{
 "ceiling": "Conformance proves agreement with the reference on these named attacks, boolean by boolean. It does not prove the absence of other bugs. The manifest identifies code, not a running process.",
 "count": 26,
 "generated_ns": "2026-09-19T18:42:24.173236096+03:00",
 "reference_fingerprint": "330e2f256ffd8d4b",
 "vectors": [
  {
   "attack": "none \u2014 the reference receipt",
   "expected": {
    "authenticity_ok": true,
    "claim_binding_ok": true,
    "hardware_authenticity_ok": null,
    "identity_ok": true,
    "integrity_ok": true,
    "valid": true
   },
   "name": "clean",
   "receipt": {
    "chain": [
     {
      "payload_hash": "378caccd3bd8fae094917eecbec7c3e1b8936d82bba53d39ce11e37cc0497698",
      "prev_hash": "",
      "record_hash": "f4598acfa78c1edafd9c95caa8e0f1a61cd6bc24606458e85da7a67fa5a8412c",
      "sator_hmac": null,
      "seq": 0,
      "stage": "SEED",
      "ts_ms": 1789832544158
     },
     {
      "payload_hash": "15f9606fc4c20572b6bd87602b039e1b0c84666c1ebfdcf3cfa0f56f14fcea75",
      "prev_hash": "f4598acfa78c1edafd9c95caa8e0f1a61cd6bc24606458e85da7a67fa5a8412c",
      "record_hash": "18f10bd773538e604a93f05aaee2a698556e339505dd444a6ea80b52b356955f",
      "sator_hmac": null,
      "seq": 1,
      "stage": "LOG",
      "ts_ms": 1789832544158
     }
    ],
    "claim": {
     "confidence": 0.87,
     "inference_ts": "2026-09-03T00:00:00Z",
     "input_fingerprint": "sha3-256:e3aa00aff57a949b6a69c7cd6725ccfff2444ffe13ea4f8be985dc301fc82717",
     "meta": {
      "suite": "counterfoil-conformance"
     },
     "model_id": "conformance-model-v1",
     "output_label": "LABEL"
    },
    "counterfoil_receipt_version": "1",
    "guarantees": {
     "authenticity": "Ed25519 seal over the terminal record_hash; only the holder of the private key for the embedded public_key could issue it. Establish trust in that key out of band via key_fingerprint.",
     "integrity": "SHA3-256 hash chain re-verifies offline with NO secret; any field tamper, reorder, or splice fails."
    },
    "issued_ns": "2026-09-19T18:42:24.160596895+03:00",
    "kind": "ai-inference-attestation",
    "seal": {
     "alg": "ed25519",
     "key_fingerprint": "330e2f256ffd8d4b",
     "public_key": "d09263f54bb8d6cf8248fd7b5f2b515c82b439f5f40f459c8df107d3515ea03c",
     "sealed_field": "chain[-1].record_hash",
     "sealed_value": "18f10bd773538e604a93f05aaee2a698556e339505dd444a6ea80b52b356955f",
     "signature": "ac542355e652edf1cdeaec1879f6b7093bf842f5d3bb2635ce74f39f43788f06955df83d7b2201f86bf3db39f68927f82cd3803ac6845d34d63be961f06b2809"
    },
    "seed_anchor": "378caccd3bd8fae094917eecbec7c3e1b8936d82bba53d39ce11e37cc0497698",
    "verify_cmd": "python verify_counterfoil.py <receipt.json>"
   },
   "verify_kwargs": {
    "expected_fingerprint": "330e2f256ffd8d4b"
   }
  },
  {
   "attack": "edit a claim field after issuance",
   "expected": {
    "claim_binding_ok": false,
    "integrity_ok": true,
    "valid": false
   },
   "name": "claim_field_tamper",
   "receipt": {
    "chain": [
     {
      "payload_hash": "378caccd3bd8fae094917eecbec7c3e1b8936d82bba53d39ce11e37cc0497698",
      "prev_hash": "",
      "record_hash": "f4598acfa78c1edafd9c95caa8e0f1a61cd6bc24606458e85da7a67fa5a8412c",
      "sator_hmac": null,
      "seq": 0,
      "stage": "SEED",
      "ts_ms": 1789832544158
     },
     {
      "payload_hash": "15f9606fc4c20572b6bd87602b039e1b0c84666c1ebfdcf3cfa0f56f14fcea75",
      "prev_hash": "f4598acfa78c1edafd9c95caa8e0f1a61cd6bc24606458e85da7a67fa5a8412c",
      "record_hash": "18f10bd773538e604a93f05aaee2a698556e339505dd444a6ea80b52b356955f",
      "sator_hmac": null,
      "seq": 1,
      "stage": "LOG",
      "ts_ms": 1789832544158
     }
    ],
    "claim": {
     "confidence": 0.99,
     "inference_ts": "2026-09-03T00:00:00Z",
     "input_fingerprint": "sha3-256:e3aa00aff57a949b6a69c7cd6725ccfff2444ffe13ea4f8be985dc301fc82717",
     "meta": {
      "suite": "counterfoil-conformance"
     },
     "model_id": "conformance-model-v1",
     "output_label": "LABEL"
    },
    "counterfoil_receipt_version": "1",
    "guarantees": {
     "authenticity": "Ed25519 seal over the terminal record_hash; only the holder of the private key for the embedded public_key could issue it. Establish trust in that key out of band via key_fingerprint.",
     "integrity": "SHA3-256 hash chain re-verifies offline with NO secret; any field tamper, reorder, or splice fails."
    },
    "issued_ns": "2026-09-19T18:42:24.160596895+03:00",
    "kind": "ai-inference-attestation",
    "seal": {
     "alg": "ed25519",
     "key_fingerprint": "330e2f256ffd8d4b",
     "public_key": "d09263f54bb8d6cf8248fd7b5f2b515c82b439f5f40f459c8df107d3515ea03c",
     "sealed_field": "chain[-1].record_hash",
     "sealed_value": "18f10bd773538e604a93f05aaee2a698556e339505dd444a6ea80b52b356955f",
     "signature": "ac542355e652edf1cdeaec1879f6b7093bf842f5d3bb2635ce74f39f43788f06955df83d7b2201f86bf3db39f68927f82cd3803ac6845d34d63be961f06b2809"
    },
    "seed_anchor": "378caccd3bd8fae094917eecbec7c3e1b8936d82bba53d39ce11e37cc0497698",
    "verify_cmd": "python verify_counterfoil.py <receipt.json>"
   },
   "verify_kwargs": {}
  },
  {
   "attack": "edit claim metadata after issuance",
   "expected": {
    "claim_binding_ok": false,
    "valid": false
   },
   "name": "claim_meta_tamper",
   "receipt": {
    "chain": [
     {
      "payload_hash": "378caccd3bd8fae094917eecbec7c3e1b8936d82bba53d39ce11e37cc0497698",
      "prev_hash": "",
      "record_hash": "f4598acfa78c1edafd9c95caa8e0f1a61cd6bc24606458e85da7a67fa5a8412c",
      "sator_hmac": null,
      "seq": 0,
      "stage": "SEED",
      "ts_ms": 1789832544158
     },
     {
      "payload_hash": "15f9606fc4c20572b6bd87602b039e1b0c84666c1ebfdcf3cfa0f56f14fcea75",
      "prev_hash": "f4598acfa78c1edafd9c95caa8e0f1a61cd6bc24606458e85da7a67fa5a8412c",
      "record_hash": "18f10bd773538e604a93f05aaee2a698556e339505dd444a6ea80b52b356955f",
      "sator_hmac": null,
      "seq": 1,
      "stage": "LOG",
      "ts_ms": 1789832544158
     }
    ],
    "claim": {
     "confidence": 0.87,
     "inference_ts": "2026-09-03T00:00:00Z",
     "input_fingerprint": "sha3-256:e3aa00aff57a949b6a69c7cd6725ccfff2444ffe13ea4f8be985dc301fc82717",
     "meta": {
      "suite": "forged"
     },
     "model_id": "conformance-model-v1",
     "output_label": "LABEL"
    },
    "counterfoil_receipt_version": "1",
    "guarantees": {
     "authenticity": "Ed25519 seal over the terminal record_hash; only the holder of the private key for the embedded public_key could issue it. Establish trust in that key out of band via key_fingerprint.",
     "integrity": "SHA3-256 hash chain re-verifies offline with NO secret; any field tamper, reorder, or splice fails."
