proofbundle 6.0.0__tar.gz → 6.1.0__tar.gz

proofbundle-6.1.0/MANIFEST.in

@@ -0,0 +1,174 @@
+# PB-2026-0717-02: the published sdist shipped tests/ WITHOUT their runtime assets (fixtures, schemas,
+# examples, conformance corpus, formal-model results, the scripts the tests invoke) → the full sdist
+# pytest aborted with collection errors. This allowlist grafts exactly the assets the shipped tests need
+# to COLLECT AND RUN.
+#
+# Self-testable, honestly (PKG-2026-0718-01 / RE-GATE): `pip install <sdist> && pytest` runs the
+# package-level suite green. A documented subset of tests assert facts about the REPO/CI/Rust/docs LAYOUT
+# (`.github/workflows` contents, the Rust verifier source under `tools/`, `SPEC.md`/`CITATION.cff`, audit
+# records) — material this allowlist DELIBERATELY prunes (not a Python-package artifact). Those repo-context
+# tests SKIP outside a git checkout (tests/conftest.py::_REPO_CONTEXT_TESTS) rather than fail, so a
+# from-sdist run is clean — the honest form of "self-testable" (package tests run; repo-layout tests declare
+# themselves N/A).
+#
+# Per-directory allowlist (Befund C: not `package-data` — that targets the wheel/import package; the
+# sdist is the right vehicle for top-level tests/ + their assets). Large / non-Python-sdist material is
+# pruned: `tools/` is the Rust verifier + its 138M build tree (Rust runs from a git checkout with a
+# toolchain, never from the Python sdist — a category error to ship it), and build/CI-meta is excluded.
+# The shipped-example policy tests/test_renewal_policy.py loads is included by exact path (PKG-2026-0718-02)
+# — NOT `graft docs/adr`, which would also ship the ADR markdowns whose internal links reference pruned
+# repo files (breaking test_docs_truth from the sdist).
+graft tests
+graft schemas
+graft examples
+graft conformance
+graft formal
+graft docs/readiness_pack
+include docs/adr/renewal_policy.example.json
+
+# PB-2026-0831-01: the receipt-envelope profile and its vectors landed on main in #159, but the
+# profile document itself was NOT in the sdist and NOT in the wheel — measured, 0 hits in both.
+# NO prune or exclude rule removed it. MANIFEST.in is an allowlist and the file was simply not on
+# any line; it was missing by absence, not by exclusion. That distinction matters: looking for the
+# offending prune rule would have found nothing and left the file out.
+#
+# The vectors under conformance/envelope_profile/ were already shipped by `graft conformance`
+# (21 of 21 files, 10 of 10 case.json, measured). Only the prose document was missing, and it is
+# the half a reader needs to know what the vectors prove.
+#
+# Named by exact path rather than `graft docs`, for the same reason the ADR example above is: a
+# blanket graft would also ship documents whose internal links point at pruned repo files, which
+# breaks test_docs_truth from the sdist.
+include docs/RECEIPT_ENVELOPE_PROFILE.md
+# Same reason, re-derived by tests/test_shipped_comment_numbers.py: 35 conformance cases under
+# conformance/agent_review/ (first written as 14 on 01.09.2026, already wrong then)
+# cite this file NORMATIVELY (`specRef`), and it was not shipped — the corpus referred to a
+# document the installed package did not contain. It carries no local links, so it cannot
+# break test_docs_truth the way a `graft docs` would.
+include docs/AGENT_REVIEW_PREDICATE.md
+# P19 (6.1.0): der Vertrag zum Verifier-Block. Fuenf Konformanzfaelle nennen ihn normativ
+# (specRefs), und ein Dokument, das ein Fall nennt, liegt auch im Paket vor -- sonst waechst die
+# Luecke, die conformance/unshipped_spec_refs_baseline.json festschreibt. Keine lokalen Links
+# auf geprunte Dateien, damit test_docs_truth aus der sdist besteht.
+include docs/VERIFIER_BLOCK.md
+# PB-2026-0902-01: der sdist enthielt `conformance/` (94 Faelle, `graft conformance`), aber NICHT
+# das Makefile, ueber das die Doku den Korpus fahren laesst. Wer den sdist auspackt und
+# `make conformance` ruft, bekommt "No rule to make target" — der Korpus ist da und
+# unerreichbar. Gefunden von der as-shipped-Linse des Tiefen-Gates am 02.09.2026. Wie schon bei
+# `RECEIPT_ENVELOPE_PROFILE.md`: keine prune-Regel entfernte es, es stand auf keiner Zeile.
