.io/pypi/pyversions/proofbundle.svg)](https://pypi.org/project/proofbundle/)
 [![License: MIT](https://img.shields.io/badge/license-MIT-D6248A.svg)](https://github.com/b7n0de/proofbundle/blob/main/LICENSE)
 [![DOI](https://zenodo.org/badge/DOI/10.5281/zenodo.21110642.svg)](https://doi.org/10.5281/zenodo.21110642)
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/b7n0de/proofbundle/badge)](https://scorecard.dev/viewer/?uri=github.com/b7n0de/proofbundle)
+
+Scorecard **6.5/10** — [what the four zeros mean, in one sentence each](#what-the-scorecard-badge-says-including-the-parts-that-are-low)
 
 **Reviewing this for adoption?** Start with the 30-minute adversarial audit path: **[docs/REVIEWERS.md](https://github.com/b7n0de/proofbundle/blob/main/docs/REVIEWERS.md)**.
 
 </div>
 
+## What the Scorecard badge says, including the parts that are low
+
+The badge is live, so it will move. Measured 2026-08-07, re-measured 2026-08-10 with identical
+per-check values (Scorecard v5.5.0 both times): **6.5 / 10**. Ten checks
+score 10/10 — Security-Policy, Token-Permissions, SAST, Fuzzing, CI-Tests, Vulnerabilities,
+Dangerous-Workflow, Dependency-Update-Tool, Packaging, License. Four score 0, and rather than let you
+wonder, here is each cause in one sentence:
+
+- **Maintained (0/10)** — the check wants sustained activity on the default branch over 90 days, and
+  this repository is younger than that window. It resolves itself with time and is not worth chasing.
+- **CII-Best-Practices (0/10)** — the OpenSSF Best Practices badge has not been applied for. The
+  criteria were walked through honestly first:
+  [docs/openssf_best_practices_self_assessment.md](https://github.com/b7n0de/proofbundle/blob/main/docs/openssf_best_practices_self_assessment.md).
+- **Contributors (0/10)** — it counts contributors from two or more organisations. This is a
+  one-person project, and the zero is an accurate description of that.
+- **Signed-Releases (0/10)** — the check reads GitHub **release assets** looking for a signature file.
+  Every version release (`v*`) is attested (SLSA build provenance over the exact built bytes, PyPI
+  upload gated on a sha256 match), but that attestation lives in GitHub's attestation store and on
+  PyPI — not next to the release, which is where the check looks. The release workflow now also
+  places the provenance bundle next to the release assets; that takes effect with the next release,
+  and already-published releases were not modified after the fact. Nothing is re-signed — an
+  existing file is placed in a second location. Of the five releases the check reads, three are
+  corpus-review pre-releases that carry no such assets either, so the number will climb only as new
+  releases move through that window.
+
+Three further checks sit in between: **Code-Review 1/10** (most commits are not reviewed by a second
+person — structural for a single maintainer), **Binary-Artifacts 9/10** (the deducted point is a
+checked-in wheel+sdist pair kept as a reproduction fixture in `dist_final/`, and one point is not
+worth rebuilding that fixture), and **Pinned-Dependencies 3/10** / **Branch-Protection 3/10**, both
+measured and not yet addressed.
+
+Publishing a middling number with its causes is the point. A project that sells evidence cannot
+withhold its own.
+
 ## 60-second try (offline)
 
 ```bash
@@ -117,8 +154,10 @@ Every AI eval number you read — a safety benchmark, a capability score, a lead
 **unverifiable claim**. You trust the lab. There is no portable way to check, offline, that a result
 was signed by a stated party, has not been altered, and covers the samples it claims.
 
-proofbundle is that check: a small MIT-licensed Python tool (a compact, auditable trusted core that
-depends only on [`cryptography`](https://cryptography.io)) that turns a result into a signed receipt
+proofbundle is that check: a small MIT-licensed Python tool (a compact, auditable trusted verify
+core that depends only on [`cryptography`](https://cryptography.io); the package installs one more
+hard dependency, the RFC 8785 canonicalizer [`rfc8785`](https://pypi.org/project/rfc8785/), used on
+the emit and canonicalization paths) that turns a result into a signed receipt
 anyone can verify from a single file. In plain terms it is the cash-register receipt of an AI test
 result: it shows who claimed the number and that nobody quietly changed it, not that the test was
 good. Without a receipt there is nothing to check at all.
@@ -200,7 +239,7 @@ version history (see also [CHANGELOG.md](https://github.com/b7n0de/proofbundle/b
 ## Install
 
