sum-engine 0.8.0__tar.gz → 0.9.0__tar.gz

{sum_engine-0.8.0/sum_engine.egg-info → sum_engine-0.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sum-engine
-Version: 0.8.0
+Version: 0.9.0
 Summary: SUM — bidirectional knowledge distillation with optional cryptographic attestation. Pipe prose, get a CanonicalBundle (HMAC / Ed25519 / W3C VC 2.0), verify anywhere.
 Author: ototao
 License: Apache-2.0
@@ -44,11 +44,11 @@ Provides-Extra: research
 Requires-Dist: numpy>=1.24.0; extra == "research"
 Requires-Dist: scipy>=1.10.0; extra == "research"
 Provides-Extra: judge
-Requires-Dist: transformers>=4.30.0; extra == "judge"
+Requires-Dist: transformers<5,>=4.30.0; extra == "judge"
 Requires-Dist: torch>=2.0.0; extra == "judge"
 Requires-Dist: sentencepiece>=0.1.99; extra == "judge"
 Provides-Extra: omni-format
-Requires-Dist: markitdown==0.1.5; extra == "omni-format"
+Requires-Dist: markitdown==0.1.6; extra == "omni-format"
 Provides-Extra: dev
 Requires-Dist: pytest>=7.0.0; extra == "dev"
 Requires-Dist: pytest-asyncio>=0.21.0; extra == "dev"
@@ -76,8 +76,24 @@ Dynamic: license-file
 [![Python 3.10+](https://img.shields.io/badge/python-3.10+-blue.svg)](https://www.python.org/downloads/)
 [![Apache 2.0](https://img.shields.io/badge/license-Apache%202.0-blue.svg)](LICENSE)
 
+**What it is, plainly.** SUM is a knowledge **distiller**: drop in a text and a slider renders it anywhere from a single tag to a full tome — and it hands back a *signed, offline-checkable receipt of how much of the original meaning survived*. So you can vouch for AI-transformed text to a skeptic without asking them to trust you. The distiller is the long-term aim; the signed receipt is the rung that makes lossy distillation trustworthy enough to build on.
+
 > **SUM lets people and agents transform knowledge without losing the ability to verify what changed, what stayed the same, who signed it, and what remains unproven.**
 
+**See what an AI transform silently dropped.** `sum meaning-diff` reads out, per document, which source claims survived a rewrite and which vanished. Here it is on a shipped fixture — a four-clause lease notice rewritten as verse:
+
+```text
+$ sum meaning-diff examples/poetry_frontier/source.txt examples/poetry_frontier/sonnet.txt --scorer nli
+  preservation: 55%   (loss 0.450)
+  source claims: 4 — 1 preserved, 3 DROPPED:
+     ✗ Late payment after the fifth day incurs a 50 dollar fee.
+     ✗ The landlord must give 24 hours notice before entering the unit.
+     ✗ Either party may terminate this lease with 30 days written notice.
+  added / unsupported claims: none ✓
+  (measured for THIS document under the named NLI judge — a per-document MEASUREMENT,
+   not a guarantee; for a (1−δ) corpus bound use a signed meaning_risk receipt)
+```
+
 Every transformation — extract triples from prose, render a tome at a controlled slider position, compose bundles across documents, share a render — emits a cryptographically-signed receipt that any third party can verify offline. The receipt attests *that the transformation happened and what its inputs were*. Separate per-axis benchmarks attest *how much the transformation preserved meaning*. Both are kept honest by separate proof discipline — and the project never blurs the line between them.
 
 *Live trust loop:* https://sum-demo.ototao.workers.dev — three runtimes (Python, Node, modern browsers) produce byte-identical Ed25519 signatures over the same JCS-canonical bytes; verify offline against `/.well-known/jwks.json`. Mechanically proven; locked in CI on every PR.
@@ -110,14 +126,37 @@ SUM is built to be that layer **in the open**: Apache-2.0, offline-verifiable by
 
