proofbundle 4.0.0__tar.gz → 5.1.0__tar.gz

{proofbundle-4.0.0 → proofbundle-5.1.0}/MANIFEST.in

@@ -25,6 +25,32 @@ graft conformance
 graft formal
 graft docs/readiness_pack
 include docs/adr/renewal_policy.example.json
+
+# PB-2026-0831-01: the receipt-envelope profile and its vectors landed on main in #159, but the
+# profile document itself was NOT in the sdist and NOT in the wheel — measured, 0 hits in both.
+# NO prune or exclude rule removed it. MANIFEST.in is an allowlist and the file was simply not on
+# any line; it was missing by absence, not by exclusion. That distinction matters: looking for the
+# offending prune rule would have found nothing and left the file out.
+#
+# The vectors under conformance/envelope_profile/ were already shipped by `graft conformance`
+# (21 of 21 files, 10 of 10 case.json, measured). Only the prose document was missing, and it is
+# the half a reader needs to know what the vectors prove.
+#
+# Named by exact path rather than `graft docs`, for the same reason the ADR example above is: a
+# blanket graft would also ship documents whose internal links point at pruned repo files, which
+# breaks test_docs_truth from the sdist.
+include docs/RECEIPT_ENVELOPE_PROFILE.md
+# Same reason, measured 01.09.2026: 14 conformance cases under conformance/agent_review/
+# cite this file NORMATIVELY (`specRef`), and it was not shipped — the corpus referred to a
+# document the installed package did not contain. It carries no local links, so it cannot
+# break test_docs_truth the way a `graft docs` would.
+include docs/AGENT_REVIEW_PREDICATE.md
+# PB-2026-0902-01: der sdist enthielt `conformance/` (94 Faelle, `graft conformance`), aber NICHT
+# das Makefile, ueber das die Doku den Korpus fahren laesst. Wer den sdist auspackt und
+# `make conformance` ruft, bekommt "No rule to make target" — der Korpus ist da und
+# unerreichbar. Gefunden von der as-shipped-Linse des Tiefen-Gates am 02.09.2026. Wie schon bei
+# `RECEIPT_ENVELOPE_PROFILE.md`: keine prune-Regel entfernte es, es stand auf keiner Zeile.
+include Makefile
 graft scripts
 
