sengol-verify 2.1.0__tar.gz

sengol_verify-2.1.0/.github/workflows/ci.yml

@@ -0,0 +1,53 @@
+name: ci
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install uv
+        uses: astral-sh/setup-uv@v3
+        with:
+          python-version: "3.11"
+      - run: uv sync
+      - name: ruff
+        run: |
+          uv run ruff check .
+          uv run ruff format --check .
+      - name: pytest
+        run: uv run pytest -q
+
+  import-guard:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install uv
+        uses: astral-sh/setup-uv@v3
+        with:
+          python-version: "3.11"
+      - run: uv sync
+      - name: sengol must never be importable as a dependency of sengol_verify
+        run: uv run pytest -q tests/test_no_sengol_dependency.py
+      - name: built wheel metadata declares no sengol dependency
+        run: |
+          uv build --wheel -o /tmp/dist
+          python3 - <<'EOF'
+          import glob, zipfile
+
+          wheel = sorted(glob.glob("/tmp/dist/*.whl"))[0]
+          with zipfile.ZipFile(wheel) as zf:
+              metadata_name = next(n for n in zf.namelist() if n.endswith("METADATA"))
+              metadata = zf.read(metadata_name).decode()
+
+          for line in metadata.splitlines():
+              if line.startswith("Requires-Dist:") and "sengol-verify" not in line:
+                  assert "sengol" not in line.lower().split(":", 1)[1].split(";")[0], (
+                      f"wheel depends on sengol: {line!r}"
+                  )
+          print("OK: wheel declares no sengol dependency")
+          EOF

sengol_verify-2.1.0/.github/workflows/publish.yml

@@ -0,0 +1,43 @@
+# Publishes sengol-verify to PyPI through a trusted publisher (OIDC): no API
+# token is stored anywhere. PyPI must list this repository, this workflow file
+# name and no environment as the trusted publisher for the project.
+name: publish
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      testpypi:
+        description: Publish to TestPyPI instead of PyPI (proves the OIDC exchange only)
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+      - name: Build sdist and wheel
+        run: uv build
+      - name: Guard the wheel against a sengol dependency
+        run: |
+          uv run --no-project --with ./dist/*.whl python - <<'PY'
+          import importlib.metadata as m
+          reqs = m.requires("sengol-verify") or []
+          assert not any(r.split()[0].lower().startswith("sengol") for r in reqs), reqs
+          print("requires:", reqs)
+          PY
+      # TestPyPI needs its own pending publisher at test.pypi.org (same repo,
+      # workflow file name and no environment).
+      - name: Publish to TestPyPI
+        if: inputs.testpypi
+        run: uv publish --publish-url https://test.pypi.org/legacy/
+      - name: Publish
+        if: ${{ !inputs.testpypi }}
+        run: uv publish

sengol_verify-2.1.0/.gitignore

@@ -0,0 +1,8 @@
+__pycache__/
+*.pyc
+.venv/
+.pytest_cache/
+.ruff_cache/
+*.egg-info/
+dist/
+build/

sengol_verify-2.1.0/AGENTS.md

@@ -0,0 +1,11 @@
+# AGENTS.md — sengol-verify
+
+## Code Review Rules
+
+- Review only defects introduced or exposed by this PR.
+- Report only actionable correctness, security, reliability, or breaking-change issues.
+- Do not report formatting, naming preferences, speculative improvements, or unrelated existing problems.
+- Do not repeat an issue already reported unless the latest commit failed to fix it.
+- Before reporting a finding, verify it against the current PR head.
+- Prefer one consolidated review with at most 5 findings, ordered by severity.
+- If no material issues remain, approve without suggesting additional improvements.

sengol_verify-2.1.0/CLAUDE.md

@@ -0,0 +1,12 @@
+@AGENTS.md
+
+# CLAUDE.md — sengol-verify
+
+## Pull Request Review Workflow
+
+- Collect all review comments before making changes.
+- Validate each comment; do not implement incorrect or purely stylistic suggestions.
+- Fix accepted comments as one batch, run tests, and push once.
+- Do not push separately after every individual fix.
+- Perform at most two review/fix rounds.
+- After two rounds, summarize remaining disagreements and wait for human direction.

