proofbundle 6.0.0__tar.gz → 6.2.0__tar.gz

proofbundle-6.2.0/MANIFEST.in

@@ -0,0 +1,226 @@
+# PB-2026-0717-02: the published sdist shipped tests/ WITHOUT their runtime assets (fixtures, schemas,
+# examples, conformance corpus, formal-model results, the scripts the tests invoke) → the full sdist
+# pytest aborted with collection errors. This allowlist grafts exactly the assets the shipped tests need
+# to COLLECT AND RUN.
+#
+# Self-testable, honestly (PKG-2026-0718-01 / RE-GATE): `pip install <sdist> && pytest` runs the
+# package-level suite green. A documented subset of tests assert facts about the REPO/CI/Rust/docs LAYOUT
+# (`.github/workflows` contents, the Rust verifier source under `tools/`, `SPEC.md`/`CITATION.cff`, audit
+# records) — material this allowlist DELIBERATELY prunes (not a Python-package artifact). Those repo-context
+# tests SKIP outside a git checkout (tests/conftest.py::_REPO_CONTEXT_TESTS) rather than fail, so a
+# from-sdist run is clean — the honest form of "self-testable" (package tests run; repo-layout tests declare
+# themselves N/A).
+#
+# Per-directory allowlist (Befund C: not `package-data` — that targets the wheel/import package; the
+# sdist is the right vehicle for top-level tests/ + their assets). Large / non-Python-sdist material is
+# pruned: `tools/` is the Rust verifier + its 138M build tree (Rust runs from a git checkout with a
+# toolchain, never from the Python sdist — a category error to ship it), and build/CI-meta is excluded.
+# The shipped-example policy tests/test_renewal_policy.py loads is included by exact path (PKG-2026-0718-02)
+# — NOT `graft docs/adr`, which would also ship the ADR markdowns whose internal links reference pruned
+# repo files (breaking test_docs_truth from the sdist).
+graft tests
+graft schemas
+graft examples
+graft conformance
+graft formal
+graft docs/readiness_pack
+include docs/adr/renewal_policy.example.json
+
+# PB-2026-0831-01: the receipt-envelope profile and its vectors landed on main in #159, but the
+# profile document itself was NOT in the sdist and NOT in the wheel — measured, 0 hits in both.
+# NO prune or exclude rule removed it. MANIFEST.in is an allowlist and the file was simply not on
+# any line; it was missing by absence, not by exclusion. That distinction matters: looking for the
+# offending prune rule would have found nothing and left the file out.
+#
+# The vectors under conformance/envelope_profile/ were already shipped by `graft conformance`
+# (21 of 21 files, 10 of 10 case.json, measured). Only the prose document was missing, and it is
+# the half a reader needs to know what the vectors prove.
+#
+# Named by exact path rather than `graft docs`, for the same reason the ADR example above is: a
+# blanket graft would also ship documents whose internal links point at pruned repo files, which
+# breaks test_docs_truth from the sdist.
+include docs/RECEIPT_ENVELOPE_PROFILE.md
+# Same reason, re-derived by tests/test_shipped_comment_numbers.py: 35 conformance cases under
+# conformance/agent_review/ (first written as 14 on 01.09.2026, already wrong then)
+# cite this file NORMATIVELY (`specRef`), and it was not shipped — the corpus referred to a
+# document the installed package did not contain. It carries no local links, so it cannot
+# break test_docs_truth the way a `graft docs` would.
+include docs/AGENT_REVIEW_PREDICATE.md
+# P19 (6.1.0): der Vertrag zum Verifier-Block. Fuenf Konformanzfaelle nennen ihn normativ
+# (specRefs), und ein Dokument, das ein Fall nennt, liegt auch im Paket vor -- sonst waechst die
+# Luecke, die conformance/unshipped_spec_refs_baseline.json festschreibt. Keine lokalen Links
+# auf geprunte Dateien, damit test_docs_truth aus der sdist besteht.
+include docs/VERIFIER_BLOCK.md
+# PB-2026-0902-01: der sdist enthielt `conformance/` (94 Faelle, `graft conformance`), aber NICHT
+# das Makefile, ueber das die Doku den Korpus fahren laesst. Wer den sdist auspackt und
+# `make conformance` ruft, bekommt "No rule to make target" — der Korpus ist da und
+# unerreichbar. Gefunden von der as-shipped-Linse des Tiefen-Gates am 02.09.2026. Wie schon bei
+# `RECEIPT_ENVELOPE_PROFILE.md`: keine prune-Regel entfernte es, es stand auf keiner Zeile.
+include Makefile
+# AUFLAGE des Owners 2026-09-06 zur Karte OA-8b1a31cc4f, Auflage 1: `graft scripts` ist durch eine
+# AUSDRUECKLICHE Liste ersetzt. Ein graft ist eine Vollmacht auf alles, was kuenftig in dem Ordner
+# landet — auch auf ein Signierwerkzeug, das noch niemand geschrieben hat. Eine Liste ist eine
+# Entscheidung je Datei, und eine neue Datei muss hier auftauchen, bevor sie ausgeliefert wird.