    },
    "issued_ns": "2026-09-19T18:42:24.160596895+03:00",
    "kind": "ai-inference-attestation",
    "seal": {
     "alg": "ed25519",
     "key_fingerprint": "330e2f256ffd8d4b",
     "public_key": "d09263f54bb8d6cf8248fd7b5f2b515c82b439f5f40f459c8df107d3515ea03c",
     "sealed_field": "chain[-1].record_hash",
     "sealed_value": "18f10bd773538e604a93f05aaee2a698556e339505dd444a6ea80b52b356955f",
     "signature": "ac542355e652edf1cdeaec1879f6b7093bf842f5d3bb2635ce74f39f43788f06955df83d7b2201f86bf3db39f68927f82cd3803ac6845d34d63be961f06b2809"
    },
    "seed_anchor": "378caccd3bd8fae094917eecbec7c3e1b8936d82bba53d39ce11e37cc0497698",
    "verify_cmd": "python verify_counterfoil.py <receipt.json>"
   },
   "verify_kwargs": {}
  },
  {
   "attack": "flip a byte in the terminal record_hash",
   "expected": {
    "integrity_ok": false,
    "valid": false
   },
   "name": "terminal_record_hash_tamper",
   "receipt": {
    "chain": [
     {
      "payload_hash": "378caccd3bd8fae094917eecbec7c3e1b8936d82bba53d39ce11e37cc0497698",
      "prev_hash": "",
      "record_hash": "f4598acfa78c1edafd9c95caa8e0f1a61cd6bc24606458e85da7a67fa5a8412c",
      "sator_hmac": null,
      "seq": 0,
      "stage": "SEED",
      "ts_ms": 1789832544158
     },
     {
      "payload_hash": "15f9606fc4c20572b6bd87602b039e1b0c84666c1ebfdcf3cfa0f56f14fcea75",
      "prev_hash": "f4598acfa78c1edafd9c95caa8e0f1a61cd6bc24606458e85da7a67fa5a8412c",
      "record_hash": "18f100d773538e604a93f05aaee2a698556e339505dd444a6ea80b52b356955f",
      "sator_hmac": null,
      "seq": 1,
      "stage": "LOG",
      "ts_ms": 1789832544158
     }
    ],
    "claim": {
     "confidence": 0.87,
     "inference_ts": "2026-09-03T00:00:00Z",
     "input_fingerprint": "sha3-256:e3aa00aff57a949b6a69c7cd6725ccfff2444ffe13ea4f8be985dc301fc82717",
     "meta": {
      "suite": "counterfoil-conformance"
     },
     "model_id": "conformance-model-v1",
     "output_label": "LABEL"
    },
    "counterfoil_receipt_version": "1",
    "guarantees": {
     "authenticity": "Ed25519 seal over the terminal record_hash; only the holder of the private key for the embedded public_key could issue it. Establish trust in that key out of band via key_fingerprint.",
     "integrity": "SHA3-256 hash chain re-verifies offline with NO secret; any field tamper, reorder, or splice fails."
    },
    "issued_ns": "2026-09-19T18:42:24.160596895+03:00",
    "kind": "ai-inference-attestation",
    "seal": {
     "alg": "ed25519",
     "key_fingerprint": "330e2f256ffd8d4b",
     "public_key": "d09263f54bb8d6cf8248fd7b5f2b515c82b439f5f40f459c8df107d3515ea03c",
     "sealed_field": "chain[-1].record_hash",
     "sealed_value": "18f10bd773538e604a93f05aaee2a698556e339505dd444a6ea80b52b356955f",
     "signature": "ac542355e652edf1cdeaec1879f6b7093bf842f5d3bb2635ce74f39f43788f06955df83d7b2201f86bf3db39f68927f82cd3803ac6845d34d63be961f06b2809"
    },
    "seed_anchor": "378caccd3bd8fae094917eecbec7c3e1b8936d82bba53d39ce11e37cc0497698",
    "verify_cmd": "python verify_counterfoil.py <receipt.json>"
   },
   "verify_kwargs": {}
  },
  {
   "attack": "flip a byte in the LOG record's payload_hash",
   "expected": {
    "integrity_ok": false,
    "valid": false
   },
   "name": "log_payload_tamper",
   "receipt": {
    "chain": [
     {
      "payload_hash": "378caccd3bd8fae094917eecbec7c3e1b8936d82bba53d39ce11e37cc0497698",
      "prev_hash": "",
      "record_hash": "f4598acfa78c1edafd9c95caa8e0f1a61cd6bc24606458e85da7a67fa5a8412c",
      "sator_hmac": null,
      "seq": 0,
      "stage": "SEED",
      "ts_ms": 1789832544158
     },
     {
      "payload_hash": "15f9616fc4c20572b6bd87602b039e1b0c84666c1ebfdcf3cfa0f56f14fcea75",
      "prev_hash": "f4598acfa78c1edafd9c95caa8e0f1a61cd6bc24606458e85da7a67fa5a8412c",
      "record_hash": "18f10bd773538e604a93f05aaee2a698556e339505dd444a6ea80b52b356955f",
      "sator_hmac": null,
      "seq": 1,
      "stage": "LOG",
      "ts_ms": 1789832544158
     }
    ],
    "claim": {
     "confidence": 0.87,
     "inference_ts": "2026-09-03T00:00:00Z",
     "input_fingerprint": "sha3-256:e3aa00aff57a949b6a69c7cd6725ccfff2444ffe13ea4f8be985dc301fc82717",
     "meta": {
      "suite": "counterfoil-conformance"
     },
     "model_id": "conformance-model-v1",
     "output_label": "LABEL"
    },
    "counterfoil_receipt_version": "1",
    "guarantees": {
     "authenticity": "Ed25519 seal over the terminal record_hash; only the holder of the private key for the embedded public_key could issue it. Establish trust in that key out of band via key_fingerprint.",
     "integrity": "SHA3-256 hash chain re-verifies offline with NO secret; any field tamper, reorder, or splice fails."
    },
    "issued_ns": "2026-09-19T18:42:24.160596895+03:00",
    "kind": "ai-inference-attestation",
    "seal": {
     "alg": "ed25519",
     "key_fingerprint": "330e2f256ffd8d4b",
     "public_key": "d09263f54bb8d6cf8248fd7b5f2b515c82b439f5f40f459c8df107d3515ea03c",
     "sealed_field": "chain[-1].record_hash",
     "sealed_value": "18f10bd773538e604a93f05aaee2a698556e339505dd444a6ea80b52b356955f",
     "signature": "ac542355e652edf1cdeaec1879f6b7093bf842f5d3bb2635ce74f39f43788f06955df83d7b2201f86bf3db39f68927f82cd3803ac6845d34d63be961f06b2809"
    },
    "seed_anchor": "378caccd3bd8fae094917eecbec7c3e1b8936d82bba53d39ce11e37cc0497698",
    "verify_cmd": "python verify_counterfoil.py <receipt.json>"
   },
   "verify_kwargs": {}
  },
  {
   "attack": "swap SEED and LOG",
   "expected": {
    "integrity_ok": false,
    "valid": false
   },
   "name": "chain_reorder",
   "receipt": {
    "chain": [
     {
      "payload_hash": "15f9606fc4c20572b6bd87602b039e1b0c84666c1ebfdcf3cfa0f56f14fcea75",
      "prev_hash": "f4598acfa78c1edafd9c95caa8e0f1a61cd6bc24606458e85da7a67fa5a8412c",
      "record_hash": "18f10bd773538e604a93f05aaee2a698556e339505dd444a6ea80b52b356955f",
      "sator_hmac": null,
      "seq": 1,
      "stage": "LOG",
      "ts_ms": 1789832544158
     },
     {
      "payload_hash": "378caccd3bd8fae094917eecbec7c3e1b8936d82bba53d39ce11e37cc0497698",
      "prev_hash": "",
      "record_hash": "f4598acfa78c1edafd9c95caa8e0f1a61cd6bc24606458e85da7a67fa5a8412c",
      "sator_hmac": null,
      "seq": 0,
      "stage": "SEED",
      "ts_ms": 1789832544158
     }
    ],
    "claim": {
     "confidence": 0.87,
     "inference_ts": "2026-09-03T00:00:00Z",
     "input_fingerprint": "sha3-256:e3aa00aff57a949b6a69c7cd6725ccfff2444ffe13ea4f8be985dc301fc82717",
     "meta": {
      "suite": "counterfoil-conformance"
     },
     "model_id": "conformance-model-v1",
     "output_label": "LABEL"
    },
    "counterfoil_receipt_version": "1",
    "guarantees": {
     "authenticity": "Ed25519 seal over the terminal record_hash; only the holder of the private key for the embedded public_key could issue it. Establish trust in that key out of band via key_fingerprint.",
     "integrity": "SHA3-256 hash chain re-verifies offline with NO secret; any field tamper, reorder, or splice fails."
    },
    "issued_ns": "2026-09-19T18:42:24.160596895+03:00",
    "kind": "ai-inference-attestation",
    "seal": {
     "alg": "ed25519",
     "key_fingerprint": "330e2f256ffd8d4b",
     "public_key": "d09263f54bb8d6cf8248fd7b5f2b515c82b439f5f40f459c8df107d3515ea03c",
     "sealed_field": "chain[-1].record_hash",
     "sealed_value": "18f10bd773538e604a93f05aaee2a698556e339505dd444a6ea80b52b356955f",
     "signature": "ac542355e652edf1cdeaec1879f6b7093bf842f5d3bb2635ce74f39f43788f06955df83d7b2201f86bf3db39f68927f82cd3803ac6845d34d63be961f06b2809"
    },
    "seed_anchor": "378caccd3bd8fae094917eecbec7c3e1b8936d82bba53d39ce11e37cc0497698",
    "verify_cmd": "python verify_counterfoil.py <receipt.json>"
   },
   "verify_kwargs": {}
  },
  {
   "attack": "remove the SEED record (chain no longer starts at the anchor)",
   "expected": {
    "integrity_ok": false,
    "valid": false
   },
   "name": "chain_splice_seed",
   "receipt": {
    "chain": [
     {
      "payload_hash": "15f9606fc4c20572b6bd87602b039e1b0c84666c1ebfdcf3cfa0f56f14fcea75",
      "prev_hash": "f4598acfa78c1edafd9c95caa8e0f1a61cd6bc24606458e85da7a67fa5a8412c",
      "record_hash": "18f10bd773538e604a93f05aaee2a698556e339505dd444a6ea80b52b356955f",
      "sator_hmac": null,
      "seq": 1,
      "stage": "LOG",
      "ts_ms": 1789832544158
     }
    ],
    "claim": {
     "confidence": 0.87,
     "inference_ts": "2026-09-03T00:00:00Z",
     "input_fingerprint": "sha3-256:e3aa00aff57a949b6a69c7cd6725ccfff2444ffe13ea4f8be985dc301fc82717",
     "meta": {
      "suite": "counterfoil-conformance"
     },
     "model_id": "conformance-model-v1",
     "output_label": "LABEL"
    },
    "counterfoil_receipt_version": "1",
    "guarantees": {
     "authenticity": "Ed25519 seal over the terminal record_hash; only the holder of the private key for the embedded public_key could issue it. Establish trust in that key out of band via key_fingerprint.",
     "integrity": "SHA3-256 hash chain re-verifies offline with NO secret; any field tamper, reorder, or splice fails."
