ziffer 0.1.0__tar.gz

ziffer-0.1.0/PKG-INFO

@@ -0,0 +1,45 @@
+Metadata-Version: 2.4
+Name: ziffer
+Version: 0.1.0
+Summary: Ziffer decision API client and ACP receipt verifier (wraps the reference implementation at the engine pin)
+License: Proprietary
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+Requires-Dist: cryptography>=42
+Requires-Dist: dilithium-py>=1.0
+
+# ziffer — Python SDK (ACP-197)
+
+Client for the Ziffer decision API plus the customer-side receipt verifier.
+
+The verifier **wraps the ACP reference implementation** — it calls the
+reference's own functions (`canon`, `h`, `sig_ok`, `Timestamp.parse`,
+`Bundle.suite_ok`, the WE-4/L-17 nonce rules) and never reimplements them.
+Refusal names are the reference's clause ids, identically. The committed
+source here is the wrapper only; `build.sh` copies the needed
+`reference/src/*.py` modules from an engine checkout **at the pin** into
+`src/ziffer/_engine/` (gitignored) at build/test time. This is build-time
+distribution under the public freeze, not a fork: the copy is verbatim,
+header-stamped with its source rev, and regenerated on every build.
+
+```sh
+./build.sh                                   # copies the engine at the pin
+PYTHONPATH=src python3 -m unittest discover -s tests -v
+python3 -m build                             # sdist + wheel (engine included)
+```
+
+```python
+import ziffer
+
+client = ziffer.Client("https://api.example", api_key="zfr_...")
+d = client.propose(proposal)                 # -> Decision(decision_id, status, ...)
+d = client.wait(d.decision_id, timeout=30)
+
+anchor = ziffer.TrustAnchor.from_file("receipt-identity.pub.json")  # acp-bundle pubkey output
+verified = ziffer.verify(d.receipt, proposal_bytes, anchor)          # or raises RefusedError(name)
+```
+
+`verify()` runs the **stateless** §9.3 subset (AB-0, AB-6, CR-4, 9.3-1/CR-3,
+9.3-2, 9.3-3, 9.3-5/L-14, WE-4/L-17). It does not — cannot, statelessly —
+check the policy basis (step 4), nonce single-use (CL-2), or steps 7–10;
+a `Verified` means the stateless half found nothing, not the full §9.3 verdict.

ziffer-0.1.0/README.md

@@ -0,0 +1,35 @@
+# ziffer — Python SDK (ACP-197)
+
+Client for the Ziffer decision API plus the customer-side receipt verifier.
+
+The verifier **wraps the ACP reference implementation** — it calls the
+reference's own functions (`canon`, `h`, `sig_ok`, `Timestamp.parse`,
+`Bundle.suite_ok`, the WE-4/L-17 nonce rules) and never reimplements them.
+Refusal names are the reference's clause ids, identically. The committed
+source here is the wrapper only; `build.sh` copies the needed
+`reference/src/*.py` modules from an engine checkout **at the pin** into
+`src/ziffer/_engine/` (gitignored) at build/test time. This is build-time
+distribution under the public freeze, not a fork: the copy is verbatim,
+header-stamped with its source rev, and regenerated on every build.
+
+```sh
+./build.sh                                   # copies the engine at the pin
+PYTHONPATH=src python3 -m unittest discover -s tests -v
+python3 -m build                             # sdist + wheel (engine included)
+```
+
+```python
+import ziffer
+
+client = ziffer.Client("https://api.example", api_key="zfr_...")
+d = client.propose(proposal)                 # -> Decision(decision_id, status, ...)
+d = client.wait(d.decision_id, timeout=30)
+
+anchor = ziffer.TrustAnchor.from_file("receipt-identity.pub.json")  # acp-bundle pubkey output
+verified = ziffer.verify(d.receipt, proposal_bytes, anchor)          # or raises RefusedError(name)
+```
+
+`verify()` runs the **stateless** §9.3 subset (AB-0, AB-6, CR-4, 9.3-1/CR-3,
+9.3-2, 9.3-3, 9.3-5/L-14, WE-4/L-17). It does not — cannot, statelessly —
+check the policy basis (step 4), nonce single-use (CL-2), or steps 7–10;
+a `Verified` means the stateless half found nothing, not the full §9.3 verdict.