 # Never ship: the Rust verifier + build artifacts, repo/CI meta, caches, VCS, big review packs.

proofbundle-5.1.0/Makefile

@@ -0,0 +1,71 @@
+.PHONY: test lint typecheck demo tamper-demo persample-demo full-demo mutation examples conformance conformance-crossimpl all coverage
+
+PYTHON ?= python3
+
+# EIN ZIEL, DAS IM AUSGELIEFERTEN ZUSTAND NICHT LAUFEN KANN, MUSS DAS SAGEN — nicht scheitern.
+#
+# GEMESSEN am 02.09.2026 (adversariale as-shipped-Linse): `include Makefile` machte alle 13 Ziele
+# zu ausgelieferten Versprechen. Sieben laufen aus dem sdist nicht, und `conformance-crossimpl`
+# scheiterte an einem fehlenden Verzeichnis, waehrend sein Kommentar "needs cargo" sagte — die
+# falsche Vorbedingung. `prune tools` ist richtig; die MELDUNG war es nicht.
+#
+# Der Wachtposten ist EINE Zeile je Ziel und nennt die Vorbedingung im Klartext, statt eine
+# Shell-Fehlermeldung ueber ein fehlendes Verzeichnis zu produzieren.
+# EIN SHELL-AUFRUF, kein zweizeiliger Wachtposten.
+#
+# Die erste Fassung war eine EIGENE Rezeptzeile mit `|| { echo …; exit 0; }`. Gemessen aus dem
+# entpackten sdist: sie meldete die Vorbedingung KORREKT — und make fuhr die naechste Zeile
+# trotzdem, weil jede Rezeptzeile ihre eigene Shell hat und `exit 0` nur diese verlaesst. Das Ziel
+# scheiterte danach genau wie vorher, jetzt nur mit einer beruhigenden Zeile davor. Ein Riegel,
+# der ankuendigt und dann durchlaesst, ist schlimmer als keiner. Deshalb umschliesst die Bedingung
+# den GANZEN Rumpf in EINER Zeile.
+CHECKOUT_FEHLT = echo "== $@: skipped — needs a source checkout, not the shipped package."; \
+	echo "   Why:  tools/ and .github/ are deliberately pruned from the sdist (MANIFEST.in)."; \
+	echo "   How:  run this target from a source checkout of the repository."
+
+test:  ## needs pytest (in the [test] extra) — it is the only runner that sees this suite
+	$(PYTHON) -m pytest -q
+
+lint:  ## needs `pip install ruff` — deliberately NOT in the [test] extra
+	ruff check .
+
+typecheck:  ## needs `pip install mypy` — deliberately NOT in the [test] extra
+	$(PYTHON) -m mypy src
+
+demo:  ## pip-only, offline: honest receipt verifies, tampers fail, sample swap caught (in memory)
+	PYTHONPATH=src $(PYTHON) -m proofbundle.cli demo
+
+tamper-demo:  ## the demo with an exit-code contract (fails if any guarantee breaks)
+	bash scripts/demo_tamper.sh
+
+persample-demo:  ## offline forced-random-sample audit walkthrough
+	$(PYTHON) examples/persample_audit.py
+
+full-demo:  ## real eval logs -> signed receipts -> verified OK (needs [eval,inspect] extras)
+	bash scripts/demo.sh
+
+mutation:  ## anti-Goodhart gate: the tests must KILL broken implementations (needs a source checkout: it walks the tracked file list)
+	@if [ -d tools ] && [ -d .github ]; then $(PYTHON) scripts/mutation_check.py; \
+	else $(CHECKOUT_FEHLT); fi
+
+coverage:  ## line coverage of the core over the test suite (needs `pip install coverage`)
+	$(PYTHON) -m coverage run -m pytest -q
+	$(PYTHON) -m coverage report -m --include="src/proofbundle/*"
+
+examples:  ## run every offline example (those without optional extras)
+	@for f in examples/make_example.py examples/lm_eval_receipt.py examples/eee_receipt.py \
+	          examples/intoto_dsse_export.py examples/checkpoint_example.py \
+	          examples/tlog_proof_example.py examples/rekor_interop.py \
+	          examples/persample_audit.py; do \
+		echo "== $$f =="; PYTHONPATH=src $(PYTHON) $$f || exit 1; done
+
+conformance:  ## offline conformance corpus (anchor sub-checks need the [anchors] extra)
+	PYTHONPATH=src $(PYTHON) conformance/run_conformance.py
+
+conformance-crossimpl:  ## cross-impl acceptance gate: the independent Rust second-verifier must AGREE with Python over the verifier core (needs a source checkout AND cargo; #55 S2)
+	@if [ -d tools ] && [ -d .github ]; then \
+		( cd tools/pb_verify_rs && cargo build --release ) && \
+		PYTHONPATH=src $(PYTHON) tools/pb_verify_rs/crosscheck.py; \
+	else $(CHECKOUT_FEHLT); fi
+
+all: lint typecheck test  ## needs ruff + mypy; from the shipped package run `make test` alone