    },
    "issued_ns": "2026-09-19T18:42:24.160596895+03:00",
    "kind": "ai-inference-attestation",
    "seal": {
     "alg": "ed25519",
     "key_fingerprint": "330e2f256ffd8d4b",
     "public_key": "d09263f54bb8d6cf8248fd7b5f2b515c82b439f5f40f459c8df107d3515ea03c",
     "sealed_field": "chain[-1].record_hash",
     "sealed_value": "18f10bd773538e604a93f05aaee2a698556e339505dd444a6ea80b52b356955f",
     "signature": "ac542355e652edf1cdeaec1879f6b7093bf842f5d3bb2635ce74f39f43788f06955df83d7b2201f86bf3db39f68927f82cd3803ac6845d34d63be961f06b2809"
    },
    "seed_anchor": "378caccd3bd8fae094917eecbec7c3e1b8936d82bba53d39ce11e37cc0497698",
    "verify_cmd": "python verify_counterfoil.py <receipt.json>"
   },
   "verify_kwargs": {}
  },
  {
   "attack": "append a forged record whose record_hash does not recompute",
   "expected": {
    "integrity_ok": false,
    "valid": false
   },
   "name": "chain_append_forged",
   "receipt": {
    "chain": [
     {
      "payload_hash": "378caccd3bd8fae094917eecbec7c3e1b8936d82bba53d39ce11e37cc0497698",
      "prev_hash": "",
      "record_hash": "f4598acfa78c1edafd9c95caa8e0f1a61cd6bc24606458e85da7a67fa5a8412c",
      "sator_hmac": null,
      "seq": 0,
      "stage": "SEED",
      "ts_ms": 1789832544158
     },
     {
      "payload_hash": "15f9606fc4c20572b6bd87602b039e1b0c84666c1ebfdcf3cfa0f56f14fcea75",
      "prev_hash": "f4598acfa78c1edafd9c95caa8e0f1a61cd6bc24606458e85da7a67fa5a8412c",
      "record_hash": "18f10bd773538e604a93f05aaee2a698556e339505dd444a6ea80b52b356955f",
      "sator_hmac": null,
      "seq": 1,
      "stage": "LOG",
      "ts_ms": 1789832544158
     },
     {
      "payload_hash": "15f9616fc4c20572b6bd87602b039e1b0c84666c1ebfdcf3cfa0f56f14fcea75",
      "prev_hash": "18f10bd773538e604a93f05aaee2a698556e339505dd444a6ea80b52b356955f",
      "record_hash": "18f10bd770538e604a93f05aaee2a698556e339505dd444a6ea80b52b356955f",
      "sator_hmac": null,
      "seq": 2,
      "stage": "LOG",
      "ts_ms": 1789832544158
     }
    ],
    "claim": {
     "confidence": 0.87,
     "inference_ts": "2026-09-03T00:00:00Z",
     "input_fingerprint": "sha3-256:e3aa00aff57a949b6a69c7cd6725ccfff2444ffe13ea4f8be985dc301fc82717",
     "meta": {
      "suite": "counterfoil-conformance"
     },
     "model_id": "conformance-model-v1",
     "output_label": "LABEL"
    },
    "counterfoil_receipt_version": "1",
    "guarantees": {
     "authenticity": "Ed25519 seal over the terminal record_hash; only the holder of the private key for the embedded public_key could issue it. Establish trust in that key out of band via key_fingerprint.",
     "integrity": "SHA3-256 hash chain re-verifies offline with NO secret; any field tamper, reorder, or splice fails."
    },
    "issued_ns": "2026-09-19T18:42:24.160596895+03:00",
    "kind": "ai-inference-attestation",
    "seal": {
     "alg": "ed25519",
     "key_fingerprint": "330e2f256ffd8d4b",
     "public_key": "d09263f54bb8d6cf8248fd7b5f2b515c82b439f5f40f459c8df107d3515ea03c",
     "sealed_field": "chain[-1].record_hash",
     "sealed_value": "18f10bd773538e604a93f05aaee2a698556e339505dd444a6ea80b52b356955f",
     "signature": "ac542355e652edf1cdeaec1879f6b7093bf842f5d3bb2635ce74f39f43788f06955df83d7b2201f86bf3db39f68927f82cd3803ac6845d34d63be961f06b2809"
    },
    "seed_anchor": "378caccd3bd8fae094917eecbec7c3e1b8936d82bba53d39ce11e37cc0497698",
    "verify_cmd": "python verify_counterfoil.py <receipt.json>"
   },
   "verify_kwargs": {}
  },
  {
   "attack": "drop the terminal record",
   "expected": {
    "authenticity_ok": false,
    "valid": false
   },
   "name": "chain_truncate_last",
   "receipt": {
    "chain": [
     {
      "payload_hash": "378caccd3bd8fae094917eecbec7c3e1b8936d82bba53d39ce11e37cc0497698",
      "prev_hash": "",
      "record_hash": "f4598acfa78c1edafd9c95caa8e0f1a61cd6bc24606458e85da7a67fa5a8412c",
      "sator_hmac": null,
      "seq": 0,
      "stage": "SEED",
      "ts_ms": 1789832544158
     }
    ],
    "claim": {
     "confidence": 0.87,
     "inference_ts": "2026-09-03T00:00:00Z",
     "input_fingerprint": "sha3-256:e3aa00aff57a949b6a69c7cd6725ccfff2444ffe13ea4f8be985dc301fc82717",
     "meta": {
      "suite": "counterfoil-conformance"
     },
     "model_id": "conformance-model-v1",
     "output_label": "LABEL"
    },
    "counterfoil_receipt_version": "1",
    "guarantees": {
     "authenticity": "Ed25519 seal over the terminal record_hash; only the holder of the private key for the embedded public_key could issue it. Establish trust in that key out of band via key_fingerprint.",
     "integrity": "SHA3-256 hash chain re-verifies offline with NO secret; any field tamper, reorder, or splice fails."
    },
    "issued_ns": "2026-09-19T18:42:24.160596895+03:00",
    "kind": "ai-inference-attestation",
    "seal": {
     "alg": "ed25519",
     "key_fingerprint": "330e2f256ffd8d4b",
     "public_key": "d09263f54bb8d6cf8248fd7b5f2b515c82b439f5f40f459c8df107d3515ea03c",
     "sealed_field": "chain[-1].record_hash",
     "sealed_value": "18f10bd773538e604a93f05aaee2a698556e339505dd444a6ea80b52b356955f",
     "signature": "ac542355e652edf1cdeaec1879f6b7093bf842f5d3bb2635ce74f39f43788f06955df83d7b2201f86bf3db39f68927f82cd3803ac6845d34d63be961f06b2809"
    },
    "seed_anchor": "378caccd3bd8fae094917eecbec7c3e1b8936d82bba53d39ce11e37cc0497698",
    "verify_cmd": "python verify_counterfoil.py <receipt.json>"
   },
   "verify_kwargs": {}
  },
  {
   "attack": "no records at all (never vacuously valid)",
   "expected": {
    "authenticity_ok": false,
    "integrity_ok": false,
    "valid": false
   },
   "name": "empty_chain",
   "receipt": {
    "chain": [],
    "claim": {
     "confidence": 0.87,
     "inference_ts": "2026-09-03T00:00:00Z",
     "input_fingerprint": "sha3-256:e3aa00aff57a949b6a69c7cd6725ccfff2444ffe13ea4f8be985dc301fc82717",
     "meta": {
      "suite": "counterfoil-conformance"
     },
     "model_id": "conformance-model-v1",
     "output_label": "LABEL"
    },
    "counterfoil_receipt_version": "1",
    "guarantees": {
     "authenticity": "Ed25519 seal over the terminal record_hash; only the holder of the private key for the embedded public_key could issue it. Establish trust in that key out of band via key_fingerprint.",
     "integrity": "SHA3-256 hash chain re-verifies offline with NO secret; any field tamper, reorder, or splice fails."
    },
    "issued_ns": "2026-09-19T18:42:24.160596895+03:00",
    "kind": "ai-inference-attestation",
    "seal": {
     "alg": "ed25519",
     "key_fingerprint": "330e2f256ffd8d4b",
     "public_key": "d09263f54bb8d6cf8248fd7b5f2b515c82b439f5f40f459c8df107d3515ea03c",
     "sealed_field": "chain[-1].record_hash",
     "sealed_value": "18f10bd773538e604a93f05aaee2a698556e339505dd444a6ea80b52b356955f",
     "signature": "ac542355e652edf1cdeaec1879f6b7093bf842f5d3bb2635ce74f39f43788f06955df83d7b2201f86bf3db39f68927f82cd3803ac6845d34d63be961f06b2809"
    },
    "seed_anchor": "378caccd3bd8fae094917eecbec7c3e1b8936d82bba53d39ce11e37cc0497698",
    "verify_cmd": "python verify_counterfoil.py <receipt.json>"
   },
   "verify_kwargs": {}
  },
  {
   "attack": "re-sign the same chain with a DIFFERENT key, embedded consistently",
   "expected": {
    "authenticity_ok": true,
    "identity_ok": false,
    "integrity_ok": true,
    "valid": false
   },
   "name": "reseal_foreign_key",
   "receipt": {
    "chain": [
     {
      "payload_hash": "378caccd3bd8fae094917eecbec7c3e1b8936d82bba53d39ce11e37cc0497698",
      "prev_hash": "",
      "record_hash": "f4598acfa78c1edafd9c95caa8e0f1a61cd6bc24606458e85da7a67fa5a8412c",
      "sator_hmac": null,
      "seq": 0,
      "stage": "SEED",
      "ts_ms": 1789832544158
     },
     {
      "payload_hash": "15f9606fc4c20572b6bd87602b039e1b0c84666c1ebfdcf3cfa0f56f14fcea75",
      "prev_hash": "f4598acfa78c1edafd9c95caa8e0f1a61cd6bc24606458e85da7a67fa5a8412c",
      "record_hash": "18f10bd773538e604a93f05aaee2a698556e339505dd444a6ea80b52b356955f",
      "sator_hmac": null,
      "seq": 1,
      "stage": "LOG",
      "ts_ms": 1789832544158
     }
    ],
    "claim": {
     "confidence": 0.87,
     "inference_ts": "2026-09-03T00:00:00Z",
     "input_fingerprint": "sha3-256:e3aa00aff57a949b6a69c7cd6725ccfff2444ffe13ea4f8be985dc301fc82717",
     "meta": {
      "suite": "counterfoil-conformance"
     },
     "model_id": "conformance-model-v1",
     "output_label": "LABEL"
    },
    "counterfoil_receipt_version": "1",
    "guarantees": {
     "authenticity": "Ed25519 seal over the terminal record_hash; only the holder of the private key for the embedded public_key could issue it. Establish trust in that key out of band via key_fingerprint.",
     "integrity": "SHA3-256 hash chain re-verifies offline with NO secret; any field tamper, reorder, or splice fails."