ziffer-0.1.0/pyproject.toml

@@ -0,0 +1,29 @@
+# ziffer Python SDK (ACP-197). setuptools, not hatchling, and the choice is
+# load-bearing: hatchling excludes gitignored files from builds by default, and
+# src/ziffer/_engine/ is gitignored on purpose (committed source = wrapper
+# only; build.sh copies the reference modules in from the pinned engine
+# checkout). setuptools includes every .py of a discovered package regardless
+# of VCS state, so the wheel carries the engine iff build.sh ran — and
+# `ziffer.verify` names build.sh when it did not, rather than half-working.
+
+[build-system]
+requires = ["setuptools>=69"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "ziffer"
+version = "0.1.0"
+description = "Ziffer decision API client and ACP receipt verifier (wraps the reference implementation at the engine pin)"
+readme = "README.md"
+requires-python = ">=3.10"
+license = { text = "Proprietary" }
+# The engine's own two dependencies, nothing else: the client half is stdlib
+# urllib by runbook §4 rule (a third-party HTTP client is a dependency with
+# no justification here).
+dependencies = [
+    "cryptography>=42",
+    "dilithium-py>=1.0",
+]
+
+[tool.setuptools.packages.find]
+where = ["src"]

ziffer-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

ziffer-0.1.0/src/ziffer/__init__.py

@@ -0,0 +1,30 @@
+"""ziffer — client and receipt verifier for the Ziffer decision API (ACP-197).
+
+Two halves, deliberately separable:
+
+- `Client` / `Decision` (stdlib-only): talk to the public decision API.
+- `verify` / `TrustAnchor` / `Verified`: run the stateless §9.3 receipt
+  checks by WRAPPING the ACP reference implementation, vendored at the
+  engine pin by `sdk/python/build.sh`. Refusal names are the reference's
+  clause ids, identically.
+
+The client works without the vendored engine; anything touching a receipt's
+cryptography raises `EngineAbsent` (naming build.sh) until the copy exists.
+That split is honest rather than convenient: importing this package must not
+fail on a machine that only submits proposals, and verifying must never
+degrade to "engine missing, skipped".
+"""
+from .client import Client, Decision
+from .errors import (AnchorError, ApiError, EngineAbsent, RefusedError,
+                     WaitTimeout, ZifferError)
+from .verify import TrustAnchor, Verified, verify
+
+__version__ = "0.1.0"
+
+__all__ = [
+    "Client", "Decision",
+    "TrustAnchor", "Verified", "verify",
+    "ZifferError", "RefusedError", "ApiError", "WaitTimeout",
+    "EngineAbsent", "AnchorError",
+    "__version__",
+]

ziffer-0.1.0/src/ziffer/_engine/__init__.py

@@ -0,0 +1 @@
+SOURCE_REV = "356ef8eaed7eed2a0d5a0ab9917892dab3e15a8c"