+include Makefile
+# AUFLAGE des Owners 2026-09-06 zur Karte OA-8b1a31cc4f, Auflage 1: `graft scripts` ist durch eine
+# AUSDRUECKLICHE Liste ersetzt. Ein graft ist eine Vollmacht auf alles, was kuenftig in dem Ordner
+# landet — auch auf ein Signierwerkzeug, das noch niemand geschrieben hat. Eine Liste ist eine
+# Entscheidung je Datei, und eine neue Datei muss hier auftauchen, bevor sie ausgeliefert wird.
+#
+# DRAUSSEN, und warum (gemessen 2026-09-06, AST-Suche nach einem schluessel-LESENDEN Codepfad):
+#   scripts/pre_tag_receipt.py      liest `Ed25519PrivateKey.from_private_bytes` ueber --privkey-file.
+#                                   Der Modus BLEIBT im Repo — er ist der Owner-Signierweg am Mac
+#                                   (Owner-Entscheid 2026-09-06) — aber er wird nicht ausgeliefert.
+#   scripts/gen_findings_register.py liest denselben Weg aus Umgebung oder Datei.
+#
+# DRIN, obwohl der Name anderes vermuten laesst: scripts/sign_readiness_artifact.py. Gemessen traegt
+# es KEINEN Codepfad, der einen privaten Schluessel liest — nur `Ed25519PublicKey` zum PRUEFEN einer
+# extern erzeugten Signatur. Es emittiert kanonische Bytes und setzt eine fremde Signatur zusammen;
+# selbst beglaubigen kann es nichts. Es aus dem sdist zu nehmen haette ausserdem
+# `audit_candidate_matrix.py` gebrochen, das seinen `tree_digest` importiert, und mit ihm zehn
+# ausgelieferte Testdateien. Der Riegel dagegen ist nicht die Abwesenheit der Datei, sondern
+# `tests/test_sdist_ohne_signierwerkzeug.py`: er misst die sdist-Dateiliste und wird rot, sobald
+# darin ein Skript einen privaten Schluessel liest — per AST, damit eine Erwaehnung im Docstring
+# nicht als Codepfad zaehlt.
+# NICHT NUR PYTHON, und das war eine Luecke dieser Liste selbst (gefunden am 06.09.2026 durch
+# den Probe-Merge der vier Lanes). `graft scripts` lieferte ALLES unter dem Ordner aus; die erste
+# Fassung dieser Liste entschied nur ueber `*.py`, und damit fielen fuenf Dateien still heraus.
+# Zwei davon liest ein AUSGELIEFERTES Skript (`rust_parity_gate.py:58` die Registry,
+# `mutation_check.py:716` die Gewichte), zwei ruft ein AUSGELIEFERTES Makefile-Ziel
+# (`make demo`, `make demo-tamper`). Ein Skript ohne seine Datendatei ist kein Skript.
+#
+# DRAUSSEN und ausdruecklich entschieden: scripts/required_check_reachability_gate.py. Es liest
+# `.github/workflows/*.yml` und `.github/required_status_checks.json`; beides faellt unten unter
+# `prune .github`. Im Paket faende es also kein einziges Workflow-File und muesste daraus ein
+# Urteil bilden — die Abwesenheit einer Eingabe als Ergebnis zu nehmen ist genau der Fehler,
+# gegen den das Skript gebaut ist. Es gehoert in den Checkout und in CI, nicht in die sdist.
+#
+# DRAUSSEN und ausdruecklich entschieden: scripts/required_context_presence_gate.py. Es fragt
+# die GitHub-API nach den Rulesets des Repositoriums und nach den check-runs eines Kopfes; beides
+# gibt es nur dort, wo dieses Repositorium als Repositorium existiert. Im Paket haette es weder
+# Ruleset noch Kopf und muesste aus zwei fehlenden Eingaben ein Urteil bilden — derselbe Grund,
+# aus dem sein Geschwister `required_check_reachability_gate.py` draussen steht, und genau der
+# Fehler, gegen den beide gebaut sind. Es gehoert in den Checkout und in CI, nicht in die sdist.