+#
+# DRAUSSEN, und warum (gemessen 2026-09-06, AST-Suche nach einem schluessel-LESENDEN Codepfad):
+#   scripts/pre_tag_receipt.py      liest `Ed25519PrivateKey.from_private_bytes` ueber --privkey-file.
+#                                   Der Modus BLEIBT im Repo — er ist der Owner-Signierweg am Mac
+#                                   (Owner-Entscheid 2026-09-06) — aber er wird nicht ausgeliefert.
+#   scripts/gen_findings_register.py liest denselben Weg aus Umgebung oder Datei.
+#
+# DRIN, obwohl der Name anderes vermuten laesst: scripts/sign_readiness_artifact.py. Gemessen traegt
+# es KEINEN Codepfad, der einen privaten Schluessel liest — nur `Ed25519PublicKey` zum PRUEFEN einer
+# extern erzeugten Signatur. Es emittiert kanonische Bytes und setzt eine fremde Signatur zusammen;
+# selbst beglaubigen kann es nichts. Es aus dem sdist zu nehmen haette ausserdem
+# `audit_candidate_matrix.py` gebrochen, das seinen `tree_digest` importiert, und mit ihm zehn
+# ausgelieferte Testdateien. Der Riegel dagegen ist nicht die Abwesenheit der Datei, sondern
+# `tests/test_sdist_ohne_signierwerkzeug.py`: er misst die sdist-Dateiliste und wird rot, sobald
+# darin ein Skript einen privaten Schluessel liest — per AST, damit eine Erwaehnung im Docstring
+# nicht als Codepfad zaehlt.
+# NICHT NUR PYTHON, und das war eine Luecke dieser Liste selbst (gefunden am 06.09.2026 durch
+# den Probe-Merge der vier Lanes). `graft scripts` lieferte ALLES unter dem Ordner aus; die erste
+# Fassung dieser Liste entschied nur ueber `*.py`, und damit fielen fuenf Dateien still heraus.
+# Zwei davon liest ein AUSGELIEFERTES Skript (`rust_parity_gate.py:58` die Registry,
+# `mutation_check.py:716` die Gewichte), zwei ruft ein AUSGELIEFERTES Makefile-Ziel
+# (`make demo`, `make demo-tamper`). Ein Skript ohne seine Datendatei ist kein Skript.
+#
+# DRAUSSEN und ausdruecklich entschieden: scripts/required_check_reachability_gate.py. Es liest
+# `.github/workflows/*.yml` und `.github/required_status_checks.json`; beides faellt unten unter
+# `prune .github`. Im Paket faende es also kein einziges Workflow-File und muesste daraus ein
+# Urteil bilden — die Abwesenheit einer Eingabe als Ergebnis zu nehmen ist genau der Fehler,
+# gegen den das Skript gebaut ist. Es gehoert in den Checkout und in CI, nicht in die sdist.
+#
+# DRAUSSEN und ausdruecklich entschieden: scripts/required_context_presence_gate.py. Es fragt
+# die GitHub-API nach den Rulesets des Repositoriums und nach den check-runs eines Kopfes; beides
+# gibt es nur dort, wo dieses Repositorium als Repositorium existiert. Im Paket haette es weder
+# Ruleset noch Kopf und muesste aus zwei fehlenden Eingaben ein Urteil bilden — derselbe Grund,
+# aus dem sein Geschwister `required_check_reachability_gate.py` draussen steht, und genau der
+# Fehler, gegen den beide gebaut sind. Es gehoert in den Checkout und in CI, nicht in die sdist.
+#
+# DRAUSSEN und ausdruecklich entschieden: scripts/install_git_hooks.sh — seine Verbraucher sind der
+# git-Hook des Checkouts und der CI-Kanal, beides gibt es im sdist nicht.
+#
+# OUT, and deliberately decided (2026-09-24): scripts/render_release.py. It renders the release body
+# from `release_notes/release-source.json`, which no line of this list ships, and it measures the head
+# of a git tree to refuse a source that describes a different one. An installed package has neither
+# the source nor a tree, so the script would only fail to find its input — the same reason
+# `b7_release_scope_title_gate.py` and its two siblings stand outside. Its contract
+# `tests/test_render_release.py` therefore loads it through `spec_from_file_location`, so a run from
+# the unpacked sdist reports an honest skip instead of aborting collection.
+#
+# OUT, and deliberately decided (2026-09-24): scripts/render_pr_body.py. It renders a pull request
+# body or a house issue from a data source under `pr_bodies/`, which no line of this list ships, and
+# the surfaces it writes for exist only in this project's own GitHub repository. An installed package
+# has neither the source nor a use for the output, so the script would only fail to find its input —
+# the same reason `render_release.py` stands outside, three paragraphs up. Its contract
+# `tests/test_render_pr_body.py` therefore loads it through `spec_from_file_location` on module level,
+# so a run from the unpacked sdist reports an honest skip instead of aborting collection, and its two
+# fixtures under `tests/fixtures/pr_bodies/` stay outside for the same reason: the cases that read them
+# never run where the script is absent.