ziffer-0.1.0/src/ziffer/_engine/acp_crypto.py

@@ -0,0 +1,454 @@
+# ziffer build-time copy — DO NOT EDIT (regenerated by sdk/python/build.sh)
+# source: reference/src/acp_crypto.py @ 356ef8eaed7eed2a0d5a0ab9917892dab3e15a8c (engine pin 356ef8e)
+#!/usr/bin/env python3
+"""
+acp_crypto.py — real cryptography and canonical encoding for ACP v1.3.8.
+
+Closes two CRYPTO-SWAP / encoding gaps that the reference Executor previously
+modelled:
+
+  1. HYBRID SIGNATURES (CR-1..CR-3) with real primitives:
+       classical -> Ed25519 (RFC 8032, via `cryptography`)
+       pq        -> ML-DSA-65 (FIPS 204, via `dilithium-py`)
+     Composition remains conjunctive; only the primitives changed.
+
+  2. CANONICAL CBOR (AT-8a) per RFC 8949 §4.2.1 deterministic encoding, with a
+     VALIDATING decoder. AT-8a requires that a non-canonical encoding be
+     REJECTED rather than re-serialised and accepted; a permissive decoder
+     silently normalises and reopens Z4. The decoder here therefore re-encodes
+     what it parsed and refuses any input that is not byte-identical.
+
+MEASUREMENT NOTE. Sizes and timings are reported by `bench()` rather than
+asserted from memory: ML-DSA-65 signatures are ~3.3 kB against Ed25519's 64 B,
+which is the fact §9.7's performance note requires deployments to re-measure.
+"""
+from __future__ import annotations
+import hashlib, io, time
+from typing import Any
+
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric.ed25519 import (
+    Ed25519PrivateKey, Ed25519PublicKey)
+from cryptography.exceptions import InvalidSignature
+from dilithium_py.ml_dsa import ML_DSA_65
+
+
+class CanonError(Exception):
+    """Encoding is not the canonical one. AT-8a: reject, never normalise."""
+
+
+# =============================================================== canonical CBOR
+def _enc_head(major: int, val: int, out: io.BytesIO):
+    """RFC 8949 §4.2.1: the argument MUST use the shortest form that holds it."""
+    if val < 24:
+        out.write(bytes([(major << 5) | val]))
+    elif val < 0x100:
+        out.write(bytes([(major << 5) | 24, val]))
+    elif val < 0x10000:
+        out.write(bytes([(major << 5) | 25]) + val.to_bytes(2, "big"))
+    elif val < 0x100000000:
+        out.write(bytes([(major << 5) | 26]) + val.to_bytes(4, "big"))
+    elif val < 0x10000000000000000:
+        out.write(bytes([(major << 5) | 27]) + val.to_bytes(8, "big"))
+    else:
+        raise CanonError("integer exceeds 64-bit CBOR argument")
+
+
+def _enc(obj: Any, out: io.BytesIO):
+    if obj is True:
+        out.write(b"\xf5"); return
+    if obj is False:
+        out.write(b"\xf4"); return
+    if obj is None:
+        out.write(b"\xf6"); return
+    if isinstance(obj, float):
+        # WE-1/AT-8a: floats have multiple representations of one value and no
+        # deterministic ordering story. Excluded from signed structures.
+        raise CanonError("float in a canonical structure")
+    if isinstance(obj, int):
+        if obj >= 0:
+            _enc_head(0, obj, out)
+        else:
+            _enc_head(1, -obj - 1, out)
+        return
+    if isinstance(obj, bytes):
+        _enc_head(2, len(obj), out); out.write(obj); return
+    if isinstance(obj, str):
+        b = obj.encode("utf-8"); _enc_head(3, len(b), out); out.write(b); return
+    if isinstance(obj, (list, tuple)):
+        _enc_head(4, len(obj), out)
+        for x in obj:
+            _enc(x, out)
+        return
+    if isinstance(obj, dict):
+        # RFC 8949 §4.2.1: map keys sorted by their ENCODED bytes, bytewise
+        # lexicographic. Sorting by the Python value would differ for e.g.
+        # integer vs string keys and for non-ASCII.
+        items = []
+        for k, v in obj.items():
+            kb = io.BytesIO(); _enc(k, kb); items.append((kb.getvalue(), v))
