========== 1. emit + verify ========== wrote new signing key to signer.key (keep this secret) wrote receipt.json [PASS] ed25519-signature: payload signed by stated key [PASS] merkle-inclusion: anchored at index 0 of 1 (Merkle-consistent under the STATED root) CRYPTO: OK ROOT-AUTHENTICITY: NOT_EVALUATED (payload-signature PASS, merkle-consistency PASS, tree-context NOT_EVALUATED, root-trust-level NONE, safe-for-automation false) SAFE_FOR_AUTOMATION: NO Reason: The Merkle root was not authenticated against a relying-party value (--expected-root or a policy trusted_roots entry) Root and tree size were not authenticated ATOMICALLY from one source (a signed checkpoint via --trusted-checkpoint / policy trusted_checkpoints, or an --expected-root + --expected-tree-size pair) — a root-bytes-only pin cannot detect a tree-size/leaf-index relabel (A-P0-1) No trust policy was evaluated (supply --policy to authorise a signer) POLICY: NOT_EVALUATED (no trust policy supplied) ASSURANCE: n/a (not an eval receipt) LIMITATIONS: NOT that the result is true, the eval well designed, the model safe/fair, or that the score generalizes (see NON_CLAIMS.md); and NOT when it happened, unless an external time anchor is present exit=0 { "schema": "proofbundle/v0.1", "payload_b64": "ewogICJzeXN0ZW0iOiAiY2ktZXZhbC1ydW5uZXItMDEiLAogICJtb2RlbCI6ICJkZW1vLW1vZGVsIiwKICAiYmVuY2htYXJrIjogInN1cHBseS1jaGFpbi1zYW5pdHkiLAogICJzY29yZSI6IDAuOTcsCiAgInNhbXBsZXMiOiAxMjgsCiAgInRpbWVzdGFtcCI6ICIyMDI2LTA3LTEwVDEyOjAwOjAwWiIKfQo=", "signature": { "alg": "ed25519", "public_key_b64": "86XhgteUxZ1Go1E76AeC187W5Q9ElQ/frwsFF9A5Vkc=", "sig_b64": "Wxdea8f4dgHRFsw0SVcSLVl/ftbAUPz6o8jHSPdTTZOq5AkBDBZe0BTSNoSANoxG42aeL1zZXRjhzHUdviRQDQ==" }, "merkle": { "hash_alg": "sha256-rfc6962", "leaf_index": 0, "tree_size": 1, "inclusion_proof_b64": [], "root_b64": "R+0CMZ/J7jC35+uvGG8JWBbhyDiedG7faBLTkpWbdag=" } } ========== 2. check by hand (no proofbundle code) ========== signature: valid for the key IN the receipt merkle root matches leaf hash: True signer key: 86XhgteUxZ1Go1E76AeC187W5Q9ElQ/frwsFF9A5Vkc= ========== 3a. edit result.json on disk, verify the old receipt ========== exit=0 result.json MATCH receipt 21917f5603e28904 file 21917f5603e28904 result_tampered.json MISMATCH receipt 21917f5603e28904 file 2c47c5d96dedc161 ========== 3b. the generic receipt tamper from the challenge ========== tampered receipt written: receipt_tampered.json 2c2 < "schema": "proofbundle/v0.1", --- > "schema": "proofbundle/v0.1-tampered", ERROR: unsupported schema 'proofbundle/v0.1-tampered', expected 'proofbundle/v0.1' exit=2 ========== 3c. edit the score inside the signed payload ========== edited signed payload: score 0.97 -> 0.99 [FAIL] ed25519-signature: invalid signature [FAIL] merkle-inclusion: inclusion proof failed CRYPTO: FAILED exit=1 ========== 4. forgery: re-sign a fake result with a new key ========== wrote new signing key to attacker.key (keep this secret) wrote receipt_forged.json [PASS] ed25519-signature: payload signed by stated key [PASS] merkle-inclusion: anchored at index 0 of 1 (Merkle-consistent under the STATED root) CRYPTO: OK exit=0 signature: valid for the key IN the receipt merkle root matches leaf hash: True signer key: OGTdE83qkiCqbmNhkYp/8AyjKgImRHHIiPHa+BALduw= ========== 5. pin the signer with a trust policy ========== wrote trust_policy.json pinning 86XhgteUxZ1Go1E76AeC187W5Q9ElQ/frwsFF9A5Vkc= policy lab-pin-ci-eval-runner-01 (proofbundle/trust-policy/v0.1) pins policyPurpose == 'eval' (wrong verifier path fails) pins schema version in ['proofbundle/v0.1'] pins issuer ci-eval-runner-01: public key pinned (86XhgteUxZ1G…) pins signature alg in ['ed25519'] pins signer MUST match an allowed_issuers entry (require_expected_signer) pins merkle.hash_alg == 'sha256-rfc6962' [policy-lint] PASS · 6 pin(s) · 0 error(s) · 0 warning(s) exit=0 --- genuine CRYPTO: OK POLICY: OK exit=0 --- forged CRYPTO: OK POLICY: FAIL (signer public key is NOT in allowed_issuers) exit=3 --- typo in policy ERROR: unknown field(s) in trust policy: ["'alowed_issuers'"] (trust policy is fail-closed) exit=2 ========== 6. stolen key ========== wrote receipt_stolen.json CRYPTO: OK POLICY: OK exit=0 --- policy that asks for revocation checking POLICY: FAIL (policy enables a status requirement, but verify --policy (v0.1) has no status-snapshot input — evaluate revocation separately with verify_status_snapshot (fail-closed)) exit=3 --- rotate: drop the stolen key, pin a new one receipt.json POLICY: FAIL (signer public key is NOT in allowed_issuers) receipt_stolen.json POLICY: FAIL (signer public key is NOT in allowed_issuers) receipt_v2.json POLICY: OK ========== 7. serialization ========== --- receipt minified + keys reordered CRYPTO: OK exit=0 same bytes: False | same JSON value: True --- duplicate key ERROR: duplicate JSON key 'payload_b64' — rejected fail-closed (a duplicated key parses differently across JSON implementations; parser-differential guard, WP-C1) exit=2 ========== 8. eval receipts ========== { "schema": "proofbundle/eval-claim/v0.1", "suite": "supply-chain-sanity", "suite_version": "1.0", "metric": "accuracy", "comparator": ">=", "threshold": "0.90", "passed": true, "n": 128, "model_id_commit": "sha256:d5be1fb9097c891c7542b1d492c8cf30d61ba13a516a319e94e26ed724b92e6c", "dataset_id_commit": "sha256:9113ff32abb66fe933a1389337736adcb4797cb5afdcc7072f1db8d5e3a69611", "commit_alg": "sha256-salted-v1", "issuer": "ed25519:86XhgteUxZ1Go1E76AeC187W5Q9ElQ/frwsFF9A5Vkc=", "timestamp": "2026-07-10T12:00:00Z", "assurance_level": "self_attested" } wrote eval receipt eval_receipt.json suite supply-chain-sanity (1.0) metric accuracy >= 0.90 passed True (n=128) evidence THRESHOLD_VERDICT_VERIFIED (proves `passed` against the signed threshold, not an exact score) note METHODOLOGY_NOT_EVALUATED (the receipt never judges whether the suite is well designed) assurance self_attested model commit sha256:d5be1fb9097c891c7542b1d492c8cf30d61ba13a516a319e94e26ed724b92e6c dataset commit sha256:9113ff32abb66fe933a1389337736adcb4797cb5afdcc7072f1db8d5e3a69611 issuer ed25519:86XhgteUxZ1Go1E76AeC187W5Q9ElQ/frwsFF9A5Vkc= timestamp 2026-07-10T12:00:00Z age 9025723s WARNING self_attested with no prereg_sha256 — the weakest assurance: trust rests entirely on the issuer, who could publish the best of many runs. Pre-register (prereg_sha256) or use a higher assurance_level (reproduced / enclave_attested) to strengthen it. => OK exit=0 wrote eval receipt eval_receipt_reproduced.json assurance reproduced => OK wrote trust_policy_reproduced.json pinning 86XhgteUxZ1Go1E76AeC187W5Q9ElQ/frwsFF9A5Vkc= --- eval_receipt.json CRYPTO: OK POLICY: FAIL (assurance_level 'self_attested' below minimum 'reproduced') ASSURANCE: self_attested (issuer-declared) exit=3 --- eval_receipt_reproduced.json CRYPTO: OK POLICY: OK ASSURANCE: reproduced (issuer-declared) exit=0 ========== 9. volume: 300 receipts ========== emit 300: 9.9s verify 300: 10.3s failures: 0 receipts: 300 | distinct Merkle roots: 300 | tree sizes: [1]