+#
+# OUT, and deliberately decided (2026-09-25): scripts/render_site_data.py. It measures this
+# repository to render `docs/site/site-data.json`: the version from pyproject, the release date and
+# commit from a git tag, the check count from a real verify run over a conformance bundle, the test
+# count from `tests/*.py`, and the release receipts under `audit_artifacts/`. An installed package has
+# no git tree, no conformance corpus and no audit artefacts, so every field would come back
+# not_measurable and the run would write a file that says nothing — the same reason `render_release.py`
+# and `render_pr_body.py` stand outside, above. Its contract
+# `tests/test_site_data_every_value_with_its_source.py` loads it through `spec_from_file_location`, and
+# because that module names `scripts/render_site_data.py` — a path this list does not ship — the
+# derived skip set in `tests/conftest.py::modul_ist_repo_kontext` marks it repo-context outside a
+# checkout and skips it honestly, while inside a checkout the path exists and every case runs.
+#
+# OUT, and deliberately decided (2026-09-26): scripts/codex_threads_check.py. It asks the GitHub API
+# for the Codex review threads, the issue comments and the head of one pull request of this
+# repository, and `.github/workflows/codex-threads.yml` runs it on every pull request. An installed
+# package has no pull request and no repository to ask, so the script could only fail to reach its
+# input, the same reason `required_context_presence_gate.py` stands outside. Its contract
+# `tests/test_codex_threads_check.py` loads it through `spec_from_file_location` on module level;
+# outside a checkout the file is absent and not in SOURCES.txt, so `tests/conftest.py` reports the
+# module as a skip that names the file instead of aborting collection.
+#
+# DRIN, und zwingend statt abgewogen: scripts/b7_historie.py. scripts/audit_candidate_matrix.py:707
+# importiert daraus `historie_abgeschnitten`, und audit_candidate_matrix.py ist SELBST ausgeliefert
+# (Zeile weiter unten). Ein ausgeliefertes Skript, dessen Import im Paket fehlt, bricht bei dem, der
+# es benutzt — nicht bei uns. Dazu laden drei ausgelieferte Testdateien es ueber
+# spec_from_file_location; sie umgehen den blanken Modul-Import ausdruecklich, weil scripts/ im
+# entpackten sdist nicht auf sys.path liegt, brauchen aber die DATEI.
+# DRIN, und die Entscheidung ist GEMESSEN statt geraten: scripts/b7_paketinhalt_ohne_schluesselmaterial.py.
+# Der erste Reflex war, ihn wie budget_axis_measurement.py als Freigabe-Beweismittel dieses Repos zu
+# fuehren und draussen zu lassen — ein Riegel fuer den Bauweg klingt nach Werkbank, nicht nach
+# Paket-Faehigkeit. Die Messung entscheidet anders: tests/test_paketinhalt_ohne_schluesselmaterial.py
+# laedt das Skript auf MODULEBENE ueber spec_from_file_location und exec_module, ohne Schutz. Fehlt
+# es im sdist, ist das kein Skip, sondern ein Collection-Error beim Nutzer — genau PB-2026-0717-02
+# aus Zeile 1 dieser Datei. Die Regel steht dort schon: die Skripte, die die Tests aufrufen, gehoeren
+# in den sdist. Dass er dabei seine eigenen Muster mitliefert, ist bedacht: der Riegel nimmt genau
+# eine Datei aus, sich selbst (EIGENER_PFAD), und zwar praefix-tolerant, weil im sdist jeder Pfad
+# unter proofbundle-<version>/ liegt.
+#
+# IN, decided the way its reader is (2026-09-26): scripts/mutation_baseline_allowlist.json. The
+# shipped scripts/mutation_check.py reads it for every baseline (`lade_erlaubnisliste`), and the
+# shipped contract tests/test_mutation_selection.py reads it as well. Left undecided, it turned
+# `test_jede_datei_unter_scripts_ist_in_manifest_entschieden` red, a test that stands in every
+# selection of the gate, so the first baseline of every shard stopped; and the contract failed from
+# the sdist with FileNotFoundError. It is data of a shipped script, like the shard weights below.
+#
+# IN, decided the way its reader is (2026-09-27): scripts/cargo_audit_gate.py. The shipped test
+# tests/test_cargo_audit_gate.py loads it with spec_from_file_location, so left out it would fail
+# from the sdist with FileNotFoundError. It reads a lock file and cargo-audit's JSON and holds no key.