+        items.sort(key=lambda kv: kv[0])
+        if len({k for k, _ in items}) != len(items):
+            raise CanonError("duplicate map key")
+        _enc_head(5, len(items), out)
+        for kb, v in items:
+            out.write(kb); _enc(v, out)
+        return
+    raise CanonError(f"type {type(obj).__name__} not encodable")
+
+
+def canon_cbor(obj: Any) -> bytes:
+    out = io.BytesIO(); _enc(obj, out); return out.getvalue()
+
+
+def _dec(buf: bytes, i: int):
+    if i >= len(buf):
+        raise CanonError("truncated")
+    ib = buf[i]; major, ai = ib >> 5, ib & 0x1F; i += 1
+    if ai < 24:
+        val = ai
+    elif ai == 24:
+        val = buf[i]; i += 1
+        if major not in (7,) and val < 24:
+            raise CanonError("non-shortest argument")
+    elif ai == 25:
+        val = int.from_bytes(buf[i:i+2], "big"); i += 2
+        if val < 0x100: raise CanonError("non-shortest argument")
+    elif ai == 26:
+        val = int.from_bytes(buf[i:i+4], "big"); i += 4
+        if val < 0x10000: raise CanonError("non-shortest argument")
+    elif ai == 27:
+        val = int.from_bytes(buf[i:i+8], "big"); i += 8
+        if val < 0x100000000: raise CanonError("non-shortest argument")
+    elif ai == 31:
+        raise CanonError("indefinite length forbidden in canonical CBOR")
+    else:
+        raise CanonError(f"reserved additional information {ai}")
+
+    if major == 0: return val, i
+    if major == 1: return -val - 1, i
+    if major == 2: return buf[i:i+val], i + val
+    if major == 3: return buf[i:i+val].decode("utf-8"), i + val
+    if major == 4:
+        out = []
+        for _ in range(val):
+            x, i = _dec(buf, i); out.append(x)
+        return out, i
+    if major == 5:
+        out, prev = {}, None
+        for _ in range(val):
+            kstart = i
+            k, i = _dec(buf, i)
+            kb = buf[kstart:i]
+            if prev is not None and kb <= prev:
+                raise CanonError("map keys not in canonical order")
+            prev = kb
+            v, i = _dec(buf, i)
+            out[k] = v
+        return out, i
+    if major == 7:
+        if val == 20: return False, i
+        if val == 21: return True, i
+        if val == 22: return None, i
+        raise CanonError("float or unsupported simple value")
+    raise CanonError("unreachable")
+
+
+def decode_canonical(buf: bytes) -> Any:
+    """
+    AT-8a: parse AND verify canonicity. Any input that is not byte-identical to
+    the canonical encoding of what it decodes to is REFUSED, never normalised.
+    """
+    obj, i = _dec(buf, 0)
+    if i != len(buf):
+        raise CanonError("trailing bytes")
+    if canon_cbor(obj) != buf:
+        raise CanonError("input is not the canonical encoding of its value")
+    return obj
+
+
+def h_cbor(obj: Any) -> str:
+    return "sha256:" + hashlib.sha256(canon_cbor(obj)).hexdigest()
+
+
+# ============================================================ hybrid signatures
+class HybridKey:
+    """
+    One identity, one key per primitive. Private halves stay together.
+
+    DERIVED FROM THE SEED, both legs. Through v1.3.13 the ML-DSA half came from
+    an unseeded `ML_DSA_65.keygen()`, which was invisible while only one process
+    ever used a key: `sim.supervise` runs seven real OS processes, each importing
+    `sim.world`, and each would have minted a DIFFERENT post-quantum keypair for
+    the same identity — the classical leg would verify and the PQ leg would not,
+    so every hybrid signature would fail closed across a process boundary. FIPS
+    204 specifies KeyGen_internal(xi) over a 32-byte seed for exactly this.
+
+    A seed is test-and-simulation key material. A deployment loads keys from a
+    KMS or an HSM; nothing here should be read as endorsing derived keys.
+    """
+    def __init__(self, seed: bytes):