 ```bash
-pip install proofbundle                 # core: offline verify + plain emit (dependency-free)
+pip install proofbundle                 # core: offline verify + plain emit (two deps: cryptography, rfc8785)
 pip install "proofbundle[eval]"          # + eval receipts, prereg, and the demo (RFC 8785 JCS canonicalizer)
 pip install "proofbundle[inspect]"      # inspect_ai adapter + hook
 pip install "proofbundle[pq]"           # verify ML-DSA-44 (post-quantum) witness cosignatures
@@ -238,6 +277,8 @@ DOI [10.5281/zenodo.21110642](https://doi.org/10.5281/zenodo.21110642); the Tech
 | The demos, tier by tier | [docs/DEMO.md](https://github.com/b7n0de/proofbundle/blob/main/docs/DEMO.md) |
 | The normative format + verification order | [SPEC.md](https://github.com/b7n0de/proofbundle/blob/main/SPEC.md) |
 | Honest comparison to Rekor / in-toto / OMS / ValiChord | [INTEROP.md](https://github.com/b7n0de/proofbundle/blob/main/INTEROP.md) |
+| What the conformance corpus does and does not establish | [CONFORMANCE.md](https://github.com/b7n0de/proofbundle/blob/main/CONFORMANCE.md) |
+| The commercial boundary of the project | [docs/COMMERCIAL_BOUNDARY.md](https://github.com/b7n0de/proofbundle/blob/main/docs/COMMERCIAL_BOUNDARY.md) |
 | Regulatory mapping (and what to never claim) | [COMPLIANCE.md](https://github.com/b7n0de/proofbundle/blob/main/COMPLIANCE.md) |
 | Funders / role fit | [docs/PROJECT_BRIEF.md](https://github.com/b7n0de/proofbundle/blob/main/docs/PROJECT_BRIEF.md) |
 | **Preview:** TEE-attestation bridge (RATS/EAT, `[experimental]`) | [docs/EXPERIMENTAL_ENCLAVE.md](https://github.com/b7n0de/proofbundle/blob/main/docs/EXPERIMENTAL_ENCLAVE.md) |

{proofbundle-3.7.0 → proofbundle-3.8.0}/README.md

@@ -19,11 +19,48 @@ Merkle, one file, no server, no network.
 [![Python](https://img.shields.io/pypi/pyversions/proofbundle.svg)](https://pypi.org/project/proofbundle/)
 [![License: MIT](https://img.shields.io/badge/license-MIT-D6248A.svg)](https://github.com/b7n0de/proofbundle/blob/main/LICENSE)
 [![DOI](https://zenodo.org/badge/DOI/10.5281/zenodo.21110642.svg)](https://doi.org/10.5281/zenodo.21110642)
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/b7n0de/proofbundle/badge)](https://scorecard.dev/viewer/?uri=github.com/b7n0de/proofbundle)
+
+Scorecard **6.5/10** — [what the four zeros mean, in one sentence each](#what-the-scorecard-badge-says-including-the-parts-that-are-low)
 
 **Reviewing this for adoption?** Start with the 30-minute adversarial audit path: **[docs/REVIEWERS.md](https://github.com/b7n0de/proofbundle/blob/main/docs/REVIEWERS.md)**.
 