+#
+# DRAUSSEN und ausdruecklich entschieden: scripts/install_git_hooks.sh — seine Verbraucher sind der
+# git-Hook des Checkouts und der CI-Kanal, beides gibt es im sdist nicht.
+#
+# DRIN, und zwingend statt abgewogen: scripts/b7_historie.py. scripts/audit_candidate_matrix.py:707
+# importiert daraus `historie_abgeschnitten`, und audit_candidate_matrix.py ist SELBST ausgeliefert
+# (Zeile weiter unten). Ein ausgeliefertes Skript, dessen Import im Paket fehlt, bricht bei dem, der
+# es benutzt — nicht bei uns. Dazu laden drei ausgelieferte Testdateien es ueber
+# spec_from_file_location; sie umgehen den blanken Modul-Import ausdruecklich, weil scripts/ im
+# entpackten sdist nicht auf sys.path liegt, brauchen aber die DATEI.
+# DRIN, und die Entscheidung ist GEMESSEN statt geraten: scripts/b7_paketinhalt_ohne_schluesselmaterial.py.
+# Der erste Reflex war, ihn wie budget_axis_measurement.py als Freigabe-Beweismittel dieses Repos zu
+# fuehren und draussen zu lassen — ein Riegel fuer den Bauweg klingt nach Werkbank, nicht nach
+# Paket-Faehigkeit. Die Messung entscheidet anders: tests/test_paketinhalt_ohne_schluesselmaterial.py
+# laedt das Skript auf MODULEBENE ueber spec_from_file_location und exec_module, ohne Schutz. Fehlt
+# es im sdist, ist das kein Skip, sondern ein Collection-Error beim Nutzer — genau PB-2026-0717-02
+# aus Zeile 1 dieser Datei. Die Regel steht dort schon: die Skripte, die die Tests aufrufen, gehoeren
+# in den sdist. Dass er dabei seine eigenen Muster mitliefert, ist bedacht: der Riegel nimmt genau
+# eine Datei aus, sich selbst (EIGENER_PFAD), und zwar praefix-tolerant, weil im sdist jeder Pfad
+# unter proofbundle-<version>/ liegt.
+include scripts/demo.sh
+include scripts/demo_tamper.sh
+include scripts/mutation_shard_weights.json
+include scripts/rust_parity_registry.json
+include scripts/_build_anchor_fixture.py
+include scripts/audit_candidate_matrix.py
+include scripts/audit_output_aufloesbar.py
+include scripts/b7_historie.py
+include scripts/b7_paketinhalt_ohne_schluesselmaterial.py
+include scripts/branch_base_check.py
+include scripts/build_reproducible.py
+include scripts/check_version_and_changelog.py
+include scripts/claims_hygiene_check.py
+include scripts/doc_link_check.py
+include scripts/finding_base_drift.py
+include scripts/findings_register.py
+include scripts/fork_pr_secret_isolation.py
+include scripts/fuzz_soak.py
+include scripts/gate_qualification_harness.py
+include scripts/gen_synthetic_ots_fixture.py
+include scripts/mutant_signature_guard.py
+include scripts/mutation_check.py
+include scripts/mutation_operators_fresh.py
+include scripts/pre_tag_attestation.py
+include scripts/pre_tag_audit_gate.py
+include scripts/pre_tag_receipt_lib.py
+include scripts/readiness_pack_gate.py
+include scripts/readiness_pack_manifest.py
+include scripts/release_text_hygiene.py
+include scripts/render_demo.py
+include scripts/rust_parity_gate.py
+include scripts/shipped_docs_check.py
+include scripts/sign_readiness_artifact.py
+include scripts/test_manifest_gate.py
+include scripts/type_confusion_gate.py
+# P19 (6.1.0): der Pruefer fuer Dritte. Er liest nur oeffentliche Schluessel und Commit-Blobs,
+# traegt keinen schluessel-lesenden Codepfad, und der Vertrag
+# tests/test_verify_pre_tag_receipt_third_party.py ruft ihn -- die Skripte, die die Tests
+# aufrufen, gehoeren in den sdist (Zeile 1 dieser Datei).