+include scripts/demo.sh
+include scripts/demo_tamper.sh
+include scripts/mutation_baseline_allowlist.json
+include scripts/mutation_shard_weights.json
+include scripts/rust_parity_registry.json
+include scripts/_build_anchor_fixture.py
+include scripts/audit_candidate_matrix.py
+include scripts/audit_output_aufloesbar.py
+include scripts/b7_historie.py
+include scripts/b7_paketinhalt_ohne_schluesselmaterial.py
+include scripts/branch_base_check.py
+include scripts/build_reproducible.py
+include scripts/cargo_audit_gate.py
+include scripts/check_version_and_changelog.py
+include scripts/claims_hygiene_check.py
+include scripts/doc_link_check.py
+include scripts/finding_base_drift.py
+include scripts/findings_register.py
+include scripts/fork_pr_secret_isolation.py
+include scripts/fuzz_soak.py
+include scripts/gate_qualification_harness.py
+include scripts/gen_synthetic_ots_fixture.py
+include scripts/mutant_signature_guard.py
+include scripts/mutation_check.py
+include scripts/mutation_operators_fresh.py
+include scripts/pre_tag_attestation.py
+include scripts/pre_tag_audit_gate.py
+include scripts/pre_tag_receipt_lib.py
+include scripts/readiness_pack_gate.py
+include scripts/readiness_pack_manifest.py
+include scripts/release_text_hygiene.py
+include scripts/render_demo.py
+include scripts/rust_parity_gate.py
+include scripts/shipped_docs_check.py
+include scripts/sign_readiness_artifact.py
+include scripts/test_manifest_gate.py
+include scripts/type_confusion_gate.py
+# P19 (6.1.0): der Pruefer fuer Dritte. Er liest nur oeffentliche Schluessel und Commit-Blobs,
+# traegt keinen schluessel-lesenden Codepfad, und der Vertrag
+# tests/test_verify_pre_tag_receipt_third_party.py ruft ihn -- die Skripte, die die Tests
+# aufrufen, gehoeren in den sdist (Zeile 1 dieser Datei).
+include scripts/verify_pre_tag_receipt.py
+
+# Never ship: the Rust verifier + build artifacts, repo/CI meta, caches, VCS, big review packs.
+prune tools
+prune audit_artifacts
+prune .github
+prune target
+global-exclude __pycache__
+global-exclude *.py[cod]
+global-exclude *.so
+global-exclude *.rs
+global-exclude *.orig
+# Die sechs v0.1-Receipts und die zwei v0.2-Receipts: tests/test_agent_review_v01_regression.py
+# liest sie als Regression gegen die unter 5.1.0 gemessenen Urteile. Ohne diese Zeile stand das
+# Modul in der sdist als repo-context und uebersprang alle 20 Faelle (Linse 3 auf PR 185,
+# FUND-1) — dieselbe Klasse wie PB-2026-0717-02, PB-2026-0831-01 und PB-2026-0902-01.
+recursive-include receipts/agent_review *.receipt.json *.block.md *.publickey.hex

proofbundle-6.2.0/PKG-INFO

@@ -0,0 +1,291 @@
+Metadata-Version: 2.4
+Name: proofbundle
+Version: 6.2.0
+Summary: Emit and verify portable cryptographic evidence bundles, offline: Ed25519 + RFC 6962 Merkle + optional SD-JWT.
+Author: Konrad Gruszka
+License: MIT
+Project-URL: Homepage, https://b7n0de.com
+Project-URL: Repository, https://github.com/b7n0de/proofbundle
+Project-URL: Issues, https://github.com/b7n0de/proofbundle/issues
+Project-URL: Changelog, https://github.com/b7n0de/proofbundle/blob/main/CHANGELOG.md
+Project-URL: Documentation, https://github.com/b7n0de/proofbundle#readme
+Keywords: cryptography,merkle,transparency-log,ed25519,sd-jwt,verifiable-credentials,attestation,provenance,rfc6962
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Security :: Cryptography
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: cryptography>=42
+Requires-Dist: rfc8785>=0.1.4
+Provides-Extra: sdjwt
+Provides-Extra: eval
+Requires-Dist: rfc8785>=0.1.4; extra == "eval"
+Provides-Extra: anchors
+Requires-Dist: rfc3161-client>=1.0.6; extra == "anchors"
+Requires-Dist: opentimestamps<0.5,>=0.4.5; extra == "anchors"
+Requires-Dist: rfc8785>=0.1.4; extra == "anchors"
+Provides-Extra: adapters
+Provides-Extra: chia
+Provides-Extra: experimental
+Provides-Extra: pq
+Requires-Dist: cryptography>=48; extra == "pq"
+Provides-Extra: rootcommit
+Requires-Dist: ecdsa>=0.18; extra == "rootcommit"
+Provides-Extra: formal
+Requires-Dist: z3-solver>=4.12; extra == "formal"
+Provides-Extra: pytest
+Requires-Dist: pytest>=7; extra == "pytest"
+Provides-Extra: test
+Requires-Dist: pytest>=7; extra == "test"
+Requires-Dist: hypothesis>=6; extra == "test"
+Requires-Dist: PyYAML>=6; extra == "test"
+Requires-Dist: jsonschema>=4; extra == "test"
+Requires-Dist: sd-jwt>=0.10; extra == "test"
+Requires-Dist: rfc8785>=0.1.4; extra == "test"
+Provides-Extra: inspect
+Requires-Dist: inspect_ai<=0.3.266,>=0.3.112; extra == "inspect"
+Provides-Extra: dev
+Requires-Dist: pytest>=7; extra == "dev"
+Requires-Dist: ruff<0.17,>=0.5; extra == "dev"
+Requires-Dist: jsonschema>=4; extra == "dev"
+Requires-Dist: mypy<3,>=1.8; extra == "dev"
+Requires-Dist: build>=1; extra == "dev"
+Requires-Dist: hypothesis>=6; extra == "dev"
+Requires-Dist: rfc8785>=0.1.4; extra == "dev"
+Requires-Dist: sd-jwt>=0.10; extra == "dev"
+Requires-Dist: PyYAML>=6; extra == "dev"
+Requires-Dist: inspect_ai<=0.3.266,>=0.3.112; extra == "dev"