 ## Verify it yourself in 60 seconds
 
-The trust loop: hit the live Worker, get back a tome plus a detached Ed25519 JWS over the JCS-canonicalised receipt payload, fetch the issuer JWKS, verify.
+**The differentiator — replay a meaning-loss bound, fully offline.** SUM's flagship receipt is a *signed, replayable* certificate over a named meaning-loss proxy. The verifier is dependency-light (`cryptography` + `joserfc` only — no numpy / scipy / torch, no GPU, no network), and a real binding-gate golden over public-domain text (BillSum, CC0) **ships inside the wheel** — so this works straight from `pip`, no clone:
+
+```bash
+pip install 'sum-engine[verify]'        # cryptography + joserfc only
+python -m sum_verify --demo             # replays the bundled BillSum golden, offline
+# → {"verified": true, "schema": "sum.meaning_risk_receipt.v1", "replayed": true,
+#    "scorer": "bidirectional-entailment[minilm-cosine-0.5]",
+#    "not_covered": ["arrangement","sound","connotation","implicature"],
+#    "proxy_caveat": "verified=true is a cryptographic fact ... the proxy
+#       correlated only modestly at summary level (Spearman rho ~0.27-0.33 on
+#       SummEval; NLI ~0.29 replicates on FRANK; the embedding judge is
+#       corpus-dependent, near zero on abstractive FRANK-XSum). Not a
+#       substitute for human review."}
+```
+
+To verify *your own* receipt — or the source goldens from a git checkout — pass the files explicitly:
+
+```bash
+python -m sum_verify <receipt.json> --jwks <jwks.json> --losses <losses.json>
+# from a checkout, the binding-gate goldens live in fixtures/meaning_receipts_billsum/
+```
+
+`verified: true` + `replayed: true` means the committed per-pair losses hash to the receipt's anchor and re-certify to its stated bound (≤ 0.6454 at 95%) by exact integer equality — on your machine, against the issuer's JWKS, trusting nobody. **Read the `proxy_caveat`:** that PASS is a *cryptographic* fact, not proof meaning was preserved — the bound is over a proxy that tracks human judgment only modestly. The richer readout (the bound itself, perspective cohorts) is `sum verify-meaning` (which needs the heavier `pip install "sum-engine[research,receipt-verify]"` — the no-numpy promise above is scoped to `python -m sum_verify`); for non-extractive rewrites use `--scorer nli` — [`examples/poetry_frontier/`](examples/poetry_frontier/) shows exactly where the embedding judge's blind spot is.
+
+**The render trust loop (signed provenance).** The other receipt family attests *that* a transformation happened (issuer, inputs, slider position, model, time) — the same JWS verifiable byte-for-byte in three independent runtimes:
 
 ```bash
-# 1. JWKS — single Ed25519 OKP JWK, application/jwk-set+json
+# JWKS — single Ed25519 OKP JWK, application/jwk-set+json
 curl -sS https://sum-demo.ototao.workers.dev/.well-known/jwks.json | jq .
-# → {"keys":[{"crv":"Ed25519","kty":"OKP","x":"...","alg":"EdDSA","use":"sig","kid":"sum-render-2026-04-27-1"}]}
 
-# 2. Render — tome + render_receipt (signed JWS over JCS payload)
+# Render — tome + render_receipt (signed JWS over JCS payload)
 curl -sS -X POST https://sum-demo.ototao.workers.dev/api/render \
   -H 'content-type: application/json' \
   -d '{"triples":[["alice","graduated","2012"],["alice","born","1990"]],
@@ -125,7 +164,7 @@ curl -sS -X POST https://sum-demo.ototao.workers.dev/api/render \
   | jq '.render_receipt | {schema, kid, payload, jws_segments: (.jws | split(".") | length)}'
 ```
 
-A minimal Node verifier using `jose` + `canonicalize` is in [`docs/RENDER_RECEIPT_FORMAT.md`](docs/RENDER_RECEIPT_FORMAT.md) §A.5; the same format is reachable from Python (`joserfc` + `jcs`), Go, and Rust per §3.
+A render receipt attests the *render*, not the truth of its content (trust scope in [`docs/RENDER_RECEIPT_FORMAT.md`](docs/RENDER_RECEIPT_FORMAT.md) §5); a minimal Node verifier using `jose` + `canonicalize` is in §A.5, and the same format is reachable from Python (`joserfc` + `jcs`), Go, and Rust per §3.
 
