proofbundle

AI eval results need receipts.

Turn an AI evaluation result, review, decision, or action outcome into a portable receipt that can be checked offline.

proofbundle lets a verifier check which key signed the exact bytes and whether those bytes changed. It does not prove that the result is true, that the signer is trustworthy, or that the evaluation was sound.

One file. No verification server. No network required.

Quick start · What it proves · New in 6.0.0 · New in 5.1.0 · Adoption review · Documentation

New in 6.0.0

proofbundle 6.0.0 makes agent-review/v0.2 what the emitter produces without an argument. That is the one break of this MAJOR: v0.1 needs an explicit legacy_v01=True, stays readable and verifiable without a deadline, and is reported as predicateVersionStatus: legacy by the new dispatcher verify_agent_review_any. v0.2 requires subjectContext.disclosureCoreDigest and derived limitationCodes, separates time claims by source, accepts only the full 40-character fixCommit, and carries a named policy axis: verify_agent_review_v02 evaluates the derived codes and the coverage status against a policy that is a file (the standard one ships in the package and its digest appears in the result), with three decisions, accept, reject and insufficient_evidence.

Two things a relying party should know. A receipt whose own time claims contradict each other is now rejected with TIME_CLAIMS_CONFLICT regardless of policy, and a malformed policy file is refused before it decides (POLICY_NOT_EVALUABLE), never read as a permissive one. Non-fatal notes such as POLICY_NOT_EVALUATED and AGENT_REVIEW_LEGACY_V01 live in advisory_codes; reason_codes is empty for a valid receipt. The six published v0.1 receipts verify as before; the full list is in the CHANGELOG.

Release status

The closing audit verdict for 6.0.0 was FIX_FIRST, not WITHSTANDS_DEEPGATE. Three findings were confirmed and stay open; they are published in RESTRISIKO_600.md, together with the scope each statement of that round holds over: the mutation gate ran over a measured subset of the suite, the parity gate over all 68 source files. Both figures are stated in RESTRISIKO_600.md with the definition of what they count — this page deliberately carries no test count, because one here goes stale with the next added test (tests/test_docs_truth.py).

New in 5.1.0

proofbundle 5.1.0 adds a new receipt kind for disclosing AI agent involvement and review in pull requests and issues.

• Agent review receipts bind the reviewed GitHub object, the declared review runs, coverage, findings, limitations, and the human visible disclosure.
• Stronger subject and disclosure binding prevents a valid receipt from silently travelling to another object or a visible block from claiming more than the signed predicate.
• Clearer time and coverage semantics separate declared event time from witness observation time and reject ambiguous claims of complete coverage.
• Hardened correction chains prevent an untrusted receipt from taking over the current position in a correction or supersession chain.
• Executable conformance coverage now includes the agent review predicate and the receipt envelope profile.

One behaviour change deserves attention before upgrading. automation_summary now adds RECEIPT_NOT_OK to its blockers when a receipt is not ok. Read the 5.1.0 changelog before updating automation.

Release status

For 6.0.0 the residual-risk record was frozen BEFORE the closing audit round, by owner decision: RESTRISIKO_600.md lists what was known to be open when the tree was frozen, with class and funnel ruling, and its sha256 is bound inside the pre-tag receipt. The verdict of the closing round itself is recorded next to that receipt in audit_artifacts/600/ once the round has run; a round that had to be written down would have meant a new freeze, not an edit. The 5.1.0 verdict was PARTIAL_GATE_NO_WITHSTANDS with its risks in RESTRISIKO_510.md and RESTRISIKO_510_NACHTRAG_20260903.md.

Quick start

Install the core verifier.

python -m pip install proofbundle

Requires Python 3.10 or newer. The core installs two dependencies, cryptography and rfc8785.

Download a real example receipt and verify it offline.

curl -fsSL \
  https://raw.githubusercontent.com/b7n0de/proofbundle/main/examples/example_bundle.json \
  -o receipt.json

proofbundle verify receipt.json

The command uses the local file only. Its exit code is part of the public contract.