    },
    "issued_ns": "2026-09-19T18:42:24.160596895+03:00",
    "kind": "ai-inference-attestation",
    "seal": {
     "alg": "ed25519",
     "key_fingerprint": "43dda35d08bb891e",
     "public_key": "e5c7bba6a3f2f8be8cc46e9158bf6cd5c36ffaf2047b28f4852ce47d9beeec61",
     "sealed_field": "chain[-1].record_hash",
     "sealed_value": "18f10bd773538e604a93f05aaee2a698556e339505dd444a6ea80b52b356955f",
     "signature": "587455fcc6cdede8f122309a6c197bb85925a5ec485a298f002338d31a2a12798e289ff05f897dcfdcd31328599d23ba32bdee1f09320006fb1c4c46c060f906"
    },
    "seed_anchor": "378caccd3bd8fae094917eecbec7c3e1b8936d82bba53d39ce11e37cc0497698",
    "verify_cmd": "python verify_counterfoil.py <receipt.json>"
   },
   "verify_kwargs": {
    "expected_fingerprint": "330e2f256ffd8d4b"
   }
  },
  {
   "attack": "foreign-key reseal checked with no pinned fingerprint",
   "expected": {
    "authenticity_ok": true,
    "identity_ok": null,
    "integrity_ok": true
   },
   "name": "reseal_foreign_key_unpinned",
   "receipt": {
    "chain": [
     {
      "payload_hash": "378caccd3bd8fae094917eecbec7c3e1b8936d82bba53d39ce11e37cc0497698",
      "prev_hash": "",
      "record_hash": "f4598acfa78c1edafd9c95caa8e0f1a61cd6bc24606458e85da7a67fa5a8412c",
      "sator_hmac": null,
      "seq": 0,
      "stage": "SEED",
      "ts_ms": 1789832544158
     },
     {
      "payload_hash": "15f9606fc4c20572b6bd87602b039e1b0c84666c1ebfdcf3cfa0f56f14fcea75",
      "prev_hash": "f4598acfa78c1edafd9c95caa8e0f1a61cd6bc24606458e85da7a67fa5a8412c",
      "record_hash": "18f10bd773538e604a93f05aaee2a698556e339505dd444a6ea80b52b356955f",
      "sator_hmac": null,
      "seq": 1,
      "stage": "LOG",
      "ts_ms": 1789832544158
     }
    ],
    "claim": {
     "confidence": 0.87,
     "inference_ts": "2026-09-03T00:00:00Z",
     "input_fingerprint": "sha3-256:e3aa00aff57a949b6a69c7cd6725ccfff2444ffe13ea4f8be985dc301fc82717",
     "meta": {
      "suite": "counterfoil-conformance"
     },
     "model_id": "conformance-model-v1",
     "output_label": "LABEL"
    },
    "counterfoil_receipt_version": "1",
    "guarantees": {
     "authenticity": "Ed25519 seal over the terminal record_hash; only the holder of the private key for the embedded public_key could issue it. Establish trust in that key out of band via key_fingerprint.",
     "integrity": "SHA3-256 hash chain re-verifies offline with NO secret; any field tamper, reorder, or splice fails."
    },
    "issued_ns": "2026-09-19T18:42:24.160596895+03:00",
    "kind": "ai-inference-attestation",
    "seal": {
     "alg": "ed25519",
     "key_fingerprint": "116d985e65fb5124",
     "public_key": "e4e2c5cc7d66e8f928bcc8944d0a7cd6d189800329b9723b9c1252ff359e4288",
     "sealed_field": "chain[-1].record_hash",
     "sealed_value": "18f10bd773538e604a93f05aaee2a698556e339505dd444a6ea80b52b356955f",
     "signature": "039469dd4f1f099f2b6b7a40dc0225601374b9132f0f0e39b9d43fb224e2b9058df34d044a0e6d0b6b4040b19451f124e9a9d8dbed148ec221dcdcda32902604"
    },
    "seed_anchor": "378caccd3bd8fae094917eecbec7c3e1b8936d82bba53d39ce11e37cc0497698",
    "verify_cmd": "python verify_counterfoil.py <receipt.json>"
   },
   "verify_kwargs": {}
  },
  {
   "attack": "flip a byte in the seal signature",
   "expected": {
    "authenticity_ok": false,
    "integrity_ok": true,
    "valid": false
   },
   "name": "seal_signature_tamper",
   "receipt": {
    "chain": [
     {
      "payload_hash": "378caccd3bd8fae094917eecbec7c3e1b8936d82bba53d39ce11e37cc0497698",
      "prev_hash": "",
      "record_hash": "f4598acfa78c1edafd9c95caa8e0f1a61cd6bc24606458e85da7a67fa5a8412c",
      "sator_hmac": null,
      "seq": 0,
      "stage": "SEED",
      "ts_ms": 1789832544158
     },
     {
      "payload_hash": "15f9606fc4c20572b6bd87602b039e1b0c84666c1ebfdcf3cfa0f56f14fcea75",
      "prev_hash": "f4598acfa78c1edafd9c95caa8e0f1a61cd6bc24606458e85da7a67fa5a8412c",
      "record_hash": "18f10bd773538e604a93f05aaee2a698556e339505dd444a6ea80b52b356955f",
      "sator_hmac": null,
      "seq": 1,
      "stage": "LOG",
      "ts_ms": 1789832544158
     }
    ],
    "claim": {
     "confidence": 0.87,
     "inference_ts": "2026-09-03T00:00:00Z",
     "input_fingerprint": "sha3-256:e3aa00aff57a949b6a69c7cd6725ccfff2444ffe13ea4f8be985dc301fc82717",
     "meta": {
      "suite": "counterfoil-conformance"
     },
     "model_id": "conformance-model-v1",
     "output_label": "LABEL"
    },
    "counterfoil_receipt_version": "1",
    "guarantees": {
     "authenticity": "Ed25519 seal over the terminal record_hash; only the holder of the private key for the embedded public_key could issue it. Establish trust in that key out of band via key_fingerprint.",
     "integrity": "SHA3-256 hash chain re-verifies offline with NO secret; any field tamper, reorder, or splice fails."
    },
    "issued_ns": "2026-09-19T18:42:24.160596895+03:00",
    "kind": "ai-inference-attestation",
    "seal": {
     "alg": "ed25519",
     "key_fingerprint": "330e2f256ffd8d4b",
     "public_key": "d09263f54bb8d6cf8248fd7b5f2b515c82b439f5f40f459c8df107d3515ea03c",
     "sealed_field": "chain[-1].record_hash",
     "sealed_value": "18f10bd773538e604a93f05aaee2a698556e339505dd444a6ea80b52b356955f",
     "signature": "ac542055e652edf1cdeaec1879f6b7093bf842f5d3bb2635ce74f39f43788f06955df83d7b2201f86bf3db39f68927f82cd3803ac6845d34d63be961f06b2809"
    },
    "seed_anchor": "378caccd3bd8fae094917eecbec7c3e1b8936d82bba53d39ce11e37cc0497698",
    "verify_cmd": "python verify_counterfoil.py <receipt.json>"
   },
   "verify_kwargs": {}
  },
  {
   "attack": "seal fingerprint does not match its public key",
   "expected": {
    "authenticity_ok": false,
    "valid": false
   },
   "name": "seal_fingerprint_mismatch",
   "receipt": {
    "chain": [
     {
      "payload_hash": "378caccd3bd8fae094917eecbec7c3e1b8936d82bba53d39ce11e37cc0497698",
      "prev_hash": "",
      "record_hash": "f4598acfa78c1edafd9c95caa8e0f1a61cd6bc24606458e85da7a67fa5a8412c",
      "sator_hmac": null,
      "seq": 0,
      "stage": "SEED",
      "ts_ms": 1789832544158
     },
     {
      "payload_hash": "15f9606fc4c20572b6bd87602b039e1b0c84666c1ebfdcf3cfa0f56f14fcea75",
      "prev_hash": "f4598acfa78c1edafd9c95caa8e0f1a61cd6bc24606458e85da7a67fa5a8412c",
      "record_hash": "18f10bd773538e604a93f05aaee2a698556e339505dd444a6ea80b52b356955f",
      "sator_hmac": null,
      "seq": 1,
      "stage": "LOG",
      "ts_ms": 1789832544158
     }
    ],
    "claim": {
     "confidence": 0.87,
     "inference_ts": "2026-09-03T00:00:00Z",
     "input_fingerprint": "sha3-256:e3aa00aff57a949b6a69c7cd6725ccfff2444ffe13ea4f8be985dc301fc82717",
     "meta": {
      "suite": "counterfoil-conformance"
     },
     "model_id": "conformance-model-v1",
     "output_label": "LABEL"
    },
    "counterfoil_receipt_version": "1",
    "guarantees": {
     "authenticity": "Ed25519 seal over the terminal record_hash; only the holder of the private key for the embedded public_key could issue it. Establish trust in that key out of band via key_fingerprint.",
     "integrity": "SHA3-256 hash chain re-verifies offline with NO secret; any field tamper, reorder, or splice fails."