+Dynamic: license-file
+
+<div align="center">
+
+<img alt="proofbundle, flat rabbit head with a pink ear tip" src="https://raw.githubusercontent.com/b7n0de/proofbundle/main/assets/proofbundle-hase-flach-512.png" width="180">
+
+<h1>proofbundle</h1>
+
+[![CI](https://github.com/b7n0de/proofbundle/actions/workflows/ci.yml/badge.svg)](https://github.com/b7n0de/proofbundle/actions/workflows/ci.yml)
+[![demo reproducible](https://github.com/b7n0de/proofbundle/actions/workflows/demo-reproducible.yml/badge.svg)](https://github.com/b7n0de/proofbundle/actions/workflows/demo-reproducible.yml)
+[![PyPI](https://img.shields.io/pypi/v/proofbundle.svg)](https://pypi.org/project/proofbundle/)
+[![Python](https://img.shields.io/pypi/pyversions/proofbundle.svg)](https://pypi.org/project/proofbundle/)
+[![License: MIT](https://img.shields.io/badge/license-MIT-D6248A.svg)](https://github.com/b7n0de/proofbundle/blob/main/LICENSE)
+[![DOI](https://zenodo.org/badge/DOI/10.5281/zenodo.21110642.svg)](https://doi.org/10.5281/zenodo.21110642)
+
+**Portable evidence for AI work, verifiable offline. Integrity, not truth**
+
+**One file. No verification server. No network required.**
+
+[Quick start](#quick-start) · [What it proves](#what-a-receipt-proves) · [Current release](#current-release) · [Adoption review](https://github.com/b7n0de/proofbundle/blob/main/docs/REVIEWERS.md) · [Documentation](#documentation)
+
+</div>
+
+## Current release
+
+**[v6.2.0](https://github.com/b7n0de/proofbundle/releases/tag/v6.2.0) · Beta · Closing audit record named in the release notes**
+
+[Known limitations](https://github.com/b7n0de/proofbundle/blob/v6.2.0/RESTRISIKO_620.md) · [Release notes](https://github.com/b7n0de/proofbundle/blob/v6.2.0/CHANGELOG.md) · [Release scope](https://github.com/b7n0de/proofbundle/blob/v6.2.0/docs/release_scope/6.2.0.md)
+
+<details>
+<summary>What was checked, and what remains open</summary>
+
+6.2.0 closes five findings in the released 6.0.0 and 6.1.0 at the verify boundary, and one class of eight more: a related map that says it is empty no longer hides a retraction, an edge's `declaredAt` takes ASCII digits only as the Rust verifier does, a low-order Ed25519 key is refused both as a trusted key and as the holder key of a key binding, a caller's resolver promotes a verdict only on the exact `True`, and a public verify surface reads each argument of its caller once, by what it stores, so the caller's own methods no longer decide a verdict.
+
+It closes six more findings in four classes, five of them in the released 6.0.0 and 6.1.0: every evaluator applies the rule of `load_policy`, so a policy field of another type is refused instead of read as no constraint; no value a check judges is read after caller code could change it, the anchors, the relying party's trust material and the answers of a resolver included; a restricting `warn` of a registered anchor verifier marks the anchor pending; and a container of the wrong type is refused instead of read as empty. The sixth, the `warn` reading, is a regression of this release cycle and not in the released versions.
+
+A later gate round found two more, both in the released 6.0.0 and 6.1.0: an attached target's subject state is read against the four words its resolver writes, so a state it never writes no longer binds a declared subject pin to the first subject of an ambiguous target; and a restricting command-line option given an empty value, such as `--policy ''`, is refused or applied instead of being read as absent. The gate round at d388ed3d found two more, also in the released 6.0.0 and 6.1.0: the decision and outcome verifiers read a caller's `related` map once, so a callback of the caller can no longer hide an attached retraction between two readings, and every public function now reads all of its arguments in one reading at its call, before its body reads any of them; and `decision verify --anchors` refuses a file holding `null` or an empty list instead of reading it as no option, as the receipt verify commands refuse a policy with nothing in it they evaluate.
+
+The gate round at fda55f98 found one more in the released 6.0.0 and 6.1.0, and closed what that reading still handed on. Every rule a policy sets is now applied by the command it is given to, or the policy is refused; `outcome verify` printed `POLICY: OK` over an attached, verified retraction under a rule it never applies. No object of the caller reaches the body of a public function except where an argument's contract names it: an iterator or a generator is refused (pass a list or a tuple), a memoryview no private copy can take is refused, and a value of the caller's own class reaches the body as a stand-in that holds nothing of the caller. The reading does not yet prove a joint state of mutable inputs: a change made and undone between its two reads is not seen, as `RESTRISIKO_620.md` names. The release notes name the affected versions, the effect and the upgrade.