+include scripts/verify_pre_tag_receipt.py
+
+# Never ship: the Rust verifier + build artifacts, repo/CI meta, caches, VCS, big review packs.
+prune tools
+prune audit_artifacts
+prune .github
+prune target
+global-exclude __pycache__
+global-exclude *.py[cod]
+global-exclude *.so
+global-exclude *.rs
+global-exclude *.orig
+# Die sechs v0.1-Receipts und die zwei v0.2-Receipts: tests/test_agent_review_v01_regression.py
+# liest sie als Regression gegen die unter 5.1.0 gemessenen Urteile. Ohne diese Zeile stand das
+# Modul in der sdist als repo-context und uebersprang alle 20 Faelle (Linse 3 auf PR 185,
+# FUND-1) — dieselbe Klasse wie PB-2026-0717-02, PB-2026-0831-01 und PB-2026-0902-01.
+recursive-include receipts/agent_review *.receipt.json *.block.md *.publickey.hex

proofbundle-6.1.0/PKG-INFO

@@ -0,0 +1,280 @@
+Metadata-Version: 2.4
+Name: proofbundle
+Version: 6.1.0
+Summary: Emit and verify portable cryptographic evidence bundles, offline: Ed25519 + RFC 6962 Merkle + optional SD-JWT.
+Author: Konrad Gruszka
+License: MIT
+Project-URL: Homepage, https://b7n0de.com
+Project-URL: Repository, https://github.com/b7n0de/proofbundle
+Project-URL: Issues, https://github.com/b7n0de/proofbundle/issues
+Project-URL: Changelog, https://github.com/b7n0de/proofbundle/blob/main/CHANGELOG.md
+Project-URL: Documentation, https://github.com/b7n0de/proofbundle#readme
+Keywords: cryptography,merkle,transparency-log,ed25519,sd-jwt,verifiable-credentials,attestation,provenance,rfc6962
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Security :: Cryptography
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: cryptography>=42
+Requires-Dist: rfc8785>=0.1.4
+Provides-Extra: sdjwt
+Provides-Extra: eval
+Requires-Dist: rfc8785>=0.1.4; extra == "eval"
+Provides-Extra: anchors
+Requires-Dist: rfc3161-client>=1.0.6; extra == "anchors"
+Requires-Dist: opentimestamps<0.5,>=0.4.5; extra == "anchors"
+Requires-Dist: rfc8785>=0.1.4; extra == "anchors"
+Provides-Extra: adapters
+Provides-Extra: chia
+Provides-Extra: experimental
+Provides-Extra: pq
+Requires-Dist: cryptography>=48; extra == "pq"
+Provides-Extra: rootcommit
+Requires-Dist: ecdsa>=0.18; extra == "rootcommit"
+Provides-Extra: formal
+Requires-Dist: z3-solver>=4.12; extra == "formal"
+Provides-Extra: pytest
+Requires-Dist: pytest>=7; extra == "pytest"
+Provides-Extra: test
+Requires-Dist: pytest>=7; extra == "test"
+Requires-Dist: hypothesis>=6; extra == "test"
+Requires-Dist: PyYAML>=6; extra == "test"
+Requires-Dist: jsonschema>=4; extra == "test"
+Requires-Dist: sd-jwt>=0.10; extra == "test"
+Requires-Dist: rfc8785>=0.1.4; extra == "test"
+Provides-Extra: inspect
+Requires-Dist: inspect_ai<=0.3.263,>=0.3.112; extra == "inspect"
+Provides-Extra: dev
+Requires-Dist: pytest>=7; extra == "dev"
+Requires-Dist: ruff<0.17,>=0.5; extra == "dev"
+Requires-Dist: jsonschema>=4; extra == "dev"
+Requires-Dist: mypy<3,>=1.8; extra == "dev"
+Requires-Dist: build>=1; extra == "dev"
+Requires-Dist: hypothesis>=6; extra == "dev"
+Requires-Dist: rfc8785>=0.1.4; extra == "dev"
+Requires-Dist: sd-jwt>=0.10; extra == "dev"
+Requires-Dist: PyYAML>=6; extra == "dev"
+Requires-Dist: inspect_ai<=0.3.263,>=0.3.112; extra == "dev"
+Dynamic: license-file
+
+<div align="center">
+
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/b7n0de/proofbundle/main/assets/b7n0de-hase-logo-dark.png">
+  <img alt="b7n0de, Verified AI Work, pink rabbit mascot over the B7N0DE wordmark" src="https://raw.githubusercontent.com/b7n0de/proofbundle/main/assets/b7n0de-hase-logo.png" width="200">