    },
    "issued_ns": "2026-09-19T18:42:24.160596895+03:00",
    "kind": "ai-inference-attestation",
    "seal": {
     "alg": "ed25519",
     "key_fingerprint": "deadbeefdeadbeef",
     "public_key": "d09263f54bb8d6cf8248fd7b5f2b515c82b439f5f40f459c8df107d3515ea03c",
     "sealed_field": "chain[-1].record_hash",
     "sealed_value": "18f10bd773538e604a93f05aaee2a698556e339505dd444a6ea80b52b356955f",
     "signature": "ac542355e652edf1cdeaec1879f6b7093bf842f5d3bb2635ce74f39f43788f06955df83d7b2201f86bf3db39f68927f82cd3803ac6845d34d63be961f06b2809"
    },
    "seed_anchor": "378caccd3bd8fae094917eecbec7c3e1b8936d82bba53d39ce11e37cc0497698",
    "verify_cmd": "python verify_counterfoil.py <receipt.json>"
   },
   "verify_kwargs": {}
  },
  {
   "attack": "unsupported seal algorithm must not pass",
   "expected": {
    "authenticity_ok": false,
    "valid": false
   },
   "name": "seal_alg_unsupported",
   "receipt": {
    "chain": [
     {
      "payload_hash": "378caccd3bd8fae094917eecbec7c3e1b8936d82bba53d39ce11e37cc0497698",
      "prev_hash": "",
      "record_hash": "f4598acfa78c1edafd9c95caa8e0f1a61cd6bc24606458e85da7a67fa5a8412c",
      "sator_hmac": null,
      "seq": 0,
      "stage": "SEED",
      "ts_ms": 1789832544158
     },
     {
      "payload_hash": "15f9606fc4c20572b6bd87602b039e1b0c84666c1ebfdcf3cfa0f56f14fcea75",
      "prev_hash": "f4598acfa78c1edafd9c95caa8e0f1a61cd6bc24606458e85da7a67fa5a8412c",
      "record_hash": "18f10bd773538e604a93f05aaee2a698556e339505dd444a6ea80b52b356955f",
      "sator_hmac": null,
      "seq": 1,
      "stage": "LOG",
      "ts_ms": 1789832544158
     }
    ],
    "claim": {
     "confidence": 0.87,
     "inference_ts": "2026-09-03T00:00:00Z",
     "input_fingerprint": "sha3-256:e3aa00aff57a949b6a69c7cd6725ccfff2444ffe13ea4f8be985dc301fc82717",
     "meta": {
      "suite": "counterfoil-conformance"
     },
     "model_id": "conformance-model-v1",
     "output_label": "LABEL"
    },
    "counterfoil_receipt_version": "1",
    "guarantees": {
     "authenticity": "Ed25519 seal over the terminal record_hash; only the holder of the private key for the embedded public_key could issue it. Establish trust in that key out of band via key_fingerprint.",
     "integrity": "SHA3-256 hash chain re-verifies offline with NO secret; any field tamper, reorder, or splice fails."
    },
    "issued_ns": "2026-09-19T18:42:24.160596895+03:00",
    "kind": "ai-inference-attestation",
    "seal": {
     "alg": "hmac-sha256",
     "key_fingerprint": "330e2f256ffd8d4b",
     "public_key": "d09263f54bb8d6cf8248fd7b5f2b515c82b439f5f40f459c8df107d3515ea03c",
     "sealed_field": "chain[-1].record_hash",
     "sealed_value": "18f10bd773538e604a93f05aaee2a698556e339505dd444a6ea80b52b356955f",
     "signature": "ac542355e652edf1cdeaec1879f6b7093bf842f5d3bb2635ce74f39f43788f06955df83d7b2201f86bf3db39f68927f82cd3803ac6845d34d63be961f06b2809"
    },
    "seed_anchor": "378caccd3bd8fae094917eecbec7c3e1b8936d82bba53d39ce11e37cc0497698",
    "verify_cmd": "python verify_counterfoil.py <receipt.json>"
   },
   "verify_kwargs": {}
  },
  {
   "attack": "seal claims a different terminal than the chain has",
   "expected": {
    "authenticity_ok": false,
    "integrity_ok": true,
    "valid": false
   },
   "name": "seal_sealed_value_mismatch",
   "receipt": {
    "chain": [
     {
      "payload_hash": "378caccd3bd8fae094917eecbec7c3e1b8936d82bba53d39ce11e37cc0497698",
      "prev_hash": "",
      "record_hash": "f4598acfa78c1edafd9c95caa8e0f1a61cd6bc24606458e85da7a67fa5a8412c",
      "sator_hmac": null,
      "seq": 0,
      "stage": "SEED",
      "ts_ms": 1789832544158
     },
     {
      "payload_hash": "15f9606fc4c20572b6bd87602b039e1b0c84666c1ebfdcf3cfa0f56f14fcea75",
      "prev_hash": "f4598acfa78c1edafd9c95caa8e0f1a61cd6bc24606458e85da7a67fa5a8412c",
      "record_hash": "18f10bd773538e604a93f05aaee2a698556e339505dd444a6ea80b52b356955f",
      "sator_hmac": null,
      "seq": 1,
      "stage": "LOG",
      "ts_ms": 1789832544158
     }
    ],
    "claim": {
     "confidence": 0.87,
     "inference_ts": "2026-09-03T00:00:00Z",
     "input_fingerprint": "sha3-256:e3aa00aff57a949b6a69c7cd6725ccfff2444ffe13ea4f8be985dc301fc82717",
     "meta": {
      "suite": "counterfoil-conformance"
     },
     "model_id": "conformance-model-v1",
     "output_label": "LABEL"
    },
    "counterfoil_receipt_version": "1",
    "guarantees": {
     "authenticity": "Ed25519 seal over the terminal record_hash; only the holder of the private key for the embedded public_key could issue it. Establish trust in that key out of band via key_fingerprint.",
     "integrity": "SHA3-256 hash chain re-verifies offline with NO secret; any field tamper, reorder, or splice fails."
    },
    "issued_ns": "2026-09-19T18:42:24.160596895+03:00",
    "kind": "ai-inference-attestation",
    "seal": {
     "alg": "ed25519",
     "key_fingerprint": "330e2f256ffd8d4b",
     "public_key": "d09263f54bb8d6cf8248fd7b5f2b515c82b439f5f40f459c8df107d3515ea03c",
     "sealed_field": "chain[-1].record_hash",
     "sealed_value": "18f100d773538e604a93f05aaee2a698556e339505dd444a6ea80b52b356955f",
     "signature": "ac542355e652edf1cdeaec1879f6b7093bf842f5d3bb2635ce74f39f43788f06955df83d7b2201f86bf3db39f68927f82cd3803ac6845d34d63be961f06b2809"
    },
    "seed_anchor": "378caccd3bd8fae094917eecbec7c3e1b8936d82bba53d39ce11e37cc0497698",
    "verify_cmd": "python verify_counterfoil.py <receipt.json>"
   },
   "verify_kwargs": {}
  },
  {
   "attack": "edit issued_ns: NOT evidence, verdict unchanged by design",
   "expected": {
    "authenticity_ok": true,
    "claim_binding_ok": true,
    "integrity_ok": true,
    "valid": true
   },
   "name": "issued_ns_tamper_is_unsealed",
   "receipt": {
    "chain": [
     {
      "payload_hash": "378caccd3bd8fae094917eecbec7c3e1b8936d82bba53d39ce11e37cc0497698",
      "prev_hash": "",
      "record_hash": "f4598acfa78c1edafd9c95caa8e0f1a61cd6bc24606458e85da7a67fa5a8412c",
      "sator_hmac": null,
      "seq": 0,
      "stage": "SEED",
      "ts_ms": 1789832544158
     },
     {
      "payload_hash": "15f9606fc4c20572b6bd87602b039e1b0c84666c1ebfdcf3cfa0f56f14fcea75",
      "prev_hash": "f4598acfa78c1edafd9c95caa8e0f1a61cd6bc24606458e85da7a67fa5a8412c",
      "record_hash": "18f10bd773538e604a93f05aaee2a698556e339505dd444a6ea80b52b356955f",
      "sator_hmac": null,
      "seq": 1,
      "stage": "LOG",
      "ts_ms": 1789832544158
     }
    ],
    "claim": {
     "confidence": 0.87,
     "inference_ts": "2026-09-03T00:00:00Z",
     "input_fingerprint": "sha3-256:e3aa00aff57a949b6a69c7cd6725ccfff2444ffe13ea4f8be985dc301fc82717",
     "meta": {
      "suite": "counterfoil-conformance"
     },
     "model_id": "conformance-model-v1",
     "output_label": "LABEL"
    },
    "counterfoil_receipt_version": "1",
    "guarantees": {
     "authenticity": "Ed25519 seal over the terminal record_hash; only the holder of the private key for the embedded public_key could issue it. Establish trust in that key out of band via key_fingerprint.",
     "integrity": "SHA3-256 hash chain re-verifies offline with NO secret; any field tamper, reorder, or splice fails."