 ---
 
@@ -143,6 +182,7 @@ A minimal Node verifier using `jose` + `canonicalize` is in [`docs/RENDER_RECEIP
 | Replay-defense window (`signed_at_out_of_window`) | shipped | opt-in `max_age_seconds` parameter across all four verifier surfaces (Python render / Python transform / JS render / JS transform). Default-off preserves archival use; receivers opt in per use-case (agent-swarm 60s, real-time 600s, newsletter 1d, legal-discovery no window). |
 | `sum verify --explain` layered output | shipped | Per-dimension report (`sum.verify_explained.v1`): cryptographic integrity / canonical reconstruction / axiom consistency / extraction provenance / source evidence coverage / semantic preservation / truth of content. Each carries `epistemic_status` (`provable` / `certified` / `empirical-benchmark` / `not-asserted`). Truth of content is ALWAYS `not_asserted` — locked by test. |
 | Meaning-loss receipts + `sum_verify` SDK | shipped on PyPI ≥ 0.8.0 | `sum.meaning_risk_receipt.v1` — a signed, replayable, distribution-free bound on a *named meaning-loss proxy* (`pip install 'sum-engine[verify]'` → `import sum_verify` / `python -m sum_verify`, dependency-light: no numpy/scipy/torch). Plus `sum meaning-diff` (per-document "what was kept / dropped / added"), `sum drift-budget` (compose meaning-loss across a transform chain), and `sum exchangeability` (advisory: is a bound applicable to *your* text?). Research-flagged; the affirmative contribution behind arXiv Paper-1. |
+| Certified chains + transparency log | on main; shipping in 0.9.0 | `sum.chain_receipt.v1` binds ordered hop receipts (by canonical hash + an order-binding `chain_id`) into an integer-exact Bonferroni budget with a joint confidence (`sum mint-chain`; verify with `python -m sum_verify … --hops`). The first REAL certified chain over public-domain text is committed at [`fixtures/chain_receipts_billsum/`](fixtures/chain_receipts_billsum/): BillSum (CC0), 2 real hops — the dataset's own reference summary, then deterministic lead-N extractive compression — under the strict NLI judge; budget ≤ 1.3546 at joint confidence 0.90. Honest by construction: the budget bounds the *sum* of per-hop expected losses, **not** the end-to-end loss (a directed loss, not a metric, so no triangle inequality holds), and the mandatory `budget_scope` field says exactly that. Every committed golden is witnessed in an append-only [`transparency/log.jsonl`](transparency/log.jsonl) (`python scripts/witness_receipt.py verify`). |
 | Negative-control corpus (T5 of bench-hardening) | shipped | 20 hand-authored documents across 5 failure modes (ambiguous coref / predicate-alias / contradictions / entity-resolution-adversarial / non-extractable). Runner exits 1 if observed failures don't match annotations. Baseline at [`fixtures/bench_receipts/negative_control_2026-05-17.json`](fixtures/bench_receipts/negative_control_2026-05-17.json). |
 | Compliance validators (six regimes) | shipped | `sum compliance check --regime <id> --audit-log <path>` — EU AI Act Article 12, GDPR Article 30, HIPAA § 164.312(b), ISO/IEC 27001 A.8.15, SOC 2 CC 7.2, PCI DSS v4.0 Req 10. All six produce the same `sum.compliance_report.v1` schema; per-regime docs at `docs/COMPLIANCE_*.md`. |
 
@@ -194,7 +234,7 @@ echo "Alice likes cats. Bob owns a dog." \
   | sum attest --extractor=sieve > bundle.json
 
 sum verify --input bundle.json
-# → sum: ✓ verified 2 axiom(s), state integer matches (hmac=absent, ed25519=absent)
+# → sum: ✓ verified 2 axiom(s), state integer matches (hmac=absent, ed25519=absent, extractor=sieve (verifiable))
 