+</picture>
+
+<h1>proofbundle</h1>
+
+[![CI](https://github.com/b7n0de/proofbundle/actions/workflows/ci.yml/badge.svg)](https://github.com/b7n0de/proofbundle/actions/workflows/ci.yml)
+[![demo reproducible](https://github.com/b7n0de/proofbundle/actions/workflows/demo-reproducible.yml/badge.svg)](https://github.com/b7n0de/proofbundle/actions/workflows/demo-reproducible.yml)
+[![PyPI](https://img.shields.io/pypi/v/proofbundle.svg)](https://pypi.org/project/proofbundle/)
+[![Python](https://img.shields.io/pypi/pyversions/proofbundle.svg)](https://pypi.org/project/proofbundle/)
+[![License: MIT](https://img.shields.io/badge/license-MIT-D6248A.svg)](https://github.com/b7n0de/proofbundle/blob/main/LICENSE)
+[![DOI](https://zenodo.org/badge/DOI/10.5281/zenodo.21110642.svg)](https://doi.org/10.5281/zenodo.21110642)
+
+**Portable evidence for AI work, verifiable offline. Integrity, not truth**
+
+**One file. No verification server. No network required.**
+
+[Quick start](#quick-start) · [What it proves](#what-a-receipt-proves) · [Current release](#current-release) · [Adoption review](https://github.com/b7n0de/proofbundle/blob/main/docs/REVIEWERS.md) · [Documentation](#documentation)
+
+</div>
+
+## Current release
+
+What changed, entry by entry, is in the [CHANGELOG](https://github.com/b7n0de/proofbundle/blob/main/CHANGELOG.md); what is in the cut and what moved out of it is in [docs/release_scope](https://github.com/b7n0de/proofbundle/tree/main/docs/release_scope). The version is on the PyPI badge above and not in this text, so this section cannot go stale.
+
+The closing audit verdict of the last release was `FIX_FIRST`, not `WITHSTANDS_DEEPGATE`. The findings that stayed open are published in [RESTRISIKO_600.md](https://github.com/b7n0de/proofbundle/blob/main/RESTRISIKO_600.md) with the scope each statement of that round holds over, and the artefacts of the round are in [audit_artifacts/600](https://github.com/b7n0de/proofbundle/tree/main/audit_artifacts/600).
+
+## Quick start
+
+Install the core verifier.
+
+```bash
+python -m pip install proofbundle
+```
+
+Requires Python 3.10 or newer. The core installs two dependencies, `cryptography` and `rfc8785`.
+
+Download a real example receipt and verify it offline.
+
+```bash
+curl -fsSL \
+  https://raw.githubusercontent.com/b7n0de/proofbundle/main/examples/example_bundle.json \
+  -o receipt.json
+
+proofbundle verify receipt.json
+```
+
+The command uses the local file only. Its exit code is part of the public contract.
+
+```text
+0  verified
+1  verification failed
+2  malformed input or usage error
+3  relying party policy not met
+```
+
+That table is the contract of `proofbundle verify`. The statement-style commands
+(`decision verify`, `outcome verify`, `relation-statement verify`) carry their own exit contract in
+their own `--help`, and the meanings differ, until 6.2.0 sets one contract for all of them.
+
+Run the tamper demo.
+
+```bash
+python -m pip install "proofbundle[eval]"
+proofbundle demo
+```
+
+The demo checks an honest receipt, multiple tampered variants, and a sample swap. It exits nonzero if a tamper is accepted.
+
+For a guided walkthrough, see [docs/DEMO.md](https://github.com/b7n0de/proofbundle/blob/main/docs/DEMO.md). For Inspect, see [docs/INSPECT_HAPPY_PATH.md](https://github.com/b7n0de/proofbundle/blob/main/docs/INSPECT_HAPPY_PATH.md).