+
+The closing round runs at a later head than the one this file describes, so this file cannot state its result. In the tagged tree its verdict is the gate line of `audit_artifacts/360/fuzz_soak_latest.json` and `audit_artifacts/360/rust_differential_matrix.json`, and the pre-tag receipt `audit_artifacts/620/pre_tag_receipt_v6.2.0.json` records its own audit command and result; the release notes name the same places.
+
+The package being published and its closing audit passing are separate facts. An audit that was not run makes no statement about the absence of defects.
+
+[Residual risks](https://github.com/b7n0de/proofbundle/blob/v6.2.0/RESTRISIKO_620.md)
+
+</details>
+
+## Quick start
+
+Install the verifier, download an example, then verify the local file.
+
+```bash
+python -m pip install proofbundle==6.2.0
+
+curl -fsSLo receipt.json \
+  https://raw.githubusercontent.com/b7n0de/proofbundle/v6.2.0/examples/example_bundle.json
+
+proofbundle verify receipt.json
+```
+
+Python 3.10 or newer. Installation and download use the network. **Verification reads the local file only.**
+
+<details>
+<summary>Exit codes and the tamper demo</summary>
+
+These exit codes apply to `proofbundle verify`, not to every command in the package.
+
+| Exit code | Meaning |
+|---|---|
+| `0` | Verified |
+| `1` | Verification failed |
+| `2` | Malformed input or usage error |
+| `3` | Relying party policy not met |
+
+`decision verify`, `outcome verify` and `relation-statement verify` have separate contracts in their own `--help`.
+
+To try deliberate tampering, install the evaluation extra and run the demo.
+
+```bash
+python -m pip install 'proofbundle[eval]==6.2.0'
+proofbundle demo
+```
+
+The demo checks an honest receipt, tampered variants and a sample swap. It exits with a nonzero code if a tamper is accepted.
+
+[Guided walkthrough](https://github.com/b7n0de/proofbundle/blob/dcac5aeec92e850443cf34d9c07ab5cd277fabe1/docs/DEMO.md) · [Inspect walkthrough](https://github.com/b7n0de/proofbundle/blob/dcac5aeec92e850443cf34d9c07ab5cd277fabe1/docs/INSPECT_HAPPY_PATH.md)
+
+</details>
+
+## What a receipt proves
+
+| What verification can establish | What it does not establish |
+|---|---|
+| Which key signed the content | Whether you should trust that key |
+| Whether signed content has changed | Whether the reported result is true |
+| Whether supplied proofs and requested policy checks pass | Whether the work was correct or complete |
+
+**A valid signature does not make a reported result true.** Checks depend on the receipt format and the policy you request.
+
+[Threat model](https://github.com/b7n0de/proofbundle/blob/dcac5aeec92e850443cf34d9c07ab5cd277fabe1/THREAT_MODEL.md) · [Non claims](https://github.com/b7n0de/proofbundle/blob/dcac5aeec92e850443cf34d9c07ab5cd277fabe1/docs/NON_CLAIMS.md)
+
+<a name="choose-the-path-that-matches-your-task"></a>
+
+## Choose your task
+
+| I want to | Start here |
+|---|---|
+| Verify a receipt | [Quick start](#quick-start) |
+| Create evaluation evidence | [Evaluation walkthrough](https://github.com/b7n0de/proofbundle/blob/dcac5aeec92e850443cf34d9c07ab5cd277fabe1/docs/DEMO.md) |
+| Add receipts to Inspect AI | [Inspect integration](https://github.com/b7n0de/proofbundle/blob/dcac5aeec92e850443cf34d9c07ab5cd277fabe1/docs/INSPECT_HAPPY_PATH.md) |
+| Assess proofbundle for adoption | [Adversarial review guide](https://github.com/b7n0de/proofbundle/blob/dcac5aeec92e850443cf34d9c07ab5cd277fabe1/docs/REVIEWERS.md) |
+
+<details>
+<summary>Other workflows and optional features</summary>
+
+| Workflow | Package or reference |
+|---|---|
+| Evaluation receipts and preregistration | `proofbundle[eval]` · [Claim format](https://github.com/b7n0de/proofbundle/blob/dcac5aeec92e850443cf34d9c07ab5cd277fabe1/EVAL_CLAIM.md) |
+| Inspect AI | `proofbundle[inspect]` · [Integration guide](https://github.com/b7n0de/proofbundle/blob/dcac5aeec92e850443cf34d9c07ab5cd277fabe1/docs/INSPECT_HAPPY_PATH.md) |
+| Agent review disclosures | [Profile inventory](https://github.com/b7n0de/proofbundle/blob/dcac5aeec92e850443cf34d9c07ab5cd277fabe1/docs/predicates/README.md) · [Conformance examples](https://github.com/b7n0de/proofbundle/tree/dcac5aeec92e850443cf34d9c07ab5cd277fabe1/conformance/agent_review) |
+| RFC 3161 and OpenTimestamps | `proofbundle[anchors]` · [Anchor guide](https://github.com/b7n0de/proofbundle/blob/dcac5aeec92e850443cf34d9c07ab5cd277fabe1/docs/ANCHORS.md) |
+| ML-DSA-44 witness cosignatures | `proofbundle[pq]` · [Anchor guide](https://github.com/b7n0de/proofbundle/blob/dcac5aeec92e850443cf34d9c07ab5cd277fabe1/docs/ANCHORS.md) |
+| TEE attestation bridge | `proofbundle[experimental]` · [Experimental bridge](https://github.com/b7n0de/proofbundle/blob/dcac5aeec92e850443cf34d9c07ab5cd277fabe1/docs/EXPERIMENTAL_ENCLAVE.md) |
+
+Shipped features do not all have the same maturity. Agent review disclosures are self declarations. Anchor and enclave paths have experimental boundaries. Check the [predicate inventory](https://github.com/b7n0de/proofbundle/blob/dcac5aeec92e850443cf34d9c07ab5cd277fabe1/docs/predicates/README.md) for the exact profile before relying on it.
