Release pf-core 0.7.0 reward-binding (multi-commit)

CHANGELOG.md

@@ -0,0 +1,20 @@
+# CHANGELOG
+
+## 0.7.0 — 2026-07-24
+
+### Added
+
+- Reward-binding layer (parallel to `TraceSafe`): normalized `RewardBindingInput`, four predicates, multi-outcome decider, Lean model + soundness, `pf-core.reward_binding_certificate.v0`.
+- CLI: `pf core check-reward-binding`, `emit-reward-binding-certificate`, `replay-reward-binding`.
+- Untrusted PCS reward-binding adapter + mirrored schemas under `adapters/pcs/`.
+- Assumptions A11–A14; ADR-001 reward-binding ownership; companion PR specs for pcs-core / LabTrust / OVK.
+- Adversarial and LabTrust/OVK-shaped fixtures (offline).
+
+### Changed
+
+- Claim-boundary and audit forbidden phrases extended for reward overclaims.
+- `pf-core/VERSION` MINOR bump from 0.6.0.
+
+### Frozen
+
+- `pf-core.certificate.v0` unchanged.

SECURITY.md

@@ -0,0 +1,20 @@
+# Security Policy
+
+## Supported versions
+
+| Version | Supported |
+|---------|-----------|
+| 0.7.x   | Yes |
+| 0.6.x   | Best-effort |
+| < 0.6   | No |
+
+## Reporting a vulnerability
+
+This repository is private. Report suspected vulnerabilities in the trusted kernel (`pf-core/lean`, `pf-core/schemas`, `pf-core/validator/pf_core`) or adapter integrity handling privately to the maintainers via the organization's private security channel. Do not open public issues for exploitable defects.
+
+Include: affected commit/tag, reproduction under network-disabled conditions, and whether the issue crosses the trusted/untrusted boundary.
+
+## Scope notes
+
+- Untrusted adapters (`adapters/`) are not a security boundary for predicate truth.
+- Reward-binding certificates assert binding under A11–A14; they do not assert objective correctness or verifier accuracy.

adapters/__init__.py

@@ -0,0 +1 @@
+# Untrusted adapter packages (outside PF-Core TCB).

adapters/pcs/README.md

@@ -0,0 +1,59 @@
+# PCS adapters (untrusted)
+
+This tree is **outside the PF-Core TCB**. It normalizes portable PCS-shaped evidence into trusted PF-Core schemas. Predicate acceptance truth lives only in `pf_core/reward_binding.py` and Lean `PFCore.RewardBinding`.
+
+## Mirrored schemas
+
+Immutable mirrors under `adapters/pcs/schemas/`:
+
+| Schema `$id` | File |
+|--------------|------|
+| `pcs.reward_evidence_envelope.v0` | `reward_evidence_envelope.schema.json` |
+| `pcs.verifier_profile.v0` | `verifier_profile.schema.json` |
+| `pcs.environment_profile.v0` | `environment_profile.schema.json` |
+| `pcs.verification_result.v0` | `verification_result.schema.json` |
+| `pcs.authority_record.v0` | `authority_record.schema.json` |
+
+Upstream to pcs-core via companion tickets in `docs/pf-core/pf-va-pr-artifacts/`. Do not invent a second portable evidence standard under `pf-core/schemas/`.
+
+### Schema pin digests (SHA-256 of canonical file bytes)
+
+Regenerate with:
+
+```bash
+python -c "import hashlib,pathlib; p=pathlib.Path('adapters/pcs/schemas');
+[print(f.name, hashlib.sha256(f.read_bytes()).hexdigest()) for f in sorted(p.glob('*.schema.json'))]"
+```
+
+Pins are recorded in `adapters/pcs/schemas/SCHEMA_PINS.json` after VA-01 land.
+
+## Trust registry (`trusted_keys.json`)
+
+Operator pin format:
+
+```json
+{
+  "schema_version": "pcs.trusted_keys.v0",
+  "keys": [
+    { "key_id": "org-root-1", "alg": "sha256", "public_pin": "<hex64>" }
+  ]
+}
+```
+
+`reward_binding_adapter` accepts an integrity envelope only when `key_id` is listed and the recomputed payload digest matches `integrity.digest`. Trust-root correctness is assumption A13 (organizational).
+
+## Reward-binding adapter
+
+```bash
+python -m adapters.pcs.reward_binding_adapter \
+  --trace trace.json \
+  --reward-evidence reward.json \
+  --artifact-root artifacts/ \
+  --trust-registry trusted_keys.json
+```
+
+Emits `RewardBindingInput` (`pf-core.reward_binding_input.v0`) plus a mapping report listing discharged vs delegated assumptions. Never sets predicate acceptance.
+
+## Non-claims
+
+Adapter success does not imply reward correctness, verifier accuracy, environment fidelity, or RL/judge objective endorsement.