+        self.ed_sk = Ed25519PrivateKey.from_private_bytes(
+            hashlib.sha256(seed + b"ed").digest())
+        self.ed_pk = self.ed_sk.public_key()
+        self.ml_pk, self.ml_sk = ML_DSA_65.key_derive(
+            hashlib.sha256(seed + b"mldsa").digest())
+
+    def public(self) -> "HybridPub":
+        return HybridPub(self.ed_pk, self.ml_pk)
+
+
+class HybridPub:
+    def __init__(self, ed_pk: Ed25519PublicKey, ml_pk: bytes):
+        self.ed_pk, self.ml_pk = ed_pk, ml_pk
+
+    def fingerprint(self) -> str:
+        """
+        A name for this public identity, over BOTH halves.
+
+        Used to bring the key registry inside `Bundle.hash()` (spec §8.2: the
+        SIGNATURE is over the canonical bundle tree, and `attesters/` is in that
+        tree). Covering both primitives is the point — a fingerprint over the
+        classical half alone would let an ML-DSA key be swapped without moving
+        the bundle hash, which is the conjunctive CR-3 guarantee undone at the
+        registry instead of at the verifier.
+        """
+        raw = self.ed_pk.public_bytes(
+            serialization.Encoding.Raw, serialization.PublicFormat.Raw)
+        return "sha256:" + hashlib.sha256(raw + self.ml_pk).hexdigest()
+
+
+PRIMS = {"classical", "pq"}
+
+
+# ------------------------------------------------- per-primitive sign / verify
+#
+# The Executor owns SUITES, SUITE_RANK and the conjunctive composition (CR-3);
+# this module owns the primitives. Keeping that split is deliberate: a mutation
+# of the composition (`all` -> `any`) still has something real to break, and the
+# CR-4 suite floor stays protocol logic rather than a property of a crypto
+# library.
+
+
+# ------------------------------------------ Ed25519 small-order guard (ACP-106)
+#
+# `cryptography` verifies Ed25519 through OpenSSL, which implements RFC 8032 as
+# written and does NOT refuse a public key of small order. Under such a key the
+# verification equation `[s]B == R + [k]A` loses its `A` term -- for the
+# identity point `[k]A` is the identity whatever `k` is -- and what remains,
+# `[s]B == R`, does not mention the message at all. ONE signature then verifies
+# under that key for EVERY message.
+#
+# That is a fail-OPEN primitive, and the damage is a quorum bypass: an attester
+# whose registered classical key is small-order has its attestations mintable by
+# anyone who has seen that key, so a single holder satisfies a k=2 quorum alone.
+# That is the ACP-53 shape reached by a different route. CR-3's conjunction
+# masks it under `hybrid-ed25519-mldsa65`, because the post-quantum half still
+# has to verify -- but `ed25519` is a declared legacy suite in SUITES, and under
+# a classical floor nothing else stands in the way.
+#
+# `ed25519-dalek` puts this rule behind `verify_strict`, which
+# crates/acp-crypto/src/primitives.rs now calls; this is the Python half of the
+# same fix. THE TWO MUST STAY THE SAME RULE. The differential compares the two
+# implementations against each other, so a guard on one side only would convert
+# a closed defect into a divergence -- and note that the differential could not
+# see this defect at all while both sides were wrong in the same way, which is
+# the standing warning in dossier/05-TEST-EVIDENCE.md landing on a real case.
+#
+# The rule is `[8]P == identity`, exactly dalek's `is_small_order()`, written
+# out rather than kept as a table of encodings: a hardcoded blacklist is a
+# second definition of "small order" that nothing can check against the curve.
+
+_ED_P = 2 ** 255 - 19
+_ED_D = (-121665 * pow(121666, _ED_P - 2, _ED_P)) % _ED_P
+_ED_SQRT_M1 = pow(2, (_ED_P - 1) // 4, _ED_P)
+
+
+def _ed_decompress(b: bytes):
+    """RFC 8032 5.1.3 point decompression. None when `b` is not a curve point."""
+    if len(b) != 32:
+        return None
+    y = int.from_bytes(b, "little")
+    sign, y = y >> 255, y & ((1 << 255) - 1)
+    u = (y * y - 1) % _ED_P
+    v = (_ED_D * y * y + 1) % _ED_P
+    x = (u * pow(v, 3, _ED_P)
+         * pow(u * pow(v, 7, _ED_P), (_ED_P - 5) // 8, _ED_P)) % _ED_P
+    if (v * x * x - u) % _ED_P:
+        if (v * x * x + u) % _ED_P:
+            return None
+        x = x * _ED_SQRT_M1 % _ED_P
+    if x == 0 and sign:
+        return None
+    return (_ED_P - x if x % 2 != sign else x), y
+
+
+def _ed_is_small_order(b: bytes) -> bool:
+    """
+    True when the encoded point has order dividing 8.
+
+    A point that does not decode is NOT reported small-order. It is refused a
+    line later by the verifier itself, and conflating "not a point" with "small
+    order" would make this guard's own failure mode unreadable.
+    """
+    pt = _ed_decompress(b)
+    if pt is None:
+        return False
+    X, Y, Z = pt[0], pt[1], 1
+    for _ in range(3):                       # [8]P, by three doublings
+        a, bb = X * X % _ED_P, Y * Y % _ED_P
+        c = 2 * Z * Z % _ED_P
+        hh = (a + bb) % _ED_P
+        e = (hh - (X + Y) * (X + Y)) % _ED_P
+        g = (a - bb) % _ED_P
+        f = (c + g) % _ED_P
+        X, Y, Z = e * f % _ED_P, g * hh % _ED_P, f * g % _ED_P
+    return X % _ED_P == 0 and (Y - Z) % _ED_P == 0     # identity is (0 : 1 : 1)
+
+
+# The same predicate under a public name, for the bundle loader (ACP-109,
+# PB-9). ONE definition, two callers: `verify_prim` refuses a small-order key
+# at verification and `acp_bundle.BundleHost._check_registry` refuses it at
+# enrolment. A second copy in the loader would be a second definition of
+# "small order" that the two could drift apart on -- which is the reason the
+# Rust side exposes dalek's `is_weak` rather than re-deriving it. The
+# underscore name stays as the one `verify_prim` calls, because
+# `mutate_executor.py` anchors the ACP-106 mutant on that source line.
+ed25519_is_small_order = _ed_is_small_order
+
+
+def sign_prim(key: HybridKey, msg: bytes, prim: str) -> bytes:
+    if prim == "classical":
+        return key.ed_sk.sign(msg)
+    if prim == "pq":
+        return ML_DSA_65.sign(key.ml_sk, msg)
+    raise CanonError(f"no primitive {prim!r}")
+
+
+def verify_prim(pub: HybridPub, msg: bytes, sig_hex: Any, prim: str) -> bool:
+    """
+    Never raises. A malformed signature is a verification FAILURE, not an
+    exception for some caller further up to catch — a raise here would travel a
+    different path from a false, and the two must be indistinguishable to the
+    Executor's fail-closed contract.
+    """
+    if not isinstance(sig_hex, str):
+        return False
+    try:
+        raw = bytes.fromhex(sig_hex)
+    except ValueError:
+        return False
+    if prim == "classical":
+        # ACP-106-small-order-guard (mutation target). Both halves, because
+        # `verify_strict` refuses both and the two implementations must refuse
+        # the same bytes: a small-order A makes one signature verify for every
+        # message; a small-order R lets a signer emit an r=0 signature that a
+        # non-strict verifier accepts over a message it never committed to.
+        ed_pk_raw = pub.ed_pk.public_bytes(
+            serialization.Encoding.Raw, serialization.PublicFormat.Raw)
+        if _ed_is_small_order(ed_pk_raw) or _ed_is_small_order(raw[:32]):
+            return False
+        try:
+            pub.ed_pk.verify(raw, msg)
+            return True
+        except Exception:
+            return False
+    if prim == "pq":
+        try:
+            return bool(ML_DSA_65.verify(pub.ml_pk, msg, raw))
+        except Exception:
+            return False
+    return False
+
+
+def sign_hybrid(key: HybridKey, msg: bytes, alg: str) -> dict:
+    """CR-2: one signature value per primitive in the suite."""
+    sig = {}
+    if alg in ("ed25519", "hybrid-ed25519-mldsa65"):
+        sig["classical"] = key.ed_sk.sign(msg)
+    if alg in ("mldsa65", "hybrid-ed25519-mldsa65"):
+        sig["pq"] = ML_DSA_65.sign(key.ml_sk, msg)
+    if not sig:
+        raise CanonError(f"unknown suite {alg}")
+    return sig
+
+
+def verify_hybrid(pub: HybridPub, msg: bytes, sig: Any, alg: str) -> bool:
+    """
+    CR-3: conjunctive. Every primitive in the suite must verify, and the set of
+    supplied primitives must match the suite exactly.
+    """
+    expected = set()
+    if alg in ("ed25519", "hybrid-ed25519-mldsa65"): expected.add("classical")
+    if alg in ("mldsa65", "hybrid-ed25519-mldsa65"): expected.add("pq")
+    if not expected or not isinstance(sig, dict) or set(sig) != expected:
+        return False
+    if "classical" in expected:
+        try:
+            pub.ed_pk.verify(sig["classical"], msg)
+        except (InvalidSignature, Exception):
+            return False
+    if "pq" in expected:
+        try:
+            if not ML_DSA_65.verify(pub.ml_pk, msg, sig["pq"]):
+                return False
+        except Exception:
+            return False
+    return True
+
+
+# ==================================================================== benchmark
+SIGS_PER_HIGH_RECEIPT = 4   # 1 receipt signature + 3 attestations (quorum k=3)
+
+
+def bench(n: int = 200) -> dict:
+    """§9.7 requires deployments to MEASURE against EO-2, not assume."""
+    k = HybridKey(b"bench"); pub = k.public()
+    msg = canon_cbor({"proposal_hash": "sha256:" + "ab" * 32, "epoch": 47,
+                      "targets": ["prod-db"], "action": "allow", "port": 22})
+    out = {"payload_bytes": len(msg)}
+    for alg in ("ed25519", "hybrid-ed25519-mldsa65"):
+        t0 = time.perf_counter()
+        for _ in range(n):
+            s = sign_hybrid(k, msg, alg)
+        t1 = time.perf_counter()
+        for _ in range(n):
+            verify_hybrid(pub, msg, s, alg)
+        t2 = time.perf_counter()
+        # true p99 over per-verification samples, not a mean
+        samples = []
+        for _ in range(n):
+            a = time.perf_counter(); verify_hybrid(pub, msg, s, alg)
+            samples.append((time.perf_counter() - a) * 1000)
+        samples.sort()
+        p99 = samples[min(len(samples) - 1, int(0.99 * len(samples)))]
+        per_sig = sum(len(v) for v in s.values())
+        out[alg] = {
+            "sig_bytes": per_sig,
+            "receipt_bytes": per_sig * SIGS_PER_HIGH_RECEIPT,
+            "sign_ms": (t1 - t0) / n * 1000,
+            "verify_ms": (t2 - t1) / n * 1000,
+            "verify_p99_ms": p99,
+            "receipt_verify_p99_ms": p99 * SIGS_PER_HIGH_RECEIPT,
+        }
+    return out
+
+
+if __name__ == "__main__":
+    import json
+    r = bench()
+    print(f"canonical CBOR payload: {r.pop('payload_bytes')} bytes\n")
+    for alg, m in r.items():
+        print(f"{alg:26s} sig={m['sig_bytes']:>5} B  "
+              f"sign={m['sign_ms']:.3f} ms  verify={m['verify_ms']:.3f} ms  "
+              f"p99={m['verify_p99_ms']:.3f} ms")
+    print(f"\nPer floor-HIGH receipt ({SIGS_PER_HIGH_RECEIPT} signatures: "
+          f"1 receipt + 3 attestations, quorum k=3):")
+    for alg, m in r.items():
+        print(f"  {alg:26s} {m['receipt_bytes']:>6} B on the wire, "
+              f"verify p99 {m['receipt_verify_p99_ms']:.1f} ms")
+    c, h = r["ed25519"], r["hybrid-ed25519-mldsa65"]
+    print(f"\n  size factor  : {h['receipt_bytes']/c['receipt_bytes']:.1f}x "
+          f"({c['receipt_bytes']} B -> {h['receipt_bytes']} B)  [algorithm-bound]")
+    print(f"  latency factor: {h['receipt_verify_p99_ms']/c['receipt_verify_p99_ms']:.0f}x "
+          f"[implementation-bound: pure-Python ML-DSA]")