+
+</details>
+
+## Documentation
+
+| Your question | Reference |
+|---|---|
+| How do I implement the format? | [Specification](https://github.com/b7n0de/proofbundle/blob/dcac5aeec92e850443cf34d9c07ab5cd277fabe1/SPEC.md) · [Conformance](https://github.com/b7n0de/proofbundle/blob/dcac5aeec92e850443cf34d9c07ab5cd277fabe1/CONFORMANCE.md) |
+| How do I integrate my workflow? | [Integrations](https://github.com/b7n0de/proofbundle/blob/dcac5aeec92e850443cf34d9c07ab5cd277fabe1/INTEGRATIONS.md) · [Glossary](https://github.com/b7n0de/proofbundle/blob/dcac5aeec92e850443cf34d9c07ab5cd277fabe1/docs/GLOSSARY.md) |
+| Which keys and claims should I accept? | [Policies](https://github.com/b7n0de/proofbundle/blob/dcac5aeec92e850443cf34d9c07ab5cd277fabe1/docs/POLICY_PROFILES.md) · [Trust anchors](https://github.com/b7n0de/proofbundle/blob/dcac5aeec92e850443cf34d9c07ab5cd277fabe1/docs/TRUST_ANCHORS.md) |
+| How is security assessed? | [Threat model](https://github.com/b7n0de/proofbundle/blob/dcac5aeec92e850443cf34d9c07ab5cd277fabe1/THREAT_MODEL.md) · [Security policy](https://github.com/b7n0de/proofbundle/blob/dcac5aeec92e850443cf34d9c07ab5cd277fabe1/SECURITY.md) |
+| How was this release prepared? | [Release process](https://github.com/b7n0de/proofbundle/blob/dcac5aeec92e850443cf34d9c07ab5cd277fabe1/RELEASE.md) · [Pre tag audit](https://github.com/b7n0de/proofbundle/blob/dcac5aeec92e850443cf34d9c07ab5cd277fabe1/docs/PRE_TAG_AUDIT.md) |
+
+<a name="how-it-works"></a>
+
+<details>
+<summary>How it works</summary>
+
+```text
+Your evaluation, review, decision or action
+                    ↓
+Canonical statement, signature and supplied proofs
+                    ↓
+One portable receipt file
+                    ↓
+Offline verification and explicit policy checks
+```
+
+The verifier checks the evidence it receives. Expected subjects, trusted keys, freshness requirements and acceptance policies come from the relying party. Missing evidence is not evidence that omitted work never happened.
+
+</details>
+
+<a name="capabilities-and-maturity"></a>
+
+<details>
+<summary>Capabilities and maturity</summary>
+
+The core supports signed receipts and Merkle inclusion proofs. Evaluation receipts can bind metrics, thresholds, provenance and commitments. Selective disclosure can hide selected values while preserving the checks supported by its profile.
+
+Decision receipts record a verdict over named evidence. That does not establish that the decision was correct. Outcome, relation, run ledger, trust pack and verification summary profiles have their own maturity limits.
+
+The Rust cross verifier is experimental and advisory. Agreement on recorded cases does not prove either implementation correct, and the Rust tool is not part of the Python package.
+
+[Predicate inventory](https://github.com/b7n0de/proofbundle/blob/dcac5aeec92e850443cf34d9c07ab5cd277fabe1/docs/predicates/README.md) · [Conformance boundaries](https://github.com/b7n0de/proofbundle/blob/dcac5aeec92e850443cf34d9c07ab5cd277fabe1/CONFORMANCE.md)
+
+</details>
+
+<a name="security-and-trust"></a>
+<a name="openssf-scorecard"></a>
+
+<details>
+<summary>Security and trust</summary>
+
+The core uses `cryptography` and `rfc8785`, rather than implementing its own cryptographic primitives. The test approach includes external vectors, mutation checks and parser fuzzing. Those are test signals, not a proof of correctness.