+
+## What a receipt proves
+
+| A verified receipt can establish | A verified receipt does not establish |
+|---|---|
+| A stated key signed these exact bytes | The real world identity or honesty of the key holder |
+| The signed content has not changed | The truth of the reported score or finding |
+| A supplied Merkle inclusion or sample opening is valid | That the evaluation design was good |
+| A declared threshold, provenance field, or relation is present and bound | That the computation itself was correct |
+| A supplied relying party policy was met | That no omitted run or cherry picked result exists unless the chosen profile makes that claim testable |
+
+This boundary is the product. proofbundle makes a claim attributable and tamper evident without turning the claim into truth.
+
+Read the full [threat model](https://github.com/b7n0de/proofbundle/blob/main/THREAT_MODEL.md) and the project wide [non claims](https://github.com/b7n0de/proofbundle/blob/main/docs/NON_CLAIMS.md).
+
+## Choose the path that matches your task
+
+| Task | Install | Start here |
+|---|---|---|
+| Verify an existing receipt offline | `proofbundle` | [Quick start](#quick-start), [SPEC.md](https://github.com/b7n0de/proofbundle/blob/main/SPEC.md) |
+| Emit an evaluation receipt or preregistration | `proofbundle[eval]` | [docs/DEMO.md](https://github.com/b7n0de/proofbundle/blob/main/docs/DEMO.md), [EVAL_CLAIM.md](https://github.com/b7n0de/proofbundle/blob/main/EVAL_CLAIM.md) |
+| Integrate with Inspect AI | `proofbundle[inspect]` | [docs/INSPECT_HAPPY_PATH.md](https://github.com/b7n0de/proofbundle/blob/main/docs/INSPECT_HAPPY_PATH.md) |
+| Add a signed agent review disclosure to a PR or issue | `proofbundle` | [5.1.0 release notes](https://github.com/b7n0de/proofbundle/releases/tag/v5.1.0), [conformance/agent_review](https://github.com/b7n0de/proofbundle/tree/main/conformance/agent_review/) |
+| Verify RFC 3161 or OpenTimestamps evidence | `proofbundle[anchors]` | [docs/ANCHORS.md](https://github.com/b7n0de/proofbundle/blob/main/docs/ANCHORS.md) |
+| Verify ML-DSA-44 witness cosignatures | `proofbundle[pq]` | [docs/ANCHORS.md](https://github.com/b7n0de/proofbundle/blob/main/docs/ANCHORS.md) |
+| Explore the TEE attestation bridge | `proofbundle[experimental]` | [docs/EXPERIMENTAL_ENCLAVE.md](https://github.com/b7n0de/proofbundle/blob/main/docs/EXPERIMENTAL_ENCLAVE.md) |
+
+## How it works
+
+```text
+evaluation, review, decision, or action
+                    │
+                    ▼
+      canonical statement and commitments
+                    │
+                    ▼
+       signature and optional Merkle proofs
+                    │
+                    ▼
+           one portable receipt file
+                    │
+                    ▼
+        proofbundle verification offline
+                    │
+                    ▼
+   separate verification axes and policy result
+```
+
+The verifier checks only the evidence supplied to it. Trust anchors, expected subjects, currentness information, and policy requirements come from the relying party.
+
+## Capabilities and maturity
+
+proofbundle is a **beta project**. Shipped does not mean that every profile has the same maturity.
+
+| Capability | What it provides | Maturity |
+|---|---|---|
+| Core receipt verification | Ed25519 signatures, RFC 6962 and RFC 9162 Merkle inclusion, strict parsing, offline verification | Shipped |
+| Evaluation receipts | Metric and threshold claims, provenance, salted commitments, optional per sample audit | Shipped |
+| Selective disclosure | SD-JWT with key binding for hiding selected values while preserving verifiability | Shipped |
+| Agent review receipts | Signed self declarations for AI involvement and review in PRs and issues | `agent-review/v0.2` experimental in 6.0.0 and the default; `agent-review/v0.1` legacy, still readable and byte-pinned. Self declared assurance only |
+| Inspect, pytest, and Hugging Face bridges | Opt in adapters for existing evaluation workflows | Shipped |
+| External time evidence | RFC 3161, OpenTimestamps, and a bring your own anchor interface | Experimental, the `[anchors]` extra |
+| Decision receipts | A gate's verdict over named evidence, bound to the receipts it judged, never a claim that the verdict was correct | Shipped |
+| Outcome, relation, run ledger, trust pack, and verification summary predicates | Typed evidence graphs and relying party policy inputs | Experimental |
+| TEE attestation bridge | RATS and EAT based enclave evidence | Preview, experimental |
+| Independent Rust cross-verifier (`tools/pb_verify_rs`) | A second implementation that cross-checks the conformance corpus differentially; not part of the wheel or the sdist | Experimental in 6.0.0 and advisory only: agreement on recorded vectors, no conformance promise; own milestone 6.1 |
+
+The full predicate inventory and maturity labels live in [docs/predicates/README.md](https://github.com/b7n0de/proofbundle/blob/main/docs/predicates/README.md).