{proofbundle-4.0.0/src/proofbundle.egg-info → proofbundle-5.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofbundle
-Version: 4.0.0
+Version: 5.1.0
 Summary: Emit and verify portable cryptographic evidence bundles, offline: Ed25519 + RFC 6962 Merkle + optional SD-JWT.
 Author: Konrad Gruszka
 License: MIT
@@ -51,7 +51,7 @@ Requires-Dist: jsonschema>=4; extra == "test"
 Requires-Dist: sd-jwt>=0.10; extra == "test"
 Requires-Dist: rfc8785>=0.1.4; extra == "test"
 Provides-Extra: inspect
-Requires-Dist: inspect_ai<0.4,>=0.3.112; extra == "inspect"
+Requires-Dist: inspect_ai<=0.3.261,>=0.3.112; extra == "inspect"
 Provides-Extra: dev
 Requires-Dist: pytest>=7; extra == "dev"
 Requires-Dist: ruff<0.17,>=0.5; extra == "dev"
@@ -62,7 +62,7 @@ Requires-Dist: hypothesis>=6; extra == "dev"
 Requires-Dist: rfc8785>=0.1.4; extra == "dev"
 Requires-Dist: sd-jwt>=0.10; extra == "dev"
 Requires-Dist: PyYAML>=6; extra == "dev"
-Requires-Dist: inspect_ai<0.4,>=0.3.112; extra == "dev"
+Requires-Dist: inspect_ai<=0.3.261,>=0.3.112; extra == "dev"
 Dynamic: license-file
 
 <div align="center">
@@ -74,12 +74,6 @@ Dynamic: license-file
 
 <h1>proofbundle</h1>
 
-**AI eval results need receipts.**
-
-Turn an AI evaluation result into one portable, offline-verifiable receipt. It proves *who signed
-these exact bytes* and *that nothing changed since* — not that the number is true. Ed25519 + RFC 6962
-Merkle, one file, no server, no network.
-
 [![CI](https://github.com/b7n0de/proofbundle/actions/workflows/ci.yml/badge.svg)](https://github.com/b7n0de/proofbundle/actions/workflows/ci.yml)
 [![demo reproducible](https://github.com/b7n0de/proofbundle/actions/workflows/demo-reproducible.yml/badge.svg)](https://github.com/b7n0de/proofbundle/actions/workflows/demo-reproducible.yml)
 [![PyPI](https://img.shields.io/pypi/v/proofbundle.svg)](https://pypi.org/project/proofbundle/)
@@ -90,10 +84,48 @@ Merkle, one file, no server, no network.
 
 Scorecard **6.5/10** — [what the four zeros mean, in one sentence each](#what-the-scorecard-badge-says-including-the-parts-that-are-low)
 
+**AI eval results need receipts.**
+
+Turn an AI evaluation result into one portable, offline-verifiable receipt. It proves *who signed
+these exact bytes* and *that nothing changed since* — not that the number is true. Ed25519 + RFC 6962
+Merkle, one file, no server, no network.
+
 **Reviewing this for adoption?** Start with the 30-minute adversarial audit path: **[docs/REVIEWERS.md](https://github.com/b7n0de/proofbundle/blob/main/docs/REVIEWERS.md)**.
 
 </div>
 
+## Install
+
+```bash
+pip install proofbundle                 # core: offline verify + plain emit (two deps: cryptography, rfc8785)
+pip install "proofbundle[eval]"          # + eval receipts, prereg, and the demo (RFC 8785 JCS canonicalizer)
+pip install "proofbundle[inspect]"      # inspect_ai adapter + hook
+pip install "proofbundle[pq]"           # verify ML-DSA-44 (post-quantum) witness cosignatures
+```
+
+Requires Python 3.10+. The verify path never rolls its own crypto — Ed25519 comes from
+`cryptography`; Merkle hashing is RFC 6962.
+
+## 60-second try (offline)
+
+```bash
+pip install "proofbundle[eval]"
+proofbundle demo   # honest receipt => OK, six tampers each => FAILED, sample swap caught
+```
+
+The demo runs entirely in memory and exits non-zero if any tamper slips through, so it doubles as a
+self-test.
+
+```bash
+# verify a real hosted receipt without writing any code — the verify runs fully offline:
+curl -fsSL https://raw.githubusercontent.com/b7n0de/proofbundle/main/examples/example_bundle.json -o receipt.json
+proofbundle verify receipt.json        # CRYPTO: OK   (exit 0 ok · 1 fail · 2 malformed · 3 policy)
+```
+
+Emit your own receipt, apply a trust policy, start from a shipped template, or run the Inspect-native
+path (METR Task Standard / UK-AISI ecosystem, mockllm, no API key): **[docs/DEMO.md](https://github.com/b7n0de/proofbundle/blob/main/docs/DEMO.md)** ·
+Inspect walkthrough **[docs/INSPECT_HAPPY_PATH.md](https://github.com/b7n0de/proofbundle/blob/main/docs/INSPECT_HAPPY_PATH.md)**.
+
 ## What the Scorecard badge says, including the parts that are low
 