 </div>
 
+## What the Scorecard badge says, including the parts that are low
+
+The badge is live, so it will move. Measured 2026-08-07, re-measured 2026-08-10 with identical
+per-check values (Scorecard v5.5.0 both times): **6.5 / 10**. Ten checks
+score 10/10 — Security-Policy, Token-Permissions, SAST, Fuzzing, CI-Tests, Vulnerabilities,
+Dangerous-Workflow, Dependency-Update-Tool, Packaging, License. Four score 0, and rather than let you
+wonder, here is each cause in one sentence:
+
+- **Maintained (0/10)** — the check wants sustained activity on the default branch over 90 days, and
+  this repository is younger than that window. It resolves itself with time and is not worth chasing.
+- **CII-Best-Practices (0/10)** — the OpenSSF Best Practices badge has not been applied for. The
+  criteria were walked through honestly first:
+  [docs/openssf_best_practices_self_assessment.md](https://github.com/b7n0de/proofbundle/blob/main/docs/openssf_best_practices_self_assessment.md).
+- **Contributors (0/10)** — it counts contributors from two or more organisations. This is a
+  one-person project, and the zero is an accurate description of that.
+- **Signed-Releases (0/10)** — the check reads GitHub **release assets** looking for a signature file.
+  Every version release (`v*`) is attested (SLSA build provenance over the exact built bytes, PyPI
+  upload gated on a sha256 match), but that attestation lives in GitHub's attestation store and on
+  PyPI — not next to the release, which is where the check looks. The release workflow now also
+  places the provenance bundle next to the release assets; that takes effect with the next release,
+  and already-published releases were not modified after the fact. Nothing is re-signed — an
+  existing file is placed in a second location. Of the five releases the check reads, three are
+  corpus-review pre-releases that carry no such assets either, so the number will climb only as new
+  releases move through that window.
+
+Three further checks sit in between: **Code-Review 1/10** (most commits are not reviewed by a second
+person — structural for a single maintainer), **Binary-Artifacts 9/10** (the deducted point is a
+checked-in wheel+sdist pair kept as a reproduction fixture in `dist_final/`, and one point is not
+worth rebuilding that fixture), and **Pinned-Dependencies 3/10** / **Branch-Protection 3/10**, both
+measured and not yet addressed.
+
+Publishing a middling number with its causes is the point. A project that sells evidence cannot
+withhold its own.
+
 ## 60-second try (offline)
 
 ```bash
@@ -50,8 +87,10 @@ Every AI eval number you read — a safety benchmark, a capability score, a lead
 **unverifiable claim**. You trust the lab. There is no portable way to check, offline, that a result
 was signed by a stated party, has not been altered, and covers the samples it claims.
 
-proofbundle is that check: a small MIT-licensed Python tool (a compact, auditable trusted core that
-depends only on [`cryptography`](https://cryptography.io)) that turns a result into a signed receipt
+proofbundle is that check: a small MIT-licensed Python tool (a compact, auditable trusted verify
+core that depends only on [`cryptography`](https://cryptography.io); the package installs one more
+hard dependency, the RFC 8785 canonicalizer [`rfc8785`](https://pypi.org/project/rfc8785/), used on
+the emit and canonicalization paths) that turns a result into a signed receipt
 anyone can verify from a single file. In plain terms it is the cash-register receipt of an AI test
 result: it shows who claimed the number and that nobody quietly changed it, not that the test was
 good. Without a receipt there is nothing to check at all.
@@ -133,7 +172,7 @@ version history (see also [CHANGELOG.md](https://github.com/b7n0de/proofbundle/b
 ## Install
 
 ```bash
-pip install proofbundle                 # core: offline verify + plain emit (dependency-free)
+pip install proofbundle                 # core: offline verify + plain emit (two deps: cryptography, rfc8785)
 pip install "proofbundle[eval]"          # + eval receipts, prereg, and the demo (RFC 8785 JCS canonicalizer)
 pip install "proofbundle[inspect]"      # inspect_ai adapter + hook
 pip install "proofbundle[pq]"           # verify ML-DSA-44 (post-quantum) witness cosignatures
@@ -171,6 +210,8 @@ DOI [10.5281/zenodo.21110642](https://doi.org/10.5281/zenodo.21110642); the Tech
 | The demos, tier by tier | [docs/DEMO.md](https://github.com/b7n0de/proofbundle/blob/main/docs/DEMO.md) |
 | The normative format + verification order | [SPEC.md](https://github.com/b7n0de/proofbundle/blob/main/SPEC.md) |
 | Honest comparison to Rekor / in-toto / OMS / ValiChord | [INTEROP.md](https://github.com/b7n0de/proofbundle/blob/main/INTEROP.md) |
+| What the conformance corpus does and does not establish | [CONFORMANCE.md](https://github.com/b7n0de/proofbundle/blob/main/CONFORMANCE.md) |
+| The commercial boundary of the project | [docs/COMMERCIAL_BOUNDARY.md](https://github.com/b7n0de/proofbundle/blob/main/docs/COMMERCIAL_BOUNDARY.md) |
 | Regulatory mapping (and what to never claim) | [COMPLIANCE.md](https://github.com/b7n0de/proofbundle/blob/main/COMPLIANCE.md) |
 | Funders / role fit | [docs/PROJECT_BRIEF.md](https://github.com/b7n0de/proofbundle/blob/main/docs/PROJECT_BRIEF.md) |
 | **Preview:** TEE-attestation bridge (RATS/EAT, `[experimental]`) | [docs/EXPERIMENTAL_ENCLAVE.md](https://github.com/b7n0de/proofbundle/blob/main/docs/EXPERIMENTAL_ENCLAVE.md) |