adapters/pcs/__init__.py

@@ -0,0 +1 @@
+# PCS adapters package (untrusted).

adapters/pcs/fixtures/labtrust-reward-binding/manifest.json

@@ -0,0 +1,10 @@
+{
+  "schema_version": "labtrust.reward_binding_fixture.v0",
+  "description": "Local LabTrust-shaped reward-binding fixture pointer (vendored; no network).",
+  "trace_fixture": "../reward-binding/trace_valid.json",
+  "reward_evidence": "../reward-binding/reward_valid.json",
+  "artifact_root": "../reward-binding/artifacts",
+  "trust_registry": "../reward-binding/trusted_keys.json",
+  "expected_outcome": "safe",
+  "notes": "Companion LabTrust PR should accept this mapping without cloning siblings in pf-core-trusted."
+}

adapters/pcs/fixtures/ovk-verifier-profile/README.md

@@ -0,0 +1,11 @@
+# OVK-shaped verifier profile fixture (local)
+
+Minimal offline fixture for companion OVK profile-pin work. Not executed against a live OVK binary in `pf-core-trusted`.
+
+| Field | Value |
+|-------|-------|
+| `profile_id` | `ovk-basic-v0` |
+| `config_digest` | hex64 `c` repeated |
+| `suite` | `ovk.offline_check.v0` |
+
+Upstream: `docs/pf-core/pf-va-pr-artifacts/ovk-profile-pin-pr-spec.md`.

adapters/pcs/fixtures/ovk-verifier-profile/verifier_profile.json

@@ -0,0 +1,8 @@
+{
+  "schema_version": "pcs.verifier_profile.v0",
+  "profile_id": "ovk-basic-v0",
+  "config_digest": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+  "status": "active",
+  "suite": "ovk.offline_check.v0",
+  "rubric": "ovk.rubric.pin.v0"
+}

adapters/pcs/fixtures/reward-binding/adversarial/artifacts_bad_profile/auth-1.json

@@ -0,0 +1,15 @@
+{
+  "authority_id": "auth-1",
+  "authorized_issuers": [
+    {
+      "principal_id": "issuer-1",
+      "tenant_id": "tenant-lab"
+    }
+  ],
+  "claim_class": "reward_binding",
+  "environment_digest": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+  "revoked": false,
+  "schema_version": "pcs.authority_record.v0",
+  "valid_from": 100,
+  "valid_until": 200
+}

adapters/pcs/fixtures/reward-binding/adversarial/artifacts_bad_profile/env-1.json

@@ -0,0 +1,6 @@
+{
+  "description": "lab env",
+  "digest": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+  "profile_id": "env-1",
+  "schema_version": "pcs.environment_profile.v0"
+}

adapters/pcs/fixtures/reward-binding/adversarial/artifacts_bad_profile/vp-1.json

@@ -0,0 +1,8 @@
+{
+  "config_digest": "2222222222222222222222222222222222222222222222222222222222222222",
+  "profile_id": "vp-1",
+  "rubric": "r1",
+  "schema_version": "pcs.verifier_profile.v0",
+  "status": "active",
+  "suite": "basic"
+}

adapters/pcs/fixtures/reward-binding/adversarial/artifacts_bad_profile/vr-1.json

@@ -0,0 +1,9 @@
+{
+  "result_id": "vr-1",
+  "schema_version": "pcs.verification_result.v0",
+  "status": "pass",
+  "verifier_profile_ref": {
+    "digest": "2dde9120776c810002cb00d44aabeb73563e39281fb545c9bd2760cabfd9d595",
+    "id": "vp-1"
+  }
+}

adapters/pcs/fixtures/reward-binding/adversarial/artifacts_dup/auth-1.json

@@ -0,0 +1,15 @@
+{
+  "authority_id": "auth-1",
+  "authorized_issuers": [
+    {
+      "principal_id": "issuer-1",
+      "tenant_id": "tenant-lab"
+    }
+  ],
+  "claim_class": "reward_binding",
+  "environment_digest": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+  "revoked": false,
+  "schema_version": "pcs.authority_record.v0",
+  "valid_from": 100,
+  "valid_until": 200
+}

adapters/pcs/fixtures/reward-binding/adversarial/artifacts_dup/env-1.json

@@ -0,0 +1,6 @@
+{
+  "description": "lab env",
+  "digest": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+  "profile_id": "env-1",
+  "schema_version": "pcs.environment_profile.v0"
+}

adapters/pcs/fixtures/reward-binding/adversarial/artifacts_dup/vp-1.json

@@ -0,0 +1,8 @@
+{
+  "config_digest": "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
+  "profile_id": "vp-1",
+  "rubric": "r1",
+  "schema_version": "pcs.verifier_profile.v0",
+  "status": "active",
+  "suite": "basic"
+}

adapters/pcs/fixtures/reward-binding/adversarial/artifacts_dup/vp-1b.json

@@ -0,0 +1,8 @@
+{
+  "config_digest": "2222222222222222222222222222222222222222222222222222222222222222",
+  "profile_id": "vp-1",
+  "rubric": "r1",
+  "schema_version": "pcs.verifier_profile.v0",
+  "status": "active",
+  "suite": "basic"
+}

adapters/pcs/fixtures/reward-binding/adversarial/artifacts_dup/vr-1.json

@@ -0,0 +1,9 @@
+{
+  "result_id": "vr-1",
+  "schema_version": "pcs.verification_result.v0",
+  "status": "pass",
+  "verifier_profile_ref": {
+    "digest": "2dde9120776c810002cb00d44aabeb73563e39281fb545c9bd2760cabfd9d595",
+    "id": "vp-1"
+  }
+}

adapters/pcs/fixtures/reward-binding/adversarial/artifacts_dup/vr-2.json

@@ -0,0 +1,9 @@
+{
+  "result_id": "vr-2",
+  "schema_version": "pcs.verification_result.v0",
+  "status": "pass",
+  "verifier_profile_ref": {
+    "digest": "001f51522834ff1dff03fecbc865432bbd7c6e8856befe7b80fee722d99d9fa3",
+    "id": "vp-1b"
+  }
+}

adapters/pcs/fixtures/reward-binding/adversarial/artifacts_revoked/auth-1.json

@@ -0,0 +1,15 @@
+{
+  "authority_id": "auth-1",
+  "authorized_issuers": [
+    {
+      "principal_id": "issuer-1",
+      "tenant_id": "tenant-lab"
+    }
+  ],
+  "claim_class": "reward_binding",
+  "environment_digest": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+  "revoked": true,
+  "schema_version": "pcs.authority_record.v0",
+  "valid_from": 100,
+  "valid_until": 200
+}

adapters/pcs/fixtures/reward-binding/adversarial/artifacts_revoked/env-1.json

@@ -0,0 +1,6 @@
+{
+  "description": "lab env",
+  "digest": "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+  "profile_id": "env-1",
+  "schema_version": "pcs.environment_profile.v0"
+}

adapters/pcs/fixtures/reward-binding/adversarial/artifacts_revoked/vp-1.json

@@ -0,0 +1,8 @@
+{
+  "config_digest": "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
+  "profile_id": "vp-1",
+  "rubric": "r1",
+  "schema_version": "pcs.verifier_profile.v0",
+  "status": "active",
+  "suite": "basic"
+}

adapters/pcs/fixtures/reward-binding/adversarial/artifacts_revoked/vr-1.json

@@ -0,0 +1,9 @@
+{
+  "result_id": "vr-1",
+  "schema_version": "pcs.verification_result.v0",
+  "status": "pass",
+  "verifier_profile_ref": {
+    "digest": "2dde9120776c810002cb00d44aabeb73563e39281fb545c9bd2760cabfd9d595",
+    "id": "vp-1"
+  }
+}