 The badge is live, so it will move. Measured 2026-08-07, re-measured 2026-08-10 with identical
@@ -128,26 +160,6 @@ measured and not yet addressed.
 Publishing a middling number with its causes is the point. A project that sells evidence cannot
 withhold its own.
 
-## 60-second try (offline)
-
-```bash
-pip install "proofbundle[eval]"
-proofbundle demo   # honest receipt => OK, six tampers each => FAILED, sample swap caught
-```
-
-The demo runs entirely in memory and exits non-zero if any tamper slips through, so it doubles as a
-self-test.
-
-```bash
-# verify a real hosted receipt without writing any code — the verify runs fully offline:
-curl -fsSL https://raw.githubusercontent.com/b7n0de/proofbundle/main/examples/example_bundle.json -o receipt.json
-proofbundle verify receipt.json        # CRYPTO: OK   (exit 0 ok · 1 fail · 2 malformed · 3 policy)
-```
-
-Emit your own receipt, apply a trust policy, start from a shipped template, or run the Inspect-native
-path (METR Task Standard / UK-AISI ecosystem, mockllm, no API key): **[docs/DEMO.md](https://github.com/b7n0de/proofbundle/blob/main/docs/DEMO.md)** ·
-Inspect walkthrough **[docs/INSPECT_HAPPY_PATH.md](https://github.com/b7n0de/proofbundle/blob/main/docs/INSPECT_HAPPY_PATH.md)**.
-
 ## The problem
 
 Every AI eval number you read — a safety benchmark, a capability score, a leaderboard entry — is an
@@ -236,18 +248,6 @@ version history (see also [CHANGELOG.md](https://github.com/b7n0de/proofbundle/b
   separation (executor ≠ decision maker) — never a claim that the decision was correct.
   [decision-receipt.md](https://github.com/b7n0de/proofbundle/blob/main/docs/predicates/decision-receipt.md) · [action-outcome.md](https://github.com/b7n0de/proofbundle/blob/main/docs/predicates/action-outcome.md)
 
-## Install
-
-```bash
-pip install proofbundle                 # core: offline verify + plain emit (two deps: cryptography, rfc8785)
-pip install "proofbundle[eval]"          # + eval receipts, prereg, and the demo (RFC 8785 JCS canonicalizer)
-pip install "proofbundle[inspect]"      # inspect_ai adapter + hook
-pip install "proofbundle[pq]"           # verify ML-DSA-44 (post-quantum) witness cosignatures
-```
-
-Requires Python 3.10+. The verify path never rolls its own crypto — Ed25519 comes from
-`cryptography`; Merkle hashing is RFC 6962.
-
 ## Post-quantum posture (honest)
 
 proofbundle is **not** "quantum-safe" as a whole. Its hash-based layers (SHA-256, RFC 6962 / 9162
@@ -264,7 +264,8 @@ a post-quantum *payload* signature is on the roadmap. Detail: [docs/ANCHORS.md](
 If proofbundle helped your evaluation pipeline, please cite it. Machine-readable metadata is in
 [`CITATION.cff`](https://github.com/b7n0de/proofbundle/blob/main/CITATION.cff). The archival software record is on Zenodo under concept
 DOI [10.5281/zenodo.21110642](https://doi.org/10.5281/zenodo.21110642); the Technical Note (design write-up) under concept DOI
-[10.5281/zenodo.21230466](https://doi.org/10.5281/zenodo.21230466), also linked from [b7n0de.com/proofbundle](https://b7n0de.com/proofbundle).
+[10.5281/zenodo.21230466](https://doi.org/10.5281/zenodo.21230466) — version 4.0.0 of the Note is
+[10.5281/zenodo.22004295](https://doi.org/10.5281/zenodo.22004295) — also linked from [b7n0de.com/proofbundle](https://b7n0de.com/proofbundle).
 