0  verified
1  verification failed
2  malformed input or usage error
3  relying party policy not met

Run the tamper demo.

python -m pip install "proofbundle[eval]"
proofbundle demo

The demo checks an honest receipt, multiple tampered variants, and a sample swap. It exits nonzero if a tamper is accepted.

For a guided walkthrough, see docs/DEMO.md. For Inspect, see docs/INSPECT_HAPPY_PATH.md.

What a receipt proves

A verified receipt can establish	A verified receipt does not establish
A stated key signed these exact bytes	The real world identity or honesty of the key holder
The signed content has not changed	The truth of the reported score or finding
A supplied Merkle inclusion or sample opening is valid	That the evaluation design was good
A declared threshold, provenance field, or relation is present and bound	That the computation itself was correct
A supplied relying party policy was met	That no omitted run or cherry picked result exists unless the chosen profile makes that claim testable

This boundary is the product. proofbundle makes a claim attributable and tamper evident without turning the claim into truth.

Read the full threat model and the project wide non claims.

Choose the path that matches your task

Task	Install	Start here
Verify an existing receipt offline	proofbundle	Quick start, SPEC.md
Emit an evaluation receipt or preregistration	proofbundle[eval]	docs/DEMO.md, EVAL_CLAIM.md
Integrate with Inspect AI	proofbundle[inspect]	docs/INSPECT_HAPPY_PATH.md
Add a signed agent review disclosure to a PR or issue	proofbundle	5.1.0 release notes, conformance/agent_review
Verify RFC 3161 or OpenTimestamps evidence	proofbundle[anchors]	docs/ANCHORS.md
Verify ML-DSA-44 witness cosignatures	proofbundle[pq]	docs/ANCHORS.md
Explore the TEE attestation bridge	proofbundle[experimental]	docs/EXPERIMENTAL_ENCLAVE.md

How it works

evaluation, review, decision, or action
                    │
                    ▼
      canonical statement and commitments
                    │
                    ▼
       signature and optional Merkle proofs
                    │
                    ▼
           one portable receipt file
                    │
                    ▼
        proofbundle verification offline
                    │
                    ▼
   separate verification axes and policy result

The verifier checks only the evidence supplied to it. Trust anchors, expected subjects, currentness information, and policy requirements come from the relying party.

Capabilities and maturity

proofbundle is a beta project. Shipped does not mean that every profile has the same maturity.

Capability	What it provides	Maturity
Core receipt verification	Ed25519 signatures, RFC 6962 and RFC 9162 Merkle inclusion, strict parsing, offline verification	Shipped
Evaluation receipts	Metric and threshold claims, provenance, salted commitments, optional per sample audit	Shipped
Selective disclosure	SD-JWT with key binding for hiding selected values while preserving verifiability	Shipped
Agent review receipts	Signed self declarations for AI involvement and review in PRs and issues	agent-review/v0.2 experimental in 6.0.0 and the default; agent-review/v0.1 legacy, still readable and byte-pinned. Self declared assurance only
Inspect, pytest, and Hugging Face bridges	Opt in adapters for existing evaluation workflows	Shipped
External time evidence	RFC 3161, OpenTimestamps, and a bring your own anchor interface	Experimental, the [anchors] extra
Decision receipts	A gate's verdict over named evidence, bound to the receipts it judged, never a claim that the verdict was correct	Shipped
Outcome, relation, run ledger, trust pack, and verification summary predicates	Typed evidence graphs and relying party policy inputs	Experimental
TEE attestation bridge	RATS and EAT based enclave evidence	Preview, experimental
Independent Rust cross-verifier (tools/pb_verify_rs)	A second implementation that cross-checks the conformance corpus differentially; not part of the wheel or the sdist	Experimental in 6.0.0 and advisory only: agreement on recorded vectors, no conformance promise; own milestone 6.1

The full predicate inventory and maturity labels live in docs/predicates/README.md.