sengol_verify-2.1.0/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

sengol_verify-2.1.0/PKG-INFO

@@ -0,0 +1,218 @@
+Metadata-Version: 2.5
+Name: sengol-verify
+Version: 2.1.0
+Summary: Standalone, offline verifier for sengol signed evidence bundles
+Project-URL: Homepage, https://github.com/sengol/sengol-verify
+Author: Sengol
+License-Expression: Apache-2.0
+License-File: LICENSE
+Keywords: audit,evidence,offline,sengol,verification
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Security
+Requires-Python: >=3.11
+Requires-Dist: cryptography>=41
+Requires-Dist: rfc8785
+Description-Content-Type: text/markdown
+
+# sengol-verify
+
+A standalone, offline verifier for [Sengol](https://github.com/sengol) signed
+evidence bundles — the file `sengol audit export` produces.
+
+## What it verifies
+
+Given a bundle (records, Ed25519 countersignatures, Merkle anchor receipts,
+and public key material), it recomputes these checks entirely from the bytes
+in the file. Step 0 and step 7 are named for the checks of the same name in
+sengol's own verifier; the rest are numbered as before:
+
+0. **Canonical payload** — every record has a canonical payload at all. A
+   value with no RFC 8785 form (NaN, infinity, an integer beyond 2^53), a
+   payload version the family does not register, or a `record_type` this
+   tool does not register FAILs here, naming the record.
+1. **Payload hash integrity** — each record's canonical payload still
+   hashes to the value its countersignature committed to.
+2. **HMAC verification** — if the bundle embeds HMAC key material (rare;
+   normally withheld for security), the symmetric signature is checked too.
+3. **Hash-chain continuity** — `sequence_number` is monotone per
+   `(tenant_id, agent_id)` partition and every `prev_hash` links to the
+   previous record's canonical-payload hash.
+4. **Ed25519 countersignature verification** — each countersignature is
+   checked against its record's payload hash. The key it is checked against
+   decides what a pass means; see "Trusting the countersignature key" below.
+5. **Merkle anchor coverage** — each anchor receipt's Merkle root is
+   recomputed from its leaf hashes and compared.
+6. **Field coverage** — a report, not a check: it never FAILs. Every set
+   field is signed except the signature fields, the family's unsigned fields
+   and a few nested ones (an evaluator score's `reason` and `reason_status`,
+   a regression case binding's `config` and `reference`; all listed under
+   "How"), so steps 1-5 already cover everything else. This step names
+   which of those by-design unsigned fields the bundle's records actually
+   carry (for example `hmac_signature`, `eval_result.scores.reason`), so you
+   know which values no check vouches for. Its row always reads PASS; it does
+   not detect an edit to an unsigned field, and a record with an unregistered
+   `record_type` is not assessed (the detail says how many).
+7. **Signed-field presence** — the keys this tool would otherwise read with a
+   default (`record_id`, `tenant_id`, `agent_id`, `sequence_number`,
+   `prev_hash`, `key_id`, `payload_version`) are present on every record.
+   Nothing is refilled from a default here, so deleting any other signed key
+   changes the recomputed bytes and fails step 1 or 2; a record with no
+   `record_id` matches no countersignature and would otherwise read as merely
+   "not countersigned yet".
+
+If the bundle has an optional top-level `regression_evidence` section
+(`{"format": "sengol-regression-evidence/v1", "agent_id": ..., "records":
+[{"family": ..., "record": {...}}]}`), a seventh step, **`regression_lineage`**,
+is added. Any other `format` FAILs, and every record's signed `agent_id` must
+equal the section's `agent_id`. Every family is one of the six regression
+families (failure, case, run, certification, and the unsigned retirement and
+waiver; unknown = FAIL), each record's canonical payload / HMAC (UNVERIFIABLE without
+`public_keys["hmac_material"]`) checks out, and every link
+resolves (case -> failure, retirement -> case, waiver -> failure, run
+`case_results` -> case, certification `run_id` -> a run in the section, and