{proofbundle-3.7.0 → proofbundle-3.8.0}/docs/readiness_pack/MANIFEST.sha256

@@ -1,11 +1,11 @@
 e6e2f1ca00c1798975005315172248db3ee8fefb02b978cd12627c526dd5dc60  AUDITOR_OPEN_POINTS.md
 3d66a85ff79c0258d794e7c8d8740f8a3b7a62e6ffd9bd7dada158a939964660  OPEN_QUESTIONS.md
-9a227810137e0c2321948b61737c5b4dbcc36196f017026d43a4bdb050c11445  PROGRESS.md
-2c59b2de935c928140c4425ad0d402683b9482f064d760e9d9ace39cfe7b6eec  README.md
+f9079c57df7b037f3c4a30137c5305de42c46cb12bf1c620f6ea5ce1b7c42c82  PROGRESS.md
+6ccab20c7daef6d71c13e0dcacba24a6a18dd480b5d41418e01b5bf2983ffc9c  README.md
 c9ceb3f92a2f720d901affa8defb47004b58a51029317208db641ce53d90b284  REPRODUCTION_RUNBOOK.md
 1b4e4316aaea6c962664fc08945c65a048147fdc4ad89a1e694818b934ef6fa2  calendar_independence.md
-f0db4c1c1449001b1d25a2712148a33293863dbf92bf1dc31a34d2465c6bb647  differential_matrix.md
+9a9a9e4956076c6c287dada5de82eb66cf259cec89a6e791088e1733a74c5ea3  differential_matrix.md
 426a22bd91c7a7529700c06570a3e55fb4c11281992d6215fc2315b12731f9cd  index.json
-5d4997642f7c68b902da5f811821c306cd902589cb027d5f4bc96d593f53ebd9  rust_parity_scope.md
+d1d1e04e9d2de38443ec2b953c3a9c968a303e81977cb7e128468945160b56d7  rust_parity_scope.md
 f2a77cacd7fefe39450edb1857ec2ffc25a4d4c3d8d68efa094ba84ab7325708  tamper_resistance.md
 6d6a4065a1e7e071819960cef8e0117ada98e931cd62fd94341b45af4865711a  threat_model_delta_360.md

{proofbundle-3.7.0 → proofbundle-3.8.0}/docs/readiness_pack/PROGRESS.md

@@ -1,6 +1,6 @@
 # Honest progress accounting (No-Overclaim)
 
-The denominator is the full distance from today (3.3.0) to "4.0.0-stable, externally audited,
+The denominator is the full distance from the 3.3.0 baseline (current release: 3.8.0) to "4.0.0-stable, externally audited,
 trustworthy". This is a factual progress statement, not a forward promise, and it is deliberately
 placed in the readiness pack so an auditor reads our own honest number before forming theirs.
 
@@ -26,7 +26,7 @@ placed in the readiness pack so an auditor reads our own honest number before fo
 ## Consequence
 
 With the five front-loaded foundations plus the pre-tag audit discipline, the audit-candidate (3.6.0)
-is reachable at ~85% of the total distance with **practically zero avoidable rework**; the remaining
+was reached at ~85% of the total distance (3.6.0 tagged 2026-07-17) with **practically zero avoidable rework**; the remaining
 ~15% is, by definition, not anticipatable — only best-prepared, which is what this pack is.
 
 ## Where this number is enforced against drift

{proofbundle-3.7.0 → proofbundle-3.8.0}/docs/readiness_pack/README.md

@@ -30,9 +30,9 @@ it does not, and cannot, close on its own.
 ## Release evidence slots (front-loaded)
 
 - `3.3.1-frontload` — **filled**: the five foundations (F1–F5) + the pre-tag audit discipline (F7).
-- `3.4.0` — reserved: relation_signer receipts, decoy-parent F1 vectors, formal obligation O5.
-- `3.5.0` — reserved: relation_statement Rust parity, formal obligation O6, F4 auto-coverage.
-- `3.6.0` — reserved: fuzz-soak corpora, differential matrix, formal obligation O7, threat-model delta.
+- `3.4.0` — **filled** (shipped under the 3.6.0 tag): relation_signer receipts, decoy-parent F1 vectors; formal obligation O5 remains reserved (see `index.json`).
+- `3.5.0` — **filled** (shipped under the 3.6.0 tag): relation_statement Rust parity, F4 auto-coverage; formal obligation O6 remains reserved (see `index.json`).
+- `3.6.0` — **filled**: fuzz-soak corpora, differential matrix, threat-model delta, 33-check acceptance matrix; formal obligation O7 remains reserved (see `index.json`).
 