    },
    "issued_ns": "1970-01-01T00:00:00.000000000+00:00",
    "kind": "ai-inference-attestation",
    "seal": {
     "alg": "ed25519",
     "key_fingerprint": "330e2f256ffd8d4b",
     "public_key": "d09263f54bb8d6cf8248fd7b5f2b515c82b439f5f40f459c8df107d3515ea03c",
     "sealed_field": "chain[-1].record_hash",
     "sealed_value": "18f10bd773538e604a93f05aaee2a698556e339505dd444a6ea80b52b356955f",
     "signature": "ac542355e652edf1cdeaec1879f6b7093bf842f5d3bb2635ce74f39f43788f06955df83d7b2201f86bf3db39f68927f82cd3803ac6845d34d63be961f06b2809"
    },
    "seed_anchor": "378caccd3bd8fae094917eecbec7c3e1b8936d82bba53d39ce11e37cc0497698",
    "verify_cmd": "python verify_counterfoil.py <receipt.json>"
   },
   "verify_kwargs": {
    "expected_fingerprint": "330e2f256ffd8d4b"
   }
  },
  {
   "attack": "edit the SEALED event time inside the claim",
   "expected": {
    "claim_binding_ok": false,
    "valid": false
   },
   "name": "claim_inference_ts_tamper",
   "receipt": {
    "chain": [
     {
      "payload_hash": "378caccd3bd8fae094917eecbec7c3e1b8936d82bba53d39ce11e37cc0497698",
      "prev_hash": "",
      "record_hash": "f4598acfa78c1edafd9c95caa8e0f1a61cd6bc24606458e85da7a67fa5a8412c",
      "sator_hmac": null,
      "seq": 0,
      "stage": "SEED",
      "ts_ms": 1789832544158
     },
     {
      "payload_hash": "15f9606fc4c20572b6bd87602b039e1b0c84666c1ebfdcf3cfa0f56f14fcea75",
      "prev_hash": "f4598acfa78c1edafd9c95caa8e0f1a61cd6bc24606458e85da7a67fa5a8412c",
      "record_hash": "18f10bd773538e604a93f05aaee2a698556e339505dd444a6ea80b52b356955f",
      "sator_hmac": null,
      "seq": 1,
      "stage": "LOG",
      "ts_ms": 1789832544158
     }
    ],
    "claim": {
     "confidence": 0.87,
     "inference_ts": "1970-01-01T00:00:00Z",
     "input_fingerprint": "sha3-256:e3aa00aff57a949b6a69c7cd6725ccfff2444ffe13ea4f8be985dc301fc82717",
     "meta": {
      "suite": "counterfoil-conformance"
     },
     "model_id": "conformance-model-v1",
     "output_label": "LABEL"
    },
    "counterfoil_receipt_version": "1",
    "guarantees": {
     "authenticity": "Ed25519 seal over the terminal record_hash; only the holder of the private key for the embedded public_key could issue it. Establish trust in that key out of band via key_fingerprint.",
     "integrity": "SHA3-256 hash chain re-verifies offline with NO secret; any field tamper, reorder, or splice fails."
    },
    "issued_ns": "2026-09-19T18:42:24.160596895+03:00",
    "kind": "ai-inference-attestation",
    "seal": {
     "alg": "ed25519",
     "key_fingerprint": "330e2f256ffd8d4b",
     "public_key": "d09263f54bb8d6cf8248fd7b5f2b515c82b439f5f40f459c8df107d3515ea03c",
     "sealed_field": "chain[-1].record_hash",
     "sealed_value": "18f10bd773538e604a93f05aaee2a698556e339505dd444a6ea80b52b356955f",
     "signature": "ac542355e652edf1cdeaec1879f6b7093bf842f5d3bb2635ce74f39f43788f06955df83d7b2201f86bf3db39f68927f82cd3803ac6845d34d63be961f06b2809"
    },
    "seed_anchor": "378caccd3bd8fae094917eecbec7c3e1b8936d82bba53d39ce11e37cc0497698",
    "verify_cmd": "python verify_counterfoil.py <receipt.json>"
   },
   "verify_kwargs": {}
  },
  {
   "attack": "receipt has no 'seal' field at all",
   "expected": {
    "authenticity_ok": false,
    "integrity_ok": true,
    "valid": false
   },
   "name": "missing_seal",
   "receipt": {
    "chain": [
     {
      "payload_hash": "378caccd3bd8fae094917eecbec7c3e1b8936d82bba53d39ce11e37cc0497698",
      "prev_hash": "",
      "record_hash": "f4598acfa78c1edafd9c95caa8e0f1a61cd6bc24606458e85da7a67fa5a8412c",
      "sator_hmac": null,
      "seq": 0,
      "stage": "SEED",
      "ts_ms": 1789832544158
     },
     {
      "payload_hash": "15f9606fc4c20572b6bd87602b039e1b0c84666c1ebfdcf3cfa0f56f14fcea75",
      "prev_hash": "f4598acfa78c1edafd9c95caa8e0f1a61cd6bc24606458e85da7a67fa5a8412c",
      "record_hash": "18f10bd773538e604a93f05aaee2a698556e339505dd444a6ea80b52b356955f",
      "sator_hmac": null,
      "seq": 1,
      "stage": "LOG",
      "ts_ms": 1789832544158
     }
    ],
    "claim": {
     "confidence": 0.87,
     "inference_ts": "2026-09-03T00:00:00Z",
     "input_fingerprint": "sha3-256:e3aa00aff57a949b6a69c7cd6725ccfff2444ffe13ea4f8be985dc301fc82717",
     "meta": {
      "suite": "counterfoil-conformance"
     },
     "model_id": "conformance-model-v1",
     "output_label": "LABEL"
    },
    "counterfoil_receipt_version": "1",
    "guarantees": {
     "authenticity": "Ed25519 seal over the terminal record_hash; only the holder of the private key for the embedded public_key could issue it. Establish trust in that key out of band via key_fingerprint.",
     "integrity": "SHA3-256 hash chain re-verifies offline with NO secret; any field tamper, reorder, or splice fails."
    },
    "issued_ns": "2026-09-19T18:42:24.160596895+03:00",
    "kind": "ai-inference-attestation",
    "seed_anchor": "378caccd3bd8fae094917eecbec7c3e1b8936d82bba53d39ce11e37cc0497698",
    "verify_cmd": "python verify_counterfoil.py <receipt.json>"
   },
   "verify_kwargs": {}
  },
  {
   "attack": "receipt has no 'chain' field at all",
   "expected": {
    "integrity_ok": false,
    "valid": false
   },
   "name": "missing_chain",
   "receipt": {
    "claim": {
     "confidence": 0.87,
     "inference_ts": "2026-09-03T00:00:00Z",
     "input_fingerprint": "sha3-256:e3aa00aff57a949b6a69c7cd6725ccfff2444ffe13ea4f8be985dc301fc82717",
     "meta": {
      "suite": "counterfoil-conformance"
     },
     "model_id": "conformance-model-v1",
     "output_label": "LABEL"
    },
    "counterfoil_receipt_version": "1",
    "guarantees": {
     "authenticity": "Ed25519 seal over the terminal record_hash; only the holder of the private key for the embedded public_key could issue it. Establish trust in that key out of band via key_fingerprint.",
     "integrity": "SHA3-256 hash chain re-verifies offline with NO secret; any field tamper, reorder, or splice fails."
    },
    "issued_ns": "2026-09-19T18:42:24.160596895+03:00",
    "kind": "ai-inference-attestation",
    "seal": {
     "alg": "ed25519",
     "key_fingerprint": "330e2f256ffd8d4b",
     "public_key": "d09263f54bb8d6cf8248fd7b5f2b515c82b439f5f40f459c8df107d3515ea03c",
     "sealed_field": "chain[-1].record_hash",
     "sealed_value": "18f10bd773538e604a93f05aaee2a698556e339505dd444a6ea80b52b356955f",
     "signature": "ac542355e652edf1cdeaec1879f6b7093bf842f5d3bb2635ce74f39f43788f06955df83d7b2201f86bf3db39f68927f82cd3803ac6845d34d63be961f06b2809"
    },
    "seed_anchor": "378caccd3bd8fae094917eecbec7c3e1b8936d82bba53d39ce11e37cc0497698",
    "verify_cmd": "python verify_counterfoil.py <receipt.json>"
   },
   "verify_kwargs": {}
  },
  {
   "attack": "receipt has no 'claim' field at all",
   "expected": {
    "claim_binding_ok": false,
    "valid": false
   },
   "name": "missing_claim",
   "receipt": {
    "chain": [
     {
      "payload_hash": "378caccd3bd8fae094917eecbec7c3e1b8936d82bba53d39ce11e37cc0497698",
      "prev_hash": "",
      "record_hash": "f4598acfa78c1edafd9c95caa8e0f1a61cd6bc24606458e85da7a67fa5a8412c",
      "sator_hmac": null,
      "seq": 0,
      "stage": "SEED",
      "ts_ms": 1789832544158
     },
     {
      "payload_hash": "15f9606fc4c20572b6bd87602b039e1b0c84666c1ebfdcf3cfa0f56f14fcea75",
      "prev_hash": "f4598acfa78c1edafd9c95caa8e0f1a61cd6bc24606458e85da7a67fa5a8412c",
      "record_hash": "18f10bd773538e604a93f05aaee2a698556e339505dd444a6ea80b52b356955f",
      "sator_hmac": null,
      "seq": 1,
      "stage": "LOG",
      "ts_ms": 1789832544158
     }
    ],
    "counterfoil_receipt_version": "1",
    "guarantees": {
     "authenticity": "Ed25519 seal over the terminal record_hash; only the holder of the private key for the embedded public_key could issue it. Establish trust in that key out of band via key_fingerprint.",
     "integrity": "SHA3-256 hash chain re-verifies offline with NO secret; any field tamper, reorder, or splice fails."