 ## Docs
 

{proofbundle-4.0.0 → proofbundle-5.1.0}/README.md

@@ -7,12 +7,6 @@
 
 <h1>proofbundle</h1>
 
-**AI eval results need receipts.**
-
-Turn an AI evaluation result into one portable, offline-verifiable receipt. It proves *who signed
-these exact bytes* and *that nothing changed since* — not that the number is true. Ed25519 + RFC 6962
-Merkle, one file, no server, no network.
-
 [![CI](https://github.com/b7n0de/proofbundle/actions/workflows/ci.yml/badge.svg)](https://github.com/b7n0de/proofbundle/actions/workflows/ci.yml)
 [![demo reproducible](https://github.com/b7n0de/proofbundle/actions/workflows/demo-reproducible.yml/badge.svg)](https://github.com/b7n0de/proofbundle/actions/workflows/demo-reproducible.yml)
 [![PyPI](https://img.shields.io/pypi/v/proofbundle.svg)](https://pypi.org/project/proofbundle/)
@@ -23,10 +17,48 @@ Merkle, one file, no server, no network.
 
 Scorecard **6.5/10** — [what the four zeros mean, in one sentence each](#what-the-scorecard-badge-says-including-the-parts-that-are-low)
 
+**AI eval results need receipts.**
+
+Turn an AI evaluation result into one portable, offline-verifiable receipt. It proves *who signed
+these exact bytes* and *that nothing changed since* — not that the number is true. Ed25519 + RFC 6962
+Merkle, one file, no server, no network.
+
 **Reviewing this for adoption?** Start with the 30-minute adversarial audit path: **[docs/REVIEWERS.md](https://github.com/b7n0de/proofbundle/blob/main/docs/REVIEWERS.md)**.
 
 </div>
 
+## Install
+
+```bash
+pip install proofbundle                 # core: offline verify + plain emit (two deps: cryptography, rfc8785)
+pip install "proofbundle[eval]"          # + eval receipts, prereg, and the demo (RFC 8785 JCS canonicalizer)
+pip install "proofbundle[inspect]"      # inspect_ai adapter + hook
+pip install "proofbundle[pq]"           # verify ML-DSA-44 (post-quantum) witness cosignatures
+```
+
+Requires Python 3.10+. The verify path never rolls its own crypto — Ed25519 comes from
+`cryptography`; Merkle hashing is RFC 6962.
+
+## 60-second try (offline)
+
+```bash
+pip install "proofbundle[eval]"
+proofbundle demo   # honest receipt => OK, six tampers each => FAILED, sample swap caught
+```
+
+The demo runs entirely in memory and exits non-zero if any tamper slips through, so it doubles as a
+self-test.
+
+```bash
+# verify a real hosted receipt without writing any code — the verify runs fully offline:
+curl -fsSL https://raw.githubusercontent.com/b7n0de/proofbundle/main/examples/example_bundle.json -o receipt.json
+proofbundle verify receipt.json        # CRYPTO: OK   (exit 0 ok · 1 fail · 2 malformed · 3 policy)
+```
+
+Emit your own receipt, apply a trust policy, start from a shipped template, or run the Inspect-native
+path (METR Task Standard / UK-AISI ecosystem, mockllm, no API key): **[docs/DEMO.md](https://github.com/b7n0de/proofbundle/blob/main/docs/DEMO.md)** ·
+Inspect walkthrough **[docs/INSPECT_HAPPY_PATH.md](https://github.com/b7n0de/proofbundle/blob/main/docs/INSPECT_HAPPY_PATH.md)**.
+
 ## What the Scorecard badge says, including the parts that are low
 
 The badge is live, so it will move. Measured 2026-08-07, re-measured 2026-08-10 with identical
@@ -61,26 +93,6 @@ measured and not yet addressed.
 Publishing a middling number with its causes is the point. A project that sells evidence cannot
 withhold its own.
 