 sum render < bundle.json > tome.md
 # → bundle's axioms re-emitted as canonical prose; round-trips to the same state integer
@@ -216,7 +256,7 @@ Add cryptographic attestation with one flag:
 # Ed25519 / W3C VC 2.0 (eddsa-jcs-2022)
 python -m scripts.generate_did_web --domain your.example --private-key-out keys/issuer.pem
 sum attest --ed25519-key keys/issuer.pem < prose.txt | sum verify --strict
-# → hmac=absent, ed25519=verified
+# → hmac=absent, ed25519=verified, extractor=sieve (verifiable)
 ```
 
 The same bundle bytes verify under `sum verify` (Python), `node standalone_verifier/verify.js` (WebCrypto), and the in-browser demo (SubtleCrypto). [`docs/DID_SETUP.md`](docs/DID_SETUP.md) walks the did:key / did:web issuer setup. [`docs/PROOF_BOUNDARY.md`](docs/PROOF_BOUNDARY.md) §1.3.1 documents what the cross-runtime Ed25519 contract proves.
@@ -295,7 +335,7 @@ Less-surfaced but shipped:
 
 ### Internal research surfaces (NOT shipped, present in repo)
 
-- **`api/quantum_router.py` + `quantum_main.py`** — FastAPI surface with 26+ endpoints (branchable knowledge graph, ZK semantic proofs, federated KG sync, JWT-tenant knowledge OS). 1,684 LOC; 58/58 tests pass; runs locally via `uvicorn quantum_main:app`. **NOT in the PyPI wheel** (`pyproject.toml` excludes `api*`), **NOT in the live Worker**, **NOT in the dogfood quickstart**. The substrate it composes is load-bearing for the shipping surfaces above; only the FastAPI HTTP layer is internal-research. Promote to a shipping `[api]` extra only if a named buyer or grant deliverable explicitly references one of the endpoint clusters. See top-of-file banner in `api/quantum_router.py` for the full triage rationale.
+- **`api/quantum_router.py` + `quantum_main.py`** — FastAPI surface with 26+ endpoints (branchable knowledge graph, ZK semantic proofs, federated KG sync, JWT multi-tenant API). 1,684 LOC; 58/58 tests pass; runs locally via `uvicorn quantum_main:app`. **NOT in the PyPI wheel** (`pyproject.toml` excludes `api*`), **NOT in the live Worker**, **NOT in the dogfood quickstart**. The substrate it composes is load-bearing for the shipping surfaces above; only the FastAPI HTTP layer is internal-research. Promote to a shipping `[api]` extra only if a named buyer or grant deliverable explicitly references one of the endpoint clusters. See top-of-file banner in `api/quantum_router.py` for the full triage rationale.
 
 ---
 
@@ -332,7 +372,7 @@ This roadmap names only unshipped work. Items already landed live in [`CHANGELOG
 
 **Platform surface (post-hardening)**
 
-Source anchoring in the bundle schema, bundle explorer / viewer, `sum verify --explain`, `sum tutorial` onboarding, shareable bundle URLs `/b/{hash}`, PWA-installable demo, `sum attest <url>` fetch mode. Each item names its dependency in [`docs/NEXT_SESSION_PLAYBOOK.md`](docs/NEXT_SESSION_PLAYBOOK.md).
+Source anchoring in the bundle schema, bundle explorer / viewer, `sum tutorial` onboarding, shareable bundle URLs `/b/{hash}`, PWA-installable demo, `sum attest <url>` fetch mode. Each item names its dependency in [`docs/NEXT_SESSION_PLAYBOOK.md`](docs/NEXT_SESSION_PLAYBOOK.md).
 
 ---
 

{sum_engine-0.8.0 → sum_engine-0.9.0}/README.md

@@ -5,8 +5,24 @@
 [![Python 3.10+](https://img.shields.io/badge/python-3.10+-blue.svg)](https://www.python.org/downloads/)
 [![Apache 2.0](https://img.shields.io/badge/license-Apache%202.0-blue.svg)](LICENSE)
 
+**What it is, plainly.** SUM is a knowledge **distiller**: drop in a text and a slider renders it anywhere from a single tag to a full tome — and it hands back a *signed, offline-checkable receipt of how much of the original meaning survived*. So you can vouch for AI-transformed text to a skeptic without asking them to trust you. The distiller is the long-term aim; the signed receipt is the rung that makes lossy distillation trustworthy enough to build on.
+
 > **SUM lets people and agents transform knowledge without losing the ability to verify what changed, what stayed the same, who signed it, and what remains unproven.**
 
+**See what an AI transform silently dropped.** `sum meaning-diff` reads out, per document, which source claims survived a rewrite and which vanished. Here it is on a shipped fixture — a four-clause lease notice rewritten as verse:
+
+```text
+$ sum meaning-diff examples/poetry_frontier/source.txt examples/poetry_frontier/sonnet.txt --scorer nli
+  preservation: 55%   (loss 0.450)
+  source claims: 4 — 1 preserved, 3 DROPPED:
+     ✗ Late payment after the fifth day incurs a 50 dollar fee.
+     ✗ The landlord must give 24 hours notice before entering the unit.
+     ✗ Either party may terminate this lease with 30 days written notice.
+  added / unsupported claims: none ✓
+  (measured for THIS document under the named NLI judge — a per-document MEASUREMENT,
+   not a guarantee; for a (1−δ) corpus bound use a signed meaning_risk receipt)
+```
+
 Every transformation — extract triples from prose, render a tome at a controlled slider position, compose bundles across documents, share a render — emits a cryptographically-signed receipt that any third party can verify offline. The receipt attests *that the transformation happened and what its inputs were*. Separate per-axis benchmarks attest *how much the transformation preserved meaning*. Both are kept honest by separate proof discipline — and the project never blurs the line between them.
 
 *Live trust loop:* https://sum-demo.ototao.workers.dev — three runtimes (Python, Node, modern browsers) produce byte-identical Ed25519 signatures over the same JCS-canonical bytes; verify offline against `/.well-known/jwks.json`. Mechanically proven; locked in CI on every PR.
@@ -39,14 +55,37 @@ SUM is built to be that layer **in the open**: Apache-2.0, offline-verifiable by
 
 ## Verify it yourself in 60 seconds
 
-The trust loop: hit the live Worker, get back a tome plus a detached Ed25519 JWS over the JCS-canonicalised receipt payload, fetch the issuer JWKS, verify.
+**The differentiator — replay a meaning-loss bound, fully offline.** SUM's flagship receipt is a *signed, replayable* certificate over a named meaning-loss proxy. The verifier is dependency-light (`cryptography` + `joserfc` only — no numpy / scipy / torch, no GPU, no network), and a real binding-gate golden over public-domain text (BillSum, CC0) **ships inside the wheel** — so this works straight from `pip`, no clone:
+
+```bash
+pip install 'sum-engine[verify]'        # cryptography + joserfc only
+python -m sum_verify --demo             # replays the bundled BillSum golden, offline
+# → {"verified": true, "schema": "sum.meaning_risk_receipt.v1", "replayed": true,
+#    "scorer": "bidirectional-entailment[minilm-cosine-0.5]",
+#    "not_covered": ["arrangement","sound","connotation","implicature"],
+#    "proxy_caveat": "verified=true is a cryptographic fact ... the proxy
+#       correlated only modestly at summary level (Spearman rho ~0.27-0.33 on
+#       SummEval; NLI ~0.29 replicates on FRANK; the embedding judge is
+#       corpus-dependent, near zero on abstractive FRANK-XSum). Not a
+#       substitute for human review."}
+```
+
+To verify *your own* receipt — or the source goldens from a git checkout — pass the files explicitly:
+
+```bash
+python -m sum_verify <receipt.json> --jwks <jwks.json> --losses <losses.json>
+# from a checkout, the binding-gate goldens live in fixtures/meaning_receipts_billsum/
+```
+
+`verified: true` + `replayed: true` means the committed per-pair losses hash to the receipt's anchor and re-certify to its stated bound (≤ 0.6454 at 95%) by exact integer equality — on your machine, against the issuer's JWKS, trusting nobody. **Read the `proxy_caveat`:** that PASS is a *cryptographic* fact, not proof meaning was preserved — the bound is over a proxy that tracks human judgment only modestly. The richer readout (the bound itself, perspective cohorts) is `sum verify-meaning` (which needs the heavier `pip install "sum-engine[research,receipt-verify]"` — the no-numpy promise above is scoped to `python -m sum_verify`); for non-extractive rewrites use `--scorer nli` — [`examples/poetry_frontier/`](examples/poetry_frontier/) shows exactly where the embedding judge's blind spot is.
+
+**The render trust loop (signed provenance).** The other receipt family attests *that* a transformation happened (issuer, inputs, slider position, model, time) — the same JWS verifiable byte-for-byte in three independent runtimes:
 