+
+## Security and trust
+
+- The verifier uses `cryptography` for Ed25519 and `rfc8785` for canonicalization. It does not implement its own cryptographic primitives.
+- Correctness is checked against external RFC 6962 vectors and a real Sigstore Rekor proof, not only against the project's own receipts.
+- The test suite sits behind a mutation gate and property based parser fuzzing.
+- The receipt signature is Ed25519 and is not post quantum. Post quantum coverage today is limited to witness side ML-DSA-44 cosignatures, plus an experimental ML-DSA path in the renewal layer (`pqsig.py`, EXPERIMENTAL, ADR 0006), which renews a receipt rather than signing its payload. A post quantum payload signature is on the roadmap and not yet built. Detail in [docs/ANCHORS.md](https://github.com/b7n0de/proofbundle/blob/main/docs/ANCHORS.md).
+- Releases are built once, carry SLSA build provenance, and are published through PyPI Trusted Publishing, where PyPI records PEP 740 attestations for the same bytes.
+- A second, independent verifier written in Rust cross-checks the conformance corpus. It is advisory: differential agreement on the recorded vectors, not a correctness proof of either implementation, and it does not ship in the package.
+- The conformance corpus includes positive controls and counter proofs. Read what it does and does not establish in [CONFORMANCE.md](https://github.com/b7n0de/proofbundle/blob/main/CONFORMANCE.md).
+- The 30 minute adversarial adoption path is in [docs/REVIEWERS.md](https://github.com/b7n0de/proofbundle/blob/main/docs/REVIEWERS.md).
+- Security reports follow [SECURITY.md](https://github.com/b7n0de/proofbundle/blob/main/SECURITY.md).
+- Release specific audit artefacts and residual risks remain visible rather than being folded into a single green status.
+
+### OpenSSF Scorecard
+
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/b7n0de/proofbundle/badge)](https://scorecard.dev/viewer/?uri=github.com/b7n0de/proofbundle)
+
+The aggregate score is a live heuristic, not a product verdict. Several checks score zero for reasons that are written down rather than hidden, one sentence per check, in [docs/SCORECARD.md](https://github.com/b7n0de/proofbundle/blob/main/docs/SCORECARD.md). The [OpenSSF self assessment](https://github.com/b7n0de/proofbundle/blob/main/docs/openssf_best_practices_self_assessment.md) walks the Best Practices criteria honestly.
+
+## Standards and interoperability
+
+proofbundle is a small offline receipt layer that complements, rather than replaces, systems such as in-toto, Sigstore, SCITT, transparency logs, trusted execution environments, and independent reproduction.
+
+- [INTEROP.md](https://github.com/b7n0de/proofbundle/blob/main/INTEROP.md) compares the boundaries tool by tool.
+- [docs/RECEIPT_ENVELOPE_PROFILE.md](https://github.com/b7n0de/proofbundle/blob/main/docs/RECEIPT_ENVELOPE_PROFILE.md) defines the portable envelope profile.
+- A second implementation, [CSOAI-ORG/inspect-receipts](https://github.com/CSOAI-ORG/inspect-receipts), was measured against R1 to R4 of that profile in [issue #147](https://github.com/b7n0de/proofbundle/issues/147) on 2026-09-05 at commit `cc8d6219`; the result is recorded in the profile.
+- [docs/IN_TOTO_PROFILE.md](https://github.com/b7n0de/proofbundle/blob/main/docs/IN_TOTO_PROFILE.md) describes the in-toto mapping.
+- [docs/SCITT_CPB_MAPPING.md](https://github.com/b7n0de/proofbundle/blob/main/docs/SCITT_CPB_MAPPING.md) records the SCITT mapping.