-## 60-second try (offline)
-
-```bash
-pip install "proofbundle[eval]"
-proofbundle demo   # honest receipt => OK, six tampers each => FAILED, sample swap caught
-```
-
-The demo runs entirely in memory and exits non-zero if any tamper slips through, so it doubles as a
-self-test.
-
-```bash
-# verify a real hosted receipt without writing any code — the verify runs fully offline:
-curl -fsSL https://raw.githubusercontent.com/b7n0de/proofbundle/main/examples/example_bundle.json -o receipt.json
-proofbundle verify receipt.json        # CRYPTO: OK   (exit 0 ok · 1 fail · 2 malformed · 3 policy)
-```
-
-Emit your own receipt, apply a trust policy, start from a shipped template, or run the Inspect-native
-path (METR Task Standard / UK-AISI ecosystem, mockllm, no API key): **[docs/DEMO.md](https://github.com/b7n0de/proofbundle/blob/main/docs/DEMO.md)** ·
-Inspect walkthrough **[docs/INSPECT_HAPPY_PATH.md](https://github.com/b7n0de/proofbundle/blob/main/docs/INSPECT_HAPPY_PATH.md)**.
-
 ## The problem
 
 Every AI eval number you read — a safety benchmark, a capability score, a leaderboard entry — is an
@@ -169,18 +181,6 @@ version history (see also [CHANGELOG.md](https://github.com/b7n0de/proofbundle/b
   separation (executor ≠ decision maker) — never a claim that the decision was correct.
   [decision-receipt.md](https://github.com/b7n0de/proofbundle/blob/main/docs/predicates/decision-receipt.md) · [action-outcome.md](https://github.com/b7n0de/proofbundle/blob/main/docs/predicates/action-outcome.md)
 
-## Install
-
-```bash
-pip install proofbundle                 # core: offline verify + plain emit (two deps: cryptography, rfc8785)
-pip install "proofbundle[eval]"          # + eval receipts, prereg, and the demo (RFC 8785 JCS canonicalizer)
-pip install "proofbundle[inspect]"      # inspect_ai adapter + hook
-pip install "proofbundle[pq]"           # verify ML-DSA-44 (post-quantum) witness cosignatures
-```
-
-Requires Python 3.10+. The verify path never rolls its own crypto — Ed25519 comes from
-`cryptography`; Merkle hashing is RFC 6962.
-
 ## Post-quantum posture (honest)
 
 proofbundle is **not** "quantum-safe" as a whole. Its hash-based layers (SHA-256, RFC 6962 / 9162
@@ -197,7 +197,8 @@ a post-quantum *payload* signature is on the roadmap. Detail: [docs/ANCHORS.md](
 If proofbundle helped your evaluation pipeline, please cite it. Machine-readable metadata is in
 [`CITATION.cff`](https://github.com/b7n0de/proofbundle/blob/main/CITATION.cff). The archival software record is on Zenodo under concept
 DOI [10.5281/zenodo.21110642](https://doi.org/10.5281/zenodo.21110642); the Technical Note (design write-up) under concept DOI
-[10.5281/zenodo.21230466](https://doi.org/10.5281/zenodo.21230466), also linked from [b7n0de.com/proofbundle](https://b7n0de.com/proofbundle).
+[10.5281/zenodo.21230466](https://doi.org/10.5281/zenodo.21230466) — version 4.0.0 of the Note is
+[10.5281/zenodo.22004295](https://doi.org/10.5281/zenodo.22004295) — also linked from [b7n0de.com/proofbundle](https://b7n0de.com/proofbundle).
 
 ## Docs