adapters/pcs/fixtures/reward-binding/adversarial/reward_bad_profile_digest.json

@@ -0,0 +1,31 @@
+{
+  "authority_ref": {
+    "digest": "530a92ae8b91bc89276183fb6f43bf03fe274985776e53e07960b51dbb655006",
+    "id": "auth-1"
+  },
+  "claim_class": "reward_binding",
+  "envelope_id": "rew-1",
+  "environment_profile_ref": {
+    "digest": "889a85d80dc564d8d839626cd6cdc8e36269059a1a7b2972d22a632677c9e08e",
+    "id": "env-1"
+  },
+  "integrity": {
+    "alg": "sha256",
+    "digest": "1d5c8803f8742d43b43183f188eeb4ca0269762ba07878a8b83a70fff9f4c1b3",
+    "key_id": "org-root-1"
+  },
+  "issued_at": 150,
+  "issuer": {
+    "principal_id": "issuer-1",
+    "tenant_id": "tenant-lab"
+  },
+  "schema_version": "pcs.reward_evidence_envelope.v0",
+  "stale": false,
+  "trace_digest": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "verifier_result_refs": [
+    {
+      "digest": "7d677412669d2d5660586071b8ece0dc1495d346a9b0991ed564ef71aef45172",
+      "id": "vr-1"
+    }
+  ]
+}

adapters/pcs/fixtures/reward-binding/adversarial/reward_duplicate_profile_conflict.json

@@ -0,0 +1,35 @@
+{
+  "authority_ref": {
+    "digest": "530a92ae8b91bc89276183fb6f43bf03fe274985776e53e07960b51dbb655006",
+    "id": "auth-1"
+  },
+  "claim_class": "reward_binding",
+  "envelope_id": "rew-dup",
+  "environment_profile_ref": {
+    "digest": "889a85d80dc564d8d839626cd6cdc8e36269059a1a7b2972d22a632677c9e08e",
+    "id": "env-1"
+  },
+  "integrity": {
+    "alg": "sha256",
+    "digest": "3ef50c8d8123607b76e02bd92a4f14e27493ffe4b44c3ae1a8454c2cd758ac3c",
+    "key_id": "org-root-1"
+  },
+  "issued_at": 150,
+  "issuer": {
+    "principal_id": "issuer-1",
+    "tenant_id": "tenant-lab"
+  },
+  "schema_version": "pcs.reward_evidence_envelope.v0",
+  "stale": false,
+  "trace_digest": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "verifier_result_refs": [
+    {
+      "digest": "7d677412669d2d5660586071b8ece0dc1495d346a9b0991ed564ef71aef45172",
+      "id": "vr-1"
+    },
+    {
+      "digest": "b50d92b7a7832aa0395b00a333a0044abd860db4ac3a1d6ad26264e7776d1ab3",
+      "id": "vr-2"
+    }
+  ]
+}

adapters/pcs/fixtures/reward-binding/adversarial/reward_for_substituted_trace.json

@@ -0,0 +1,31 @@
+{
+  "authority_ref": {
+    "digest": "530a92ae8b91bc89276183fb6f43bf03fe274985776e53e07960b51dbb655006",
+    "id": "auth-1"
+  },
+  "claim_class": "reward_binding",
+  "envelope_id": "rew-1",
+  "environment_profile_ref": {
+    "digest": "889a85d80dc564d8d839626cd6cdc8e36269059a1a7b2972d22a632677c9e08e",
+    "id": "env-1"
+  },
+  "integrity": {
+    "alg": "sha256",
+    "digest": "1d5c8803f8742d43b43183f188eeb4ca0269762ba07878a8b83a70fff9f4c1b3",
+    "key_id": "org-root-1"
+  },
+  "issued_at": 150,
+  "issuer": {
+    "principal_id": "issuer-1",
+    "tenant_id": "tenant-lab"
+  },
+  "schema_version": "pcs.reward_evidence_envelope.v0",
+  "stale": false,
+  "trace_digest": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "verifier_result_refs": [
+    {
+      "digest": "7d677412669d2d5660586071b8ece0dc1495d346a9b0991ed564ef71aef45172",
+      "id": "vr-1"
+    }
+  ]
+}