 ```bash
-# 1. JWKS — single Ed25519 OKP JWK, application/jwk-set+json
+# JWKS — single Ed25519 OKP JWK, application/jwk-set+json
 curl -sS https://sum-demo.ototao.workers.dev/.well-known/jwks.json | jq .
-# → {"keys":[{"crv":"Ed25519","kty":"OKP","x":"...","alg":"EdDSA","use":"sig","kid":"sum-render-2026-04-27-1"}]}
 
-# 2. Render — tome + render_receipt (signed JWS over JCS payload)
+# Render — tome + render_receipt (signed JWS over JCS payload)
 curl -sS -X POST https://sum-demo.ototao.workers.dev/api/render \
   -H 'content-type: application/json' \
   -d '{"triples":[["alice","graduated","2012"],["alice","born","1990"]],
@@ -54,7 +93,7 @@ curl -sS -X POST https://sum-demo.ototao.workers.dev/api/render \
   | jq '.render_receipt | {schema, kid, payload, jws_segments: (.jws | split(".") | length)}'
 ```
 
-A minimal Node verifier using `jose` + `canonicalize` is in [`docs/RENDER_RECEIPT_FORMAT.md`](docs/RENDER_RECEIPT_FORMAT.md) §A.5; the same format is reachable from Python (`joserfc` + `jcs`), Go, and Rust per §3.
+A render receipt attests the *render*, not the truth of its content (trust scope in [`docs/RENDER_RECEIPT_FORMAT.md`](docs/RENDER_RECEIPT_FORMAT.md) §5); a minimal Node verifier using `jose` + `canonicalize` is in §A.5, and the same format is reachable from Python (`joserfc` + `jcs`), Go, and Rust per §3.
 
 ---
 
@@ -72,6 +111,7 @@ A minimal Node verifier using `jose` + `canonicalize` is in [`docs/RENDER_RECEIP
 | Replay-defense window (`signed_at_out_of_window`) | shipped | opt-in `max_age_seconds` parameter across all four verifier surfaces (Python render / Python transform / JS render / JS transform). Default-off preserves archival use; receivers opt in per use-case (agent-swarm 60s, real-time 600s, newsletter 1d, legal-discovery no window). |
 | `sum verify --explain` layered output | shipped | Per-dimension report (`sum.verify_explained.v1`): cryptographic integrity / canonical reconstruction / axiom consistency / extraction provenance / source evidence coverage / semantic preservation / truth of content. Each carries `epistemic_status` (`provable` / `certified` / `empirical-benchmark` / `not-asserted`). Truth of content is ALWAYS `not_asserted` — locked by test. |
 | Meaning-loss receipts + `sum_verify` SDK | shipped on PyPI ≥ 0.8.0 | `sum.meaning_risk_receipt.v1` — a signed, replayable, distribution-free bound on a *named meaning-loss proxy* (`pip install 'sum-engine[verify]'` → `import sum_verify` / `python -m sum_verify`, dependency-light: no numpy/scipy/torch). Plus `sum meaning-diff` (per-document "what was kept / dropped / added"), `sum drift-budget` (compose meaning-loss across a transform chain), and `sum exchangeability` (advisory: is a bound applicable to *your* text?). Research-flagged; the affirmative contribution behind arXiv Paper-1. |
+| Certified chains + transparency log | on main; shipping in 0.9.0 | `sum.chain_receipt.v1` binds ordered hop receipts (by canonical hash + an order-binding `chain_id`) into an integer-exact Bonferroni budget with a joint confidence (`sum mint-chain`; verify with `python -m sum_verify … --hops`). The first REAL certified chain over public-domain text is committed at [`fixtures/chain_receipts_billsum/`](fixtures/chain_receipts_billsum/): BillSum (CC0), 2 real hops — the dataset's own reference summary, then deterministic lead-N extractive compression — under the strict NLI judge; budget ≤ 1.3546 at joint confidence 0.90. Honest by construction: the budget bounds the *sum* of per-hop expected losses, **not** the end-to-end loss (a directed loss, not a metric, so no triangle inequality holds), and the mandatory `budget_scope` field says exactly that. Every committed golden is witnessed in an append-only [`transparency/log.jsonl`](transparency/log.jsonl) (`python scripts/witness_receipt.py verify`). |
 | Negative-control corpus (T5 of bench-hardening) | shipped | 20 hand-authored documents across 5 failure modes (ambiguous coref / predicate-alias / contradictions / entity-resolution-adversarial / non-extractable). Runner exits 1 if observed failures don't match annotations. Baseline at [`fixtures/bench_receipts/negative_control_2026-05-17.json`](fixtures/bench_receipts/negative_control_2026-05-17.json). |
 | Compliance validators (six regimes) | shipped | `sum compliance check --regime <id> --audit-log <path>` — EU AI Act Article 12, GDPR Article 30, HIPAA § 164.312(b), ISO/IEC 27001 A.8.15, SOC 2 CC 7.2, PCI DSS v4.0 Req 10. All six produce the same `sum.compliance_report.v1` schema; per-regime docs at `docs/COMPLIANCE_*.md`. |
 
@@ -123,7 +163,7 @@ echo "Alice likes cats. Bob owns a dog." \
   | sum attest --extractor=sieve > bundle.json
 
 sum verify --input bundle.json
-# → sum: ✓ verified 2 axiom(s), state integer matches (hmac=absent, ed25519=absent)
+# → sum: ✓ verified 2 axiom(s), state integer matches (hmac=absent, ed25519=absent, extractor=sieve (verifiable))
 
 sum render < bundle.json > tome.md
 # → bundle's axioms re-emitted as canonical prose; round-trips to the same state integer
@@ -145,7 +185,7 @@ Add cryptographic attestation with one flag:
 # Ed25519 / W3C VC 2.0 (eddsa-jcs-2022)
 python -m scripts.generate_did_web --domain your.example --private-key-out keys/issuer.pem
 sum attest --ed25519-key keys/issuer.pem < prose.txt | sum verify --strict
-# → hmac=absent, ed25519=verified
+# → hmac=absent, ed25519=verified, extractor=sieve (verifiable)
 ```
 