    },
    "issued_ns": "2026-09-19T18:42:24.160596895+03:00",
    "kind": "ai-inference-attestation",
    "seal": {
     "alg": "ed25519",
     "key_fingerprint": "330e2f256ffd8d4b",
     "public_key": "d09263f54bb8d6cf8248fd7b5f2b515c82b439f5f40f459c8df107d3515ea03c",
     "sealed_field": "chain[-1].record_hash",
     "sealed_value": "18f10bd773538e604a93f05aaee2a698556e339505dd444a6ea80b52b356955f",
     "signature": "ac542355e652edf1cdeaec1879f6b7093bf842f5d3bb2635ce74f39f43788f06955df83d7b2201f86bf3db39f68927f82cd3803ac6845d34d63be961f06b2809"
    },
    "seed_anchor": "378caccd3bd8fae094917eecbec7c3e1b8936d82bba53d39ce11e37cc0497698",
    "verify_cmd": "python verify_counterfoil.py <receipt.json>"
   },
   "verify_kwargs": {}
  },
  {
   "attack": "a GENUINE hardware seal, but over a different record",
   "expected": {
    "authenticity_ok": true,
    "hardware_authenticity_ok": false,
    "integrity_ok": true,
    "valid": false
   },
   "name": "hardware_seal_foreign",
   "receipt": {
    "chain": [
     {
      "payload_hash": "378caccd3bd8fae094917eecbec7c3e1b8936d82bba53d39ce11e37cc0497698",
      "prev_hash": "",
      "record_hash": "f4598acfa78c1edafd9c95caa8e0f1a61cd6bc24606458e85da7a67fa5a8412c",
      "sator_hmac": null,
      "seq": 0,
      "stage": "SEED",
      "ts_ms": 1789832544158
     },
     {
      "payload_hash": "15f9606fc4c20572b6bd87602b039e1b0c84666c1ebfdcf3cfa0f56f14fcea75",
      "prev_hash": "f4598acfa78c1edafd9c95caa8e0f1a61cd6bc24606458e85da7a67fa5a8412c",
      "record_hash": "18f10bd773538e604a93f05aaee2a698556e339505dd444a6ea80b52b356955f",
      "sator_hmac": null,
      "seq": 1,
      "stage": "LOG",
      "ts_ms": 1789832544158
     }
    ],
    "claim": {
     "confidence": 0.87,
     "inference_ts": "2026-09-03T00:00:00Z",
     "input_fingerprint": "sha3-256:e3aa00aff57a949b6a69c7cd6725ccfff2444ffe13ea4f8be985dc301fc82717",
     "meta": {
      "suite": "counterfoil-conformance"
     },
     "model_id": "conformance-model-v1",
     "output_label": "LABEL"
    },
    "counterfoil_receipt_version": "1",
    "guarantees": {
     "authenticity": "Ed25519 seal over the terminal record_hash; only the holder of the private key for the embedded public_key could issue it. Establish trust in that key out of band via key_fingerprint.",
     "integrity": "SHA3-256 hash chain re-verifies offline with NO secret; any field tamper, reorder, or splice fails."
    },
    "hardware_seal": {
     "ak": {
      "fingerprint": "sha256:8d18ded1366fcdd7515049c28795fb08fff413210f27f5a063f982bbde65237d",
      "handle": "0x81010002",
      "public_pem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEHWaz7WCXcUzva8iIJrI7lD8zLtpK\nO8rpidjcI6UhEXMihqTMcjrDhWzwHi/XMy/K1Uwoxx7WvEADvtQzYXadKQ==\n-----END PUBLIC KEY-----\n"
     },
     "alg": "ecdsa-p256-sha256",
     "ceiling": "Proves: this signature was made by a key that cannot leave THIS TPM, usable only while PCR 0-7 match the quoted values, over THIS hash. Does NOT prove the hash is honest: host root controls the input path. Narrows the host-root re-seal attack (no key theft, no cross-host forgery); does not close it. A TPM is not a TEE.",
     "certify": {
      "attest_hex": "ff54434780170022000b56c1ba5696691e708589bc94796f20e282cf2ff916bd3f0b1ee8b5c263372191000400ff55aa00000011a1acc852000005d5000000000100070002000100000022000b2aeb5e8e605c47a61fab77a84d908dbe4708903e42d493c22fe7ffaaca6dbd6f0022000b87f6f2bceb5ef543d9f5402bff85b6c5299c012b94ac10260bebcf8a2a973a6e",
      "signature_der_hex": "304402207ae5f2879c0e35e8148f67e8b85e21f6f514a6a0c40be4dc941c17bfa1aedfd5022058856acfae03551bb2ce5f8a18091d78b645571ea4b0ce44421c9c8905f98a86"
     },
     "digest_rule": "sha256(sealed_value.encode())",
     "issued_ns": "2026-09-03T20:33:41.542797137+03:00",
     "key": {
      "handle": "0x81010003",
      "name_hex": "000b2aeb5e8e605c47a61fab77a84d908dbe4708903e42d493c22fe7ffaaca6dbd6f",
      "public_pem": "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEDz0gVo/CJ0WgD1L8O3QlvraVrwDJ\n5Hd6voly0Zdt+9oq5hx/RueO+X2L/4nG/8qi8IfKuwzbmXy/ZQ0IWRpmrg==\n-----END PUBLIC KEY-----\n",
      "tpm2b_public_hex": "00780023000b000400320020872b27d97296ba7d90b5b605b3621a5c15f59118ba9e395031a8e1474492034f00100018000b0003001000200f3d20568fc22745a00f52fc3b7425beb695af00c9e4777abe8972d1976dfbda00202ae61c7f46e78ef97d8bff89c6ffcaa2f087cabb0cdb997cbf650d08591a66ae"
     },
     "quote": {
      "attest_hex": "ff54434780180022000b56c1ba5696691e708589bc94796f20e282cf2ff916bd3f0b1ee8b5c2633721910014095b578b76eca2f5e30c5ef99a476c03fff174ba00000011a1accf96000005d50000000001000700020001000000000001000b03ff000000207aae63e0ef3367125a0c0a550e1e199cac6a404eaa69011a10cd8998736829fe",
      "nonce_hex": "095b578b76eca2f5e30c5ef99a476c03fff174ba",
      "pcr_alg": "sha256",
      "pcr_indices": [
       0,
       1,
       2,
       3,
       4,
       5,
       6,
       7
      ],
      "pcr_values_hex": [
       "fc3ddc294ea560105138d371f882cd936228b143c12656a0d2947f7d01b939aa",
       "04f532b64d60f106f69831844f1c33431cbbf382ea122ae5bea31b2f57b3500c",
       "3d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198e7969",
       "3d458cfe55cc03ea1f443f1562beec8df51c75e14a9fcf9a7234a13f198e7969",
       "cdb9366a1664e6b6ae408e3df98f2e5ff47bcd6f0ea19acbabe643de586853dd",
       "3267f7b2287d86564622cfaa03252113751c6deacb9ef3e59d6ad707cf248303",
       "ed044a352acbec95afb3e09df44dcee469775b6c14d09340f48e805264bfc38c",
       "a1b62f933c1e9b8605f2d9bf0401b7c2a922ddbd0178a86d806dd229aa1a341f"
      ],
      "signature_der_hex": "304602210093a546c12c165afef43a853503a8e56eb3a24b48c457bc74e8e11da6d27c2e9a022100e058bb47d338f5eec9980854b397ae70f4aec06c6f0f01f8b9b491a9b07be091"
     },
     "seal_version": 1,
     "sealed_field": "chain[-1].record_hash",
     "sealed_value": "2f9128e88c23a7cda4838b75324848672ef08fde3eda53bc7e6eaddf0d5ac5e4",
     "signature_der_hex": "3046022100fa3fb48efb7ff888fea6fa014a8a25380e3fcbbebd8fcd0c52064825d182133c022100bd055b71390f20d5dc04f27e9656263d32cc9c5e4e59702a0cc922c0e8348cd4"
    },
    "issued_ns": "2026-09-19T18:42:24.160596895+03:00",
    "kind": "ai-inference-attestation",
    "seal": {
     "alg": "ed25519",
     "key_fingerprint": "330e2f256ffd8d4b",
     "public_key": "d09263f54bb8d6cf8248fd7b5f2b515c82b439f5f40f459c8df107d3515ea03c",
     "sealed_field": "chain[-1].record_hash",
     "sealed_value": "18f10bd773538e604a93f05aaee2a698556e339505dd444a6ea80b52b356955f",
     "signature": "ac542355e652edf1cdeaec1879f6b7093bf842f5d3bb2635ce74f39f43788f06955df83d7b2201f86bf3db39f68927f82cd3803ac6845d34d63be961f06b2809"
    },
    "seed_anchor": "378caccd3bd8fae094917eecbec7c3e1b8936d82bba53d39ce11e37cc0497698",
    "verify_cmd": "python verify_counterfoil.py <receipt.json>"
   },
   "verify_kwargs": {
    "expected_nonce": "095b578b76eca2f5e30c5ef99a476c03fff174ba"
   }
  },
  {
   "attack": "a present but malformed hardware seal fails, never ignored",
   "expected": {
    "hardware_authenticity_ok": false,
    "valid": false
   },
   "name": "hardware_seal_malformed",
   "receipt": {
    "chain": [
     {
      "payload_hash": "378caccd3bd8fae094917eecbec7c3e1b8936d82bba53d39ce11e37cc0497698",
      "prev_hash": "",
      "record_hash": "f4598acfa78c1edafd9c95caa8e0f1a61cd6bc24606458e85da7a67fa5a8412c",
      "sator_hmac": null,
      "seq": 0,
      "stage": "SEED",
      "ts_ms": 1789832544158
     },
     {
      "payload_hash": "15f9606fc4c20572b6bd87602b039e1b0c84666c1ebfdcf3cfa0f56f14fcea75",
      "prev_hash": "f4598acfa78c1edafd9c95caa8e0f1a61cd6bc24606458e85da7a67fa5a8412c",
      "record_hash": "18f10bd773538e604a93f05aaee2a698556e339505dd444a6ea80b52b356955f",
      "sator_hmac": null,
      "seq": 1,
      "stage": "LOG",
      "ts_ms": 1789832544158
     }
    ],
    "claim": {
     "confidence": 0.87,
     "inference_ts": "2026-09-03T00:00:00Z",
     "input_fingerprint": "sha3-256:e3aa00aff57a949b6a69c7cd6725ccfff2444ffe13ea4f8be985dc301fc82717",
     "meta": {
      "suite": "counterfoil-conformance"
     },
     "model_id": "conformance-model-v1",
     "output_label": "LABEL"
    },
    "counterfoil_receipt_version": "1",
    "guarantees": {
     "authenticity": "Ed25519 seal over the terminal record_hash; only the holder of the private key for the embedded public_key could issue it. Establish trust in that key out of band via key_fingerprint.",
     "integrity": "SHA3-256 hash chain re-verifies offline with NO secret; any field tamper, reorder, or splice fails."