+its `run_payload_sha256` -> that run's canonical-payload hash, with the same
+`agent_version` as the run). A certification with no `run_payload_sha256`
+FAILs, because it binds no run (sengol's deploy gate refuses it the same way).
+Dangling ids and hash mismatches FAIL and are named. The signed records are not chained, so a deleted
+record is not detectable. Retirements and waivers are exported unsigned (sengol
+ADR-0024, families `RegressionCaseRetirement` and `ProductionFailureWaiver`),
+so they have no HMAC to check; only their `agent_id` and links are verified.
+The old signed families `RegressionCaseRetirementRecord` and
+`ProductionFailureWaiverRecord` are not registered and FAIL as unknown.
+Bundles without the section, or with it set to `null`, verify exactly as
+before.
+
+The verdict is **PASS**, **FAIL** (tampering or a broken chain), or
+**UNVERIFIABLE** (the bundle honestly doesn't carry enough — e.g. no
+countersignatures, no anchor receipts, or no trusted key). The exit code does
+not follow the verdict; see "Exit codes".
+
+## How
+
+Nothing here is normalized, coerced, or "cleaned up" before verification:
+this tool recomputes over the bytes exactly as stored, which is what makes
+offline verification meaningful months after the evidence was written. The
+canonical payload is built by the same rule sengol signs with (RFC 8785 over
+`{"record": <set fields>, "type": <family>}`, minus each family's unsigned
+fields, with unordered lists sorted), using signing tables vendored from
+sengol's `payload_registry.py` and `types.py`. They are not imported from
+sengol, so they can drift. Two things keep them honest: `scripts/crosscheck.py`
+compares them with a sengol checkout's own classes and bytes (every registered
+family at every payload version, a hash-chained partition of every audit
+family, a judge evidence pack), and the committed fixtures, which sengol itself
+signed, are replayed by the tests; `tests/test_sengol_tables.py` fails when a
+vendored table differs from the snapshot of sengol's. A sengol release newer
+than the snapshot is not covered until the fixtures are regenerated
+(`scripts/generate_fixtures.py`).
+
+Some fields of an exported record are outside the signature by design
+(sengol's `UNSIGNED_FIELDS`), so no check here covers them; the
+`field_coverage` row lists the ones a bundle's records carry:
+
+- an evaluator score's `reason` text and `reason_status` (sengol ADR-0078).
+  The signed `reason_digest` is a keyed HMAC under an install key this tool
+  never holds, so the text can be edited or erased without failing a check,
+  and this tool does not verify it. The digest itself is signed;
+- `CertificationRecord.evidence_pack_id` and `.anchor_record_id`,
+  `SaturationEvent.remediated_at`, the raw `config` and `reference` of a
+  regression case binding (their hashes are signed), and the `eval_result`,
+  `mcp_server_version`, `model`, token and cost fields of an
+  `AuthorizationDecisionRecord`;
+- `call_signature_manifests`, a transport-only field sengol removes before
+  storing a record.
+
+```bash
+pip install sengol-verify
+sengol-verify bundle.json --trusted-key appliance-key-1=appliance.pub.pem
+sengol-verify path/to/bundle-dir/ --trusted-keys-file trusted.json
+sengol-verify bundle.zip --trusted-key appliance-key-1=appliance.pub.pem
+sengol-verify bundle.json --trusted-key ... --json   # machine-readable
+```
+
+### Trusting the countersignature key
+
+A bundle's own `public_keys` is part of the file being checked: someone who
+rewrites every record can mint a new Ed25519 key, countersign with it, and embed
+its public half, and every check above still passes against that key. A
+countersignature that verifies against a key from the bundle proves the file is
+internally consistent, not which appliance produced it. Give the verifier the
+appliance's public key from outside the bundle (the operator, or the key you
+recorded at commissioning):
+
+- `--trusted-key KEY_ID=PEM_PATH`, repeatable: the Ed25519 public key (PEM
+  file) for countersignatures whose `key_id` is `KEY_ID`.
+- `--trusted-keys-file PATH`: a JSON object `{"key_id": "<pem>"}`. Applied
+  first, so a `--trusted-key` overrides one of its entries.
+
+With no trusted key, the `ed25519_countersig` step still checks each signature
+against the embedded key as a tamper signal but reports at most UNVERIFIABLE,
+and the command exits 3 with a message saying no trusted key was supplied. With
+any trusted key supplied (even an empty file, meaning "trust nothing"), only
+those keys are used: a countersignature whose `key_id` is not among them, or
+that does not verify against it, FAILs. The embedded key is then ignored.
+
+**A bundle with no countersignatures is not accepted, key or not.** If the
+countersignatures were stripped, or countersigning was never enabled, the step
+is UNVERIFIABLE even with a trusted key (nothing remains to check against it)
+and the command exits 3 with a message saying so. Re-export the bundle from the
+appliance with countersigning enabled, after its countersign outbox has drained
+(`sengol audit export --wait-for-countersign`), and verify that file. A bundle
+with no records and no countersignatures reads PASS on this step, in sengol and
+here, and exits 0.
+
+### Exit codes
+
+The codes are those of `sengol audit verify --offline` and follow the
+`ed25519_countersig` step result, not the overall verdict:
+
+| Code | Meaning |
+| ---- | ------- |
+| `0`  | No step FAILed and the `ed25519_countersig` step is PASS (countersignatures verified against a trusted key). An overall UNVERIFIABLE from `hmac_verify` (always UNVERIFIABLE offline: bundles carry no HMAC key) or `anchor_coverage` does not change this. |
+| `1`  | At least one step FAILed. Wins over every other outcome. |
+| `2`  | Usage error, unreadable bundle or keys file, or a malformed `--trusted-key`. |
+| `3`  | Nothing FAILed, but countersignature trust is not established: no trusted key was supplied, or a key was supplied and the bundle has no countersignatures. The message names which. Treat the bundle as not verified. |
+
+`--json` reports `trusted_key_supplied` and `countersignature_trust_established`
+(true exactly when the countersignature step is PASS).
+
+## What it never does
+
+`sengol-verify` never contacts Sengol, any Sengol-operated service, or any
+network endpoint at all. It reads one local file and prints a verdict. It
+requires no license, no API key, and no account — verification is a
+property of the bytes, not a service call.
+
+It also has **zero runtime dependency on the `sengol` package**. Its only
+third-party dependencies are [`cryptography`](https://cryptography.io) (for
+Ed25519) and [`rfc8785`](https://pypi.org/project/rfc8785/) (for the canonical
+JSON the signatures are computed over). This is enforced by a test that imports `sengol_verify` with
+`sengol` absent from `sys.modules` and asserts nothing named `sengol` or
+`sengol.*` gets imported as a side effect.
+
+## Scope
+
+This tool implements the offline bundle format as of `payload_registry.py`
+in sengol at the time it was vendored, including the call-start,
+accepted-set-lease, guard-decision (`sengol.guard.decision`) and dataset-rows-reveal
+(`sengol.audit.dataset_rows_reveal`) families. It verifies the signed commitment values of a
+guard decision as part of the record; it does not recompute a text or context commitment, because
+a bundle carries neither the text nor its nonce. It registers only families sengol signs: the
+families sengol has stopped signing (agent registration and secret records,
+retention and legal-hold records, signed regression retirements and waivers,
+and the like) are not registered. A bundle record whose `record_type` is not
+registered, whether one of those or a type this tool has never heard of, has
+no canonical payload here: `payload_hash_integrity` FAILs and names the
+record and its `record_type`, and the other steps that need its payload fail
+with it. It is never verified as a generic record. A `regression_evidence`
+entry naming a family that is not one of the six regression families FAILs as
+an unknown family. An export of such a record from an older sengol therefore cannot be
+verified with this version. It does not verify anything Sengol didn't sign —
+trace IDs, span IDs, and other fields documented as outside every canonical
+payload are not assessed by design.
+
+## License
+
+Apache-2.0. See `LICENSE`.