+- [docs/RELATED_WORK.md](https://github.com/b7n0de/proofbundle/blob/main/docs/RELATED_WORK.md) holds the research neighbourhood.
+
+## Documentation
+
+| Reader | Start here |
+|---|---|
+| New user | [docs/GLOSSARY.md](https://github.com/b7n0de/proofbundle/blob/main/docs/GLOSSARY.md), [docs/DEMO.md](https://github.com/b7n0de/proofbundle/blob/main/docs/DEMO.md) |
+| Adopter or security reviewer | [docs/REVIEWERS.md](https://github.com/b7n0de/proofbundle/blob/main/docs/REVIEWERS.md), [THREAT_MODEL.md](https://github.com/b7n0de/proofbundle/blob/main/THREAT_MODEL.md) |
+| Implementer | [SPEC.md](https://github.com/b7n0de/proofbundle/blob/main/SPEC.md), [CONFORMANCE.md](https://github.com/b7n0de/proofbundle/blob/main/CONFORMANCE.md) |
+| Integrator | [INTEGRATIONS.md](https://github.com/b7n0de/proofbundle/blob/main/INTEGRATIONS.md), [docs/INSPECT_HAPPY_PATH.md](https://github.com/b7n0de/proofbundle/blob/main/docs/INSPECT_HAPPY_PATH.md) |
+| Relying party | [docs/POLICY_PROFILES.md](https://github.com/b7n0de/proofbundle/blob/main/docs/POLICY_PROFILES.md), [docs/TRUST_ANCHORS.md](https://github.com/b7n0de/proofbundle/blob/main/docs/TRUST_ANCHORS.md) |
+| Standards or research reader | [INTEROP.md](https://github.com/b7n0de/proofbundle/blob/main/INTEROP.md), [docs/RELATED_WORK.md](https://github.com/b7n0de/proofbundle/blob/main/docs/RELATED_WORK.md) |
+| Release reviewer | [CHANGELOG.md](https://github.com/b7n0de/proofbundle/blob/main/CHANGELOG.md), [docs/PRE_TAG_AUDIT.md](https://github.com/b7n0de/proofbundle/blob/main/docs/PRE_TAG_AUDIT.md) |
+
+## Scope
+
+proofbundle is not a hosted transparency service, a complete in-toto client, a trusted execution environment, a consensus system, or a compliance product by itself.
+
+It is the portable, standards oriented receipt layer between an evidence producer and a relying party.
+
+Roadmap, stated as not yet built. A post quantum payload signature, and a CLI flag to select the content root algorithm, `jcs-sha256-v1` is the signed default today.
+
+## Citation
+
+Machine readable citation metadata is in [CITATION.cff](https://github.com/b7n0de/proofbundle/blob/main/CITATION.cff).
+
+The archival software record uses concept DOI [10.5281/zenodo.21110642](https://doi.org/10.5281/zenodo.21110642). The Technical Note uses concept DOI [10.5281/zenodo.21230466](https://doi.org/10.5281/zenodo.21230466); its latest published revision is 6.0.0, version DOI [10.5281/zenodo.22730162](https://doi.org/10.5281/zenodo.22730162), deposited 2026-09-12. The preceding revision 5.0.0 has version DOI [10.5281/zenodo.22209091](https://doi.org/10.5281/zenodo.22209091).
+
+## Contributing
+
+Read [CONTRIBUTING.md](https://github.com/b7n0de/proofbundle/blob/main/CONTRIBUTING.md) and the [Code of Conduct](https://github.com/b7n0de/proofbundle/blob/main/CODE_OF_CONDUCT.md).
+
+Good first issues use the [`good-first-issue`](https://github.com/b7n0de/proofbundle/labels/good-first-issue) label. Security findings follow [SECURITY.md](https://github.com/b7n0de/proofbundle/blob/main/SECURITY.md).
+
+The verifier core aims to remain small, dependency light, and auditable.
+
+## License
+
+MIT, see [LICENSE](https://github.com/b7n0de/proofbundle/blob/main/LICENSE).
+
+---
+
+<p align="center"><sub>proofbundle is part of <b>b7n0de</b>, Verified AI Work · <a href="https://b7n0de.com">b7n0de.com</a></sub></p>