 The same bundle bytes verify under `sum verify` (Python), `node standalone_verifier/verify.js` (WebCrypto), and the in-browser demo (SubtleCrypto). [`docs/DID_SETUP.md`](docs/DID_SETUP.md) walks the did:key / did:web issuer setup. [`docs/PROOF_BOUNDARY.md`](docs/PROOF_BOUNDARY.md) §1.3.1 documents what the cross-runtime Ed25519 contract proves.
@@ -224,7 +264,7 @@ Less-surfaced but shipped:
 
 ### Internal research surfaces (NOT shipped, present in repo)
 
-- **`api/quantum_router.py` + `quantum_main.py`** — FastAPI surface with 26+ endpoints (branchable knowledge graph, ZK semantic proofs, federated KG sync, JWT-tenant knowledge OS). 1,684 LOC; 58/58 tests pass; runs locally via `uvicorn quantum_main:app`. **NOT in the PyPI wheel** (`pyproject.toml` excludes `api*`), **NOT in the live Worker**, **NOT in the dogfood quickstart**. The substrate it composes is load-bearing for the shipping surfaces above; only the FastAPI HTTP layer is internal-research. Promote to a shipping `[api]` extra only if a named buyer or grant deliverable explicitly references one of the endpoint clusters. See top-of-file banner in `api/quantum_router.py` for the full triage rationale.
+- **`api/quantum_router.py` + `quantum_main.py`** — FastAPI surface with 26+ endpoints (branchable knowledge graph, ZK semantic proofs, federated KG sync, JWT multi-tenant API). 1,684 LOC; 58/58 tests pass; runs locally via `uvicorn quantum_main:app`. **NOT in the PyPI wheel** (`pyproject.toml` excludes `api*`), **NOT in the live Worker**, **NOT in the dogfood quickstart**. The substrate it composes is load-bearing for the shipping surfaces above; only the FastAPI HTTP layer is internal-research. Promote to a shipping `[api]` extra only if a named buyer or grant deliverable explicitly references one of the endpoint clusters. See top-of-file banner in `api/quantum_router.py` for the full triage rationale.
 