Security and trust

• The verifier uses cryptography for Ed25519 and rfc8785 for canonicalization. It does not implement its own cryptographic primitives.
• Correctness is checked against external RFC 6962 vectors and a real Sigstore Rekor proof, not only against the project's own receipts.
• The test suite sits behind a mutation gate and property based parser fuzzing.
• The receipt signature is Ed25519 and is not post quantum. Post quantum coverage today is limited to witness side ML-DSA-44 cosignatures. A post quantum payload signature is on the roadmap and not yet built. Detail in docs/ANCHORS.md.
• Releases are built once, carry SLSA build provenance, and are published through PyPI Trusted Publishing, where PyPI records PEP 740 attestations for the same bytes.
• A second, independent verifier written in Rust cross-checks the conformance corpus. It is advisory: differential agreement on the recorded vectors, not a correctness proof of either implementation, and it does not ship in the package.
• The conformance corpus includes positive controls and counter proofs. Read what it does and does not establish in CONFORMANCE.md.
• The 30 minute adversarial adoption path is in docs/REVIEWERS.md.
• Security reports follow SECURITY.md.
• Release specific audit artefacts and residual risks remain visible rather than being folded into a single green status.

OpenSSF Scorecard

The aggregate score is a live heuristic, not a product verdict. Several checks score zero for reasons that are written down rather than hidden, one sentence per check, in docs/SCORECARD.md. The OpenSSF self assessment walks the Best Practices criteria honestly.

Standards and interoperability

proofbundle is a small offline receipt layer that complements, rather than replaces, systems such as in-toto, Sigstore, SCITT, transparency logs, trusted execution environments, and independent reproduction.

• INTEROP.md compares the boundaries tool by tool.
• docs/RECEIPT_ENVELOPE_PROFILE.md defines the portable envelope profile.
• A second implementation, CSOAI-ORG/inspect-receipts, was measured against R1 to R4 of that profile in issue #147 on 2026-09-05 at commit cc8d6219; the result is recorded in the profile.
• docs/IN_TOTO_PROFILE.md describes the in-toto mapping.
• docs/SCITT_CPB_MAPPING.md records the SCITT mapping.
• docs/RELATED_WORK.md holds the research neighbourhood.

Documentation

Reader	Start here
New user	docs/GLOSSARY.md, docs/DEMO.md
Adopter or security reviewer	docs/REVIEWERS.md, THREAT_MODEL.md
Implementer	SPEC.md, CONFORMANCE.md
Integrator	INTEGRATIONS.md, docs/INSPECT_HAPPY_PATH.md
Relying party	docs/POLICY_PROFILES.md, docs/TRUST_ANCHORS.md
Standards or research reader	INTEROP.md, docs/RELATED_WORK.md
Release reviewer	CHANGELOG.md, docs/PRE_TAG_AUDIT.md

Scope

proofbundle is not a hosted transparency service, a complete in-toto client, a trusted execution environment, a consensus system, or a compliance product by itself.

It is the portable, standards oriented receipt layer between an evidence producer and a relying party.

Roadmap, stated as not yet built. A post quantum payload signature, and a CLI flag to select the content root algorithm, jcs-sha256-v1 is the signed default today.

Citation

Machine readable citation metadata is in CITATION.cff.

The archival software record uses concept DOI 10.5281/zenodo.21110642. The Technical Note uses concept DOI 10.5281/zenodo.21230466; its latest published revision is 6.0.0, version DOI 10.5281/zenodo.22730162, deposited 2026-09-12. The preceding revision 5.0.0 has version DOI 10.5281/zenodo.22209091.

Contributing

Read CONTRIBUTING.md and the Code of Conduct.

Good first issues use the good-first-issue label. Security findings follow SECURITY.md.

The verifier core aims to remain small, dependency light, and auditable.

License

MIT, see LICENSE.

---

_{proofbundle is part of b7n0de, Verified AI Work · b7n0de.com}