 A `reserved` slot is declared honestly; it is not evidence yet, and nothing here counts it as such.
 

{proofbundle-3.7.0 → proofbundle-3.8.0}/docs/readiness_pack/differential_matrix.md

@@ -19,7 +19,9 @@ python3 tools/pb_verify_rs/crosscheck.py --matrix audit_artifacts/360/rust_diffe
 
 The artifact carries an environment freeze (cargo / rustc / python versions) so a re-run on another box
 is comparable. On the recorded run: 40 relation vectors, Python == Rust on all, and the whole 54-case
-conformance corpus reproduced independently by the Rust binary.
+conformance corpus of that era reproduced independently by the Rust binary (the corpus has since
+grown to 57 cases; the named `make conformance-crossimpl` gate re-runs the cross-check on every
+invocation, 56/56 as of v3.7.0).
 
 ## Scope of coverage
 

{proofbundle-3.7.0 → proofbundle-3.8.0}/docs/readiness_pack/proofbundle/readiness_pack.bundle.json

@@ -1,16 +1,16 @@
 {
   "schema": "proofbundle/v0.1",
-  "payload_b64": "ZTZlMmYxY2EwMGMxNzk4OTc1MDA1MzE1MTcyMjQ4ZGIzZWU4ZmVmYjAyYjk3OGNkMTI2MjdjNTI2ZGQ1ZGM2MCAgQVVESVRPUl9PUEVOX1BPSU5UUy5tZAozZDY2YTg1ZmY3OWMwMjU4ZDc5NGU3YzhkODc0MGY4YTNiN2E2MmU2ZmZkOWJkN2RhZGExNThhOTM5OTY0NjYwICBPUEVOX1FVRVNUSU9OUy5tZAo5YTIyNzgxMDEzN2UwYzIzMjE5NDhiNjE3MzdjNWI0ZGJjYzM2MTk2ZjAxNzAyNmQ0M2E0YmRiMDUwYzExNDQ1ICBQUk9HUkVTUy5tZAoyYzU5YjJkZTkzNWM5MjgxNDBjNDQyNWFkMGQ0MDI2ODNiOTQ4MmYwNjRkNzYwZTlkOWFjZTM5Y2ZlN2I2ZWVjICBSRUFETUUubWQKYzljZWIzZjkyYTJmNzIwZDkwMWFmZmE4ZGVmYjQ3MDA0YjU4YTUxMDI5MzE3MjA4ZGI2NDFjZTUzZDkwYjI4NCAgUkVQUk9EVUNUSU9OX1JVTkJPT0subWQKMWI0ZTQzMTZhYWVhNmM5NjI2NjRmYzA4OTQ1YzY1YTA0ODE0N2ZkYzRhZDg5YTFlNjk0ODE4YjkzNGVmNmZhMiAgY2FsZW5kYXJfaW5kZXBlbmRlbmNlLm1kCmYwZGI0YzFjMTQ0OTAwMWIxZDI1YTI3MTIxNDhhMzMyOTM4NjNkYmY5MmJmMWRjMzFhMzRkMjQ2NWM2YmI2NDcgIGRpZmZlcmVudGlhbF9tYXRyaXgubWQKNDI2YTIyYmQ5MWM3YTc1Mjk3MDBjMDY1NzBhM2U1NWZiNGMxMTI4MTk5MmQ2MjE1ZmMyMzE1YjEyNzMxZjljZCAgaW5kZXguanNvbgo1ZDQ5OTc2NDJmN2M2OGI5MDJkYTVmODExODIxYzMwNmNkOTAyNTg5Y2IwMjdkNWY0YmM5NmQ1OTNmNTNlYmQ5ICBydXN0X3Bhcml0eV9zY29wZS5tZApmMmE3N2NhY2Q3ZmVmZTM5NDUwZWRiMTg1N2VjMmZmYzI1YTRkNGMzZDhkNjhlZmEwOTRiYTg0YWI3MzI1NzA4ICB0YW1wZXJfcmVzaXN0YW5jZS5tZAo2ZDZhNDA2NWExZTdlMDcxODE5OTYwY2VmOGUwMTE3YWRhOThlOTMxY2Q2MmZkOTQzNDFiNDVhZjQ4NjU3MTFhICB0aHJlYXRfbW9kZWxfZGVsdGFfMzYwLm1kCg==",
+  "payload_b64": "ZTZlMmYxY2EwMGMxNzk4OTc1MDA1MzE1MTcyMjQ4ZGIzZWU4ZmVmYjAyYjk3OGNkMTI2MjdjNTI2ZGQ1ZGM2MCAgQVVESVRPUl9PUEVOX1BPSU5UUy5tZAozZDY2YTg1ZmY3OWMwMjU4ZDc5NGU3YzhkODc0MGY4YTNiN2E2MmU2ZmZkOWJkN2RhZGExNThhOTM5OTY0NjYwICBPUEVOX1FVRVNUSU9OUy5tZApmOTA3OWM1N2RmN2IwMzdmM2M0YTMwMTM3YzUzMDVkZTQyYzQ2Y2IxMmJmMWM2MjBmNmVhNWNlMWI3YzQyYzgyICBQUk9HUkVTUy5tZAo2Y2NhYjIwYzdkYWVmNmQ3MWMxM2UwZGNhY2JhMjRhNmExOGRkNDgwYjVkNDE0MThlMDFiNWJmMjk4M2ZmYzljICBSRUFETUUubWQKYzljZWIzZjkyYTJmNzIwZDkwMWFmZmE4ZGVmYjQ3MDA0YjU4YTUxMDI5MzE3MjA4ZGI2NDFjZTUzZDkwYjI4NCAgUkVQUk9EVUNUSU9OX1JVTkJPT0subWQKMWI0ZTQzMTZhYWVhNmM5NjI2NjRmYzA4OTQ1YzY1YTA0ODE0N2ZkYzRhZDg5YTFlNjk0ODE4YjkzNGVmNmZhMiAgY2FsZW5kYXJfaW5kZXBlbmRlbmNlLm1kCjlhOWE5ZTQ5NTYwNzZjNmMyODdkYWRhNWRlODJlYjY2Y2YyNTljZWM4OWE2ZTc5MTA4OGUxNzMzYTc0YzVlYTMgIGRpZmZlcmVudGlhbF9tYXRyaXgubWQKNDI2YTIyYmQ5MWM3YTc1Mjk3MDBjMDY1NzBhM2U1NWZiNGMxMTI4MTk5MmQ2MjE1ZmMyMzE1YjEyNzMxZjljZCAgaW5kZXguanNvbgpkMWQxZTA0ZTlkMmRlMzg0NDNlYzJiOTUzYzNhOWM5NjhhMzAzZTgxOTc3Y2I3ZTEyODQ2ODk0NTE2MGI1NmQ3ICBydXN0X3Bhcml0eV9zY29wZS5tZApmMmE3N2NhY2Q3ZmVmZTM5NDUwZWRiMTg1N2VjMmZmYzI1YTRkNGMzZDhkNjhlZmEwOTRiYTg0YWI3MzI1NzA4ICB0YW1wZXJfcmVzaXN0YW5jZS5tZAo2ZDZhNDA2NWExZTdlMDcxODE5OTYwY2VmOGUwMTE3YWRhOThlOTMxY2Q2MmZkOTQzNDFiNDVhZjQ4NjU3MTFhICB0aHJlYXRfbW9kZWxfZGVsdGFfMzYwLm1kCg==",
   "signature": {
     "alg": "ed25519",
-    "public_key_b64": "aQDV4VkcZW9Doag0DhpOgoMlcYPFcC36S5SrpKrOnQE=",
-    "sig_b64": "Q0UXjBrfaA2w+pUNCQhY42UQuJRIiWkHw+iVQ/RXi3tMp7wFfjucLkcHM+Dog5WJULdgJ9A+vmXs1uxV1XNkAw=="
+    "public_key_b64": "GB+LMY2k3nnr1Cm64iVJLLMdiEstoP4DGflIXXN2/2Q=",
+    "sig_b64": "sgKuvyQ1j477RZ2MARU89S9oiopJkI7yfwRjeyTRj1P6N3N5rCMAEyMwhVvN5vupfwDo/CaJO/dVdZs3VribAA=="
   },
   "merkle": {
     "hash_alg": "sha256-rfc6962",
     "leaf_index": 0,
     "tree_size": 1,
     "inclusion_proof_b64": [],
-    "root_b64": "EjSMLMOQQmTnf6b7nWcAdJoURNgBG2RgvRVt4Yfz1Po="
+    "root_b64": "jaW3qlMpoFggIW4V2uP4mdPOw3prJdMP0Mc6BXihy2o="
   }
 }

proofbundle-3.8.0/docs/readiness_pack/proofbundle/readiness_pack.pub.b64

@@ -0,0 +1 @@
+GB+LMY2k3nnr1Cm64iVJLLMdiEstoP4DGflIXXN2/2Q=

{proofbundle-3.7.0 → proofbundle-3.8.0}/docs/readiness_pack/rust_parity_scope.md

@@ -24,7 +24,7 @@ python3 tools/pb_verify_rs/crosscheck.py --matrix audit_artifacts/360/rust_diffe
   negative (decoy-parent, subject-mismatch, signer, lineage tiers), Python == Rust on exit-class +
   lineage on every one
 
-The whole conformance corpus (54 cases) is reproduced independently by the Rust binary.
+The whole conformance corpus (57 cases as of v3.7.0; the `make conformance-crossimpl` gate reproduces 56/56 of its corpus cases) is reproduced independently by the Rust binary.
 
 ## Deliberately PENDING (honestly not Rust-covered, never silently accepted)
 

{proofbundle-3.7.0 → proofbundle-3.8.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "proofbundle"
-version = "3.7.0"
+version = "3.8.0"
 description = "Emit and verify portable cryptographic evidence bundles, offline: Ed25519 + RFC 6962 Merkle + optional SD-JWT."
 readme = "README.md"
 requires-python = ">=3.10"
@@ -96,7 +96,46 @@ test = ["pytest>=7", "hypothesis>=6", "PyYAML>=6", "jsonschema>=4", "sd-jwt>=0.1
 # test is bound to this range. Since v1.4.0 the project floor is Python 3.10, so no per-extra version
 # marker is needed here (inspect_ai's own >=3.10 requirement is always satisfiable on a supported base).
 inspect = ['inspect_ai>=0.3.112,<0.4']
-dev = ["pytest>=7", "ruff>=0.5", "jsonschema>=4", "mypy>=1.8", "build>=1", "hypothesis>=6",
+# ruff is bounded, but the bound is no longer what protects this repo — `[tool.ruff.lint] select`
+# is (see that section). The cap `<0.16` that stood here from 2026-07-31 to 2026-08-07 bought time
+# to find out WHY 0.16 turned a green tree red. It is now measured, and it was never our code:
+#
+#   ruff 0.16.0 expanded its DEFAULT rule set from 59 rules to 413 (Astral's v0.16.0 release; the
+#   default had been untouched since v0.1.0). Measured here on the identical tree @2e5807a:
+#     ruff 0.15.0 / 0.15.10 / 0.15.22 -> 59 default rules  -> exit 0 over all 258 tracked .py
+#     ruff 0.16.0 / 0.16.1 / 0.16.2   -> 413 default rules -> exit 1, 1168 findings
+#   Top rules, re-measured on that same tree with 0.16.0: RUF100 400, UP045 181, I001 163,
+#   RUF059 57, EXE001 40, PLW1510 37, BLE001 36, UP006 30. NONE of them was enabled in 0.15.
+#   (The earlier note here cited "E402 257" and "F401 72". Both are wrong: on that tree, with
+#   that ruff, E402 and F401 each find ZERO. The total, 1168, was right. Corrected 2026-08-07.)
+#
+# So the bound stays, but for a NARROWER and honestly smaller reason: `select` fixes WHICH rules
+# judge us, it cannot fix a change in what an individual rule MEANS. That residue is what `<0.17`
+# still covers, and it is a much cheaper thing to re-check than a 7x rule-set swing.
+#
+# mypy is `mypy src`, the OTHER blocking judge in ci.yml, and it was unbounded for the same reason
+# ruff was. Two things were measured on 2026-08-07 before this bound went in, and they point in
+# opposite directions, so both are stated:
+#
+#   NO FAILURE WAS FOUND. Every one of mypy 1.8.0 / 1.11.2 / 1.15.0 / 1.18.2 / 2.0.0 / 2.1.0 /
+#   2.2.0 / 2.3.0 exits 0 over `src` (63 files) — across BOTH major versions. So the declared
+#   floor `>=1.8` is not a guess, it is verified. That is the honest state and this bound does
+#   not pretend otherwise: it is prospective, not a fix for something broken.
+#
+#   THE MECHANISM IS REAL THOUGH. mypy changes CHECKING DEFAULTS at major versions: 2.0 turned on
+#   `--local-partial-types` and `--strict-bytes` (PEP 688: `bytearray`/`memoryview` no longer
+#   assignable to `bytes`) and redefined `--allow-redefinition`. This tree happens not to be
+#   sensitive to those three; the next major is a coin flip nobody has flipped yet.
+#
+# `<3` is therefore the granularity that matches where mypy actually moves, and it blocks nothing
+# today (2.3.0 is well under it). A bump is a deliberate act, like ruff's.
+#
+# HONEST CAVEAT ON HOW THE FLOOR WAS MEASURED: the first attempt ran each pinned mypy in a bare
+# venv and "found" that everything below 2.3 fails at pqsig.py:91. That was the measurement, not
+# the code — those venvs had no `cryptography`, so the `type: ignore[attr-defined]` on the
+# optional `slhdsa` import really is unused there. With the project's own dependency present, all
+# eight versions pass. A floor claim is only worth the environment it was measured in.
+dev = ["pytest>=7", "ruff>=0.5,<0.17", "jsonschema>=4", "mypy>=1.8,<3", "build>=1", "hypothesis>=6",
        "rfc8785>=0.1.4", "sd-jwt>=0.10", "PyYAML>=6", 'inspect_ai>=0.3.112,<0.4']
 