+
+Receipt signatures are Ed25519, not post quantum. ML-DSA-44 witness cosignatures and the experimental renewal path do not turn the payload signature into a post quantum signature. See the [anchor documentation](https://github.com/b7n0de/proofbundle/blob/dcac5aeec92e850443cf34d9c07ab5cd277fabe1/docs/ANCHORS.md).
+
+Build provenance and package attestations answer questions about the build and its bytes. They do not establish the truth of an evaluation or replace a security audit. See the [release process](https://github.com/b7n0de/proofbundle/blob/dcac5aeec92e850443cf34d9c07ab5cd277fabe1/RELEASE.md).
+
+[Report a vulnerability](https://github.com/b7n0de/proofbundle/blob/dcac5aeec92e850443cf34d9c07ab5cd277fabe1/SECURITY.md) · [Conformance](https://github.com/b7n0de/proofbundle/blob/dcac5aeec92e850443cf34d9c07ab5cd277fabe1/CONFORMANCE.md) · [Adoption review](https://github.com/b7n0de/proofbundle/blob/dcac5aeec92e850443cf34d9c07ab5cd277fabe1/docs/REVIEWERS.md)
+
+The [OpenSSF Scorecard](https://scorecard.dev/viewer/?uri=github.com/b7n0de/proofbundle) is a heuristic, not a product verdict. Read the [per check explanations](https://github.com/b7n0de/proofbundle/blob/dcac5aeec92e850443cf34d9c07ab5cd277fabe1/docs/SCORECARD.md) and [self assessment](https://github.com/b7n0de/proofbundle/blob/dcac5aeec92e850443cf34d9c07ab5cd277fabe1/docs/openssf_best_practices_self_assessment.md).
+
+</details>
+
+<a name="standards-and-interoperability"></a>
+
+<details>
+<summary>Standards and interoperability</summary>
+
+proofbundle complements other evidence systems. A format mapping or an open proposal is not the same as adoption by the upstream project.
+
+[Tool comparison](https://github.com/b7n0de/proofbundle/blob/dcac5aeec92e850443cf34d9c07ab5cd277fabe1/INTEROP.md) · [Receipt envelope profile](https://github.com/b7n0de/proofbundle/blob/dcac5aeec92e850443cf34d9c07ab5cd277fabe1/docs/RECEIPT_ENVELOPE_PROFILE.md) · [in-toto mapping](https://github.com/b7n0de/proofbundle/blob/dcac5aeec92e850443cf34d9c07ab5cd277fabe1/docs/IN_TOTO_PROFILE.md) · [SCITT mapping](https://github.com/b7n0de/proofbundle/blob/dcac5aeec92e850443cf34d9c07ab5cd277fabe1/docs/SCITT_CPB_MAPPING.md) · [Related work](https://github.com/b7n0de/proofbundle/blob/dcac5aeec92e850443cf34d9c07ab5cd277fabe1/docs/RELATED_WORK.md)
+
+The [interop discussion with inspect-receipts](https://github.com/b7n0de/proofbundle/issues/147) records a specific envelope comparison. It must not be read as evidence of a second independent implementation of every predicate.
+
+</details>
+
+<a name="scope"></a>
+<a name="citation"></a>
+<a name="contributing"></a>
+
+<details>
+<summary>Scope, citation and contributing</summary>
+
+proofbundle is not a hosted transparency service, a complete in-toto client, a trusted execution environment, a consensus system or a compliance product by itself.
+
+[Release scope](https://github.com/b7n0de/proofbundle/blob/dcac5aeec92e850443cf34d9c07ab5cd277fabe1/docs/release_scope/6.1.0.md) records what belongs to this release. [Deferred work](https://github.com/b7n0de/proofbundle/blob/dcac5aeec92e850443cf34d9c07ab5cd277fabe1/docs/release_scope/6.2.0.md) is not a delivered capability.
+
+Use [CITATION.cff](https://github.com/b7n0de/proofbundle/blob/dcac5aeec92e850443cf34d9c07ab5cd277fabe1/CITATION.cff) for citation metadata. The software archive has concept DOI [10.5281/zenodo.21110642](https://doi.org/10.5281/zenodo.21110642). The Technical Note has concept DOI [10.5281/zenodo.21230466](https://doi.org/10.5281/zenodo.21230466). Software and Technical Note versions are separate records.
+
+[Contributing guide](https://github.com/b7n0de/proofbundle/blob/dcac5aeec92e850443cf34d9c07ab5cd277fabe1/CONTRIBUTING.md) · [Code of Conduct](https://github.com/b7n0de/proofbundle/blob/dcac5aeec92e850443cf34d9c07ab5cd277fabe1/CODE_OF_CONDUCT.md) · [Good first issues](https://github.com/b7n0de/proofbundle/labels/good-first-issue) · [Security reports](https://github.com/b7n0de/proofbundle/blob/dcac5aeec92e850443cf34d9c07ab5cd277fabe1/SECURITY.md)
+
+</details>
+
+<a name="license"></a>
+
+---
+
+[MIT license](https://github.com/b7n0de/proofbundle/blob/dcac5aeec92e850443cf34d9c07ab5cd277fabe1/LICENSE) · Part of [b7n0de](https://b7n0de.com), Verified AI Work