 ---
 
@@ -261,7 +301,7 @@ This roadmap names only unshipped work. Items already landed live in [`CHANGELOG
 
 **Platform surface (post-hardening)**
 
-Source anchoring in the bundle schema, bundle explorer / viewer, `sum verify --explain`, `sum tutorial` onboarding, shareable bundle URLs `/b/{hash}`, PWA-installable demo, `sum attest <url>` fetch mode. Each item names its dependency in [`docs/NEXT_SESSION_PLAYBOOK.md`](docs/NEXT_SESSION_PLAYBOOK.md).
+Source anchoring in the bundle schema, bundle explorer / viewer, `sum tutorial` onboarding, shareable bundle URLs `/b/{hash}`, PWA-installable demo, `sum attest <url>` fetch mode. Each item names its dependency in [`docs/NEXT_SESSION_PLAYBOOK.md`](docs/NEXT_SESSION_PLAYBOOK.md).
 
 ---
 

{sum_engine-0.8.0 → sum_engine-0.9.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "sum-engine"
-version = "0.8.0"
+version = "0.9.0"
 description = "SUM — bidirectional knowledge distillation with optional cryptographic attestation. Pipe prose, get a CanonicalBundle (HMAC / Ed25519 / W3C VC 2.0), verify anywhere."
 readme = "README.md"
 license = { text = "Apache-2.0" }
@@ -117,7 +117,12 @@ research = ["numpy>=1.24.0", "scipy>=1.10.0"]
 # A local sentence-embedding model run offline in eval mode — fixes the
 # F18 lexical-scorer paraphrase misranking without any paid API. Heavy
 # (torch); strictly optional, lazy-imported.
-judge = ["transformers>=4.30.0", "torch>=2.0.0", "sentencepiece>=0.1.99"]
+# transformers <5: the DeBERTa-v3 slow-tokenizer path the default NLI
+# judge loads is not guaranteed across the next major, and this extra's
+# code path never runs in the per-PR suite — a break would ship silently.
+# Lift the ceiling only with a green judge-smoke run
+# (.github/workflows/judge-smoke.yml).
+judge = ["transformers>=4.30.0,<5", "torch>=2.0.0", "sentencepiece>=0.1.99"]
 # Omni-format adapter. Markdown is the canonical pivot for the
 # attest pipeline: any input format -> markdown -> existing
 # extract/state/bundle path. Source URI anchors to the original
@@ -129,10 +134,10 @@ judge = ["transformers>=4.30.0", "torch>=2.0.0", "sentencepiece>=0.1.99"]
 # What this base extra brings in: HTML / DOCX-via-mammoth-not-
 # included / plaintext / EPUB-without-pandoc / .ipynb / .json.
 # For PDF/DOCX/XLSX/PPTX, install the matching markitdown extra
-# (`pip install 'markitdown[pdf,docx,xlsx,pptx]==0.1.5'`) on top.
+# (`pip install 'markitdown[pdf,docx,xlsx,pptx]==0.1.6'`) on top.
 # Pinned hard to keep markdown output byte-identical for receipts.
 omni-format = [
-    "markitdown==0.1.5",
+    "markitdown==0.1.6",
 ]
 dev = [
     "pytest>=7.0.0",
@@ -207,6 +212,10 @@ exclude = ["Tests*", "Tests.*", "scripts*", "api*", "single_file_demo*"]
 # Bundled frequency-table assets used by the slider renderer's
 # audience-axis classifier (Phase E.1 STATE 5b).
 "sum_engine_internal.ensemble.data" = ["*.txt"]
+# The `python -m sum_verify --demo` golden — a real binding-gate
+# meaning-risk receipt (BillSum, CC0) + JWKS + losses, so a pip-only
+# user can replay a bound offline with zero git clone.
+"sum_verify._demo" = ["*.json"]
 
 [tool.ruff]
 line-length = 100