 [project.urls]
@@ -124,6 +163,47 @@ proofbundle = ["py.typed", "eee_eval_schema.json", "policies/*.json"]
 [tool.ruff]
 line-length = 100
 
+[tool.ruff.lint]
+# THE JUDGE'S CRITERIA ARE OURS, NOT THE VENDOR'S DEFAULT-OF-THE-DAY.
+#
+# `ruff check .` is a blocking CI step, so the set of enabled rules is an INPUT to a gate. Until
+# 2026-08-07 this file pinned only ruff's VERSION and left the rule SELECTION implicit, which meant
+# an upstream release could redefine what "green" means here without a line of our code changing.
+# It did: 0.16.0 took the default from 59 rules to 413. Capping the version deferred that; every
+# future cap raise would have replayed the same triage. Naming the rules removes the class.
+#
+# These four prefixes ARE the set that judged this repo through the whole 0.15 line — verified by
+# set comparison, not by eye: `--select E4,E7,E9,F` under 0.16.2 enables exactly the same 59 rules
+# that 0.15.0/0.15.10/0.15.22 enabled by default, and under that selection every one of
+# 0.15.0 / 0.15.10 / 0.15.22 / 0.16.0 / 0.16.1 / 0.16.2 exits 0 over all 258 tracked .py files.
+# This is also Astral's own documented way to keep the pre-0.16 behaviour.
+#
+# WHAT A PREFIX DOES NOT DO, said plainly because the sentence above reads stronger than it is:
+# a prefix is an OPEN set. `E4` means "every E4xx rule this ruff knows", not "these fifteen". A
+# future release can add a rule under one of these four prefixes and it is selected here without
+# anyone choosing it — the same shape of surprise as the 0.16 default swing, just narrower. So the
+# set equality above is a measurement AT a version, not a property of the config.
+#   Measured across the whole declared range (0.5.0, 0.15.0, 0.15.22, 0.16.0, 0.16.2), membership
+#   under these four prefixes: 0 rules added, 1 removed (E999, deprecated as a selectable rule).
+#   Eleven minor releases, no growth. That is evidence about the past, not a guarantee.
+# THIS is the residue the version bound in [project.optional-dependencies] actually catches, and it
+# is a better reason for that bound than the rule-semantics drift also named there. Enumerating all
+# 59 rule IDs would close it completely, at the cost of a config nobody re-reads; the bound plus a
+# deliberate bump was chosen instead. If that bump ever gets rubber-stamped, this trade is void.
+#
+# THE HALF THAT IS EASY TO MISS: 0.16 did not only ADD rules, it DROPPED 18 from the default —
+# E401 E402 E701 E702 E703 E711 E712 E713 E714 E721 E731 E741 E742 E743 F403 F405 F406 F722.
+# Among them `== None` (E711), `== True` (E712), type comparison by `==` (E721) and star-import
+# leakage (F403/F405). Simply raising the cap would have SILENTLY STOPPED checking all eighteen,
+# and nothing would have shown it: the finding count goes UP, so the regression hides inside an
+# apparent tightening. All eighteen sit inside the E4/E7/E9/F prefixes below, so they keep being
+# checked here. (Upstream has an open issue that this removal never reached BREAKING_CHANGES.md.)
+#
+# EXPANDING this set is a separate, deliberate task with its own diff — several of the 372 newly
+# defaulted rules look worth adopting. The point of naming the set is that adopting them becomes a
+# decision we make, at a time we choose, instead of one a `pip install` makes for us.
+select = ["E4", "E7", "E9", "F"]
+
 [tool.mypy]
 python_version = "3.10"
 files = ["src"]