    },
    "hardware_seal": {
     "alg": "ecdsa-p256-sha256"
    },
    "issued_ns": "2026-09-19T18:42:24.160596895+03:00",
    "kind": "ai-inference-attestation",
    "seal": {
     "alg": "ed25519",
     "key_fingerprint": "330e2f256ffd8d4b",
     "public_key": "d09263f54bb8d6cf8248fd7b5f2b515c82b439f5f40f459c8df107d3515ea03c",
     "sealed_field": "chain[-1].record_hash",
     "sealed_value": "18f10bd773538e604a93f05aaee2a698556e339505dd444a6ea80b52b356955f",
     "signature": "ac542355e652edf1cdeaec1879f6b7093bf842f5d3bb2635ce74f39f43788f06955df83d7b2201f86bf3db39f68927f82cd3803ac6845d34d63be961f06b2809"
    },
    "seed_anchor": "378caccd3bd8fae094917eecbec7c3e1b8936d82bba53d39ce11e37cc0497698",
    "verify_cmd": "python verify_counterfoil.py <receipt.json>"
   },
   "verify_kwargs": {}
  },
  {
   "attack": "a receipt WITH bound tool calls verifies clean",
   "expected": {
    "authenticity_ok": true,
    "claim_binding_ok": true,
    "integrity_ok": true,
    "valid": true
   },
   "name": "tool_receipt_clean",
   "receipt": {
    "chain": [
     {
      "payload_hash": "96b2ad1f908d6c08ab2fab4feb85a1d38f37e6c1bc512e730f09f134914da48b",
      "prev_hash": "",
      "record_hash": "d583bd04ca302e995edb06215fb9a9cd8b8784c8b4cc83df81d544c547f449e2",
      "sator_hmac": null,
      "seq": 0,
      "stage": "SEED",
      "ts_ms": 1789832544161
     },
     {
      "payload_hash": "5c9d4deeebe45d175cc4ce4935d7e12808ed4a0474c237b4dcaa34a28a01e330",
      "prev_hash": "d583bd04ca302e995edb06215fb9a9cd8b8784c8b4cc83df81d544c547f449e2",
      "record_hash": "c15437f84601595628cc443e60fe938991ff2aa2004e8e30bd4b55ebc791ba16",
      "sator_hmac": null,
      "seq": 1,
      "stage": "LOG",
      "ts_ms": 1789832544161
     }
    ],
    "claim": {
     "confidence": 0.87,
     "inference_ts": "2026-09-03T00:00:00Z",
     "input_fingerprint": "sha3-256:e3aa00aff57a949b6a69c7cd6725ccfff2444ffe13ea4f8be985dc301fc82717",
     "meta": {
      "suite": "counterfoil-conformance"
     },
     "model_id": "conformance-model-v1",
     "output_label": "LABEL",
     "tool_calls": [
      {
       "args_fingerprint": "sha3-256:89e481b7a295050251f3a9f838743a62588be58ca0974a8e0382f3d8b775e88b",
       "metadata_fingerprint": "sha3-256:3ea445410f608e6453cdcb7dbe42d57a89aca018993d7e87da85993cbccc6308",
       "name": "http_get",
       "ok": true,
       "output_fingerprint": "sha3-256:da5514081ee9e06e09cc71aba043264cc34c6bdb7a9ef6b58e72929360681d19",
       "seq": 0,
       "server": ""
      }
     ]
    },
    "counterfoil_receipt_version": "1",
    "guarantees": {
     "authenticity": "Ed25519 seal over the terminal record_hash; only the holder of the private key for the embedded public_key could issue it. Establish trust in that key out of band via key_fingerprint.",
     "integrity": "SHA3-256 hash chain re-verifies offline with NO secret; any field tamper, reorder, or splice fails.",
     "tool_integrity": "1 tool call(s) bound by args+output fingerprint into the sealed claim; any tampered tool output fails claim-binding on verify. Proves what the tools returned, not only that the model emitted text."
    },
    "issued_ns": "2026-09-19T18:42:24.161936726+03:00",
    "kind": "ai-inference-attestation",
    "seal": {
     "alg": "ed25519",
     "key_fingerprint": "330e2f256ffd8d4b",
     "public_key": "d09263f54bb8d6cf8248fd7b5f2b515c82b439f5f40f459c8df107d3515ea03c",
     "sealed_field": "chain[-1].record_hash",
     "sealed_value": "c15437f84601595628cc443e60fe938991ff2aa2004e8e30bd4b55ebc791ba16",
     "signature": "193a029e7fbd94245b1e8642c41e880aef9112851221a4fb8772d62b9d4a0bd59793e247186ee3b5ec73d618826f48774324a2c59d2bdafa17918a7a7eadf80f"
    },
    "seed_anchor": "96b2ad1f908d6c08ab2fab4feb85a1d38f37e6c1bc512e730f09f134914da48b",
    "verify_cmd": "python verify_counterfoil.py <receipt.json>"
   },
   "verify_kwargs": {
    "expected_fingerprint": "330e2f256ffd8d4b"
   }
  },
  {
   "attack": "swap a bound tool OUTPUT fingerprint to hide a spoofed result (ExploitGym)",
   "expected": {
    "claim_binding_ok": false,
    "integrity_ok": true,
    "valid": false
   },
   "name": "tool_output_spoof",
   "receipt": {
    "chain": [
     {
      "payload_hash": "96b2ad1f908d6c08ab2fab4feb85a1d38f37e6c1bc512e730f09f134914da48b",
      "prev_hash": "",
      "record_hash": "d583bd04ca302e995edb06215fb9a9cd8b8784c8b4cc83df81d544c547f449e2",
      "sator_hmac": null,
      "seq": 0,
      "stage": "SEED",
      "ts_ms": 1789832544161
     },
     {
      "payload_hash": "5c9d4deeebe45d175cc4ce4935d7e12808ed4a0474c237b4dcaa34a28a01e330",
      "prev_hash": "d583bd04ca302e995edb06215fb9a9cd8b8784c8b4cc83df81d544c547f449e2",
      "record_hash": "c15437f84601595628cc443e60fe938991ff2aa2004e8e30bd4b55ebc791ba16",
      "sator_hmac": null,
      "seq": 1,
      "stage": "LOG",
      "ts_ms": 1789832544161
     }
    ],
    "claim": {
     "confidence": 0.87,
     "inference_ts": "2026-09-03T00:00:00Z",
     "input_fingerprint": "sha3-256:e3aa00aff57a949b6a69c7cd6725ccfff2444ffe13ea4f8be985dc301fc82717",
     "meta": {
      "suite": "counterfoil-conformance"
     },
     "model_id": "conformance-model-v1",
     "output_label": "LABEL",
     "tool_calls": [
      {
       "args_fingerprint": "sha3-256:89e481b7a295050251f3a9f838743a62588be58ca0974a8e0382f3d8b775e88b",
       "metadata_fingerprint": "sha3-256:3ea445410f608e6453cdcb7dbe42d57a89aca018993d7e87da85993cbccc6308",
       "name": "http_get",
       "ok": true,
       "output_fingerprint": "sha3-056:da5514081ee9e06e09cc71aba043264cc34c6bdb7a9ef6b58e72929360681d19",
       "seq": 0,
       "server": ""
      }
     ]
    },
    "counterfoil_receipt_version": "1",
    "guarantees": {
     "authenticity": "Ed25519 seal over the terminal record_hash; only the holder of the private key for the embedded public_key could issue it. Establish trust in that key out of band via key_fingerprint.",
     "integrity": "SHA3-256 hash chain re-verifies offline with NO secret; any field tamper, reorder, or splice fails.",
     "tool_integrity": "1 tool call(s) bound by args+output fingerprint into the sealed claim; any tampered tool output fails claim-binding on verify. Proves what the tools returned, not only that the model emitted text."
    },
    "issued_ns": "2026-09-19T18:42:24.161936726+03:00",
    "kind": "ai-inference-attestation",
    "seal": {
     "alg": "ed25519",
     "key_fingerprint": "330e2f256ffd8d4b",
     "public_key": "d09263f54bb8d6cf8248fd7b5f2b515c82b439f5f40f459c8df107d3515ea03c",
     "sealed_field": "chain[-1].record_hash",
     "sealed_value": "c15437f84601595628cc443e60fe938991ff2aa2004e8e30bd4b55ebc791ba16",
     "signature": "193a029e7fbd94245b1e8642c41e880aef9112851221a4fb8772d62b9d4a0bd59793e247186ee3b5ec73d618826f48774324a2c59d2bdafa17918a7a7eadf80f"
    },
    "seed_anchor": "96b2ad1f908d6c08ab2fab4feb85a1d38f37e6c1bc512e730f09f134914da48b",
    "verify_cmd": "python verify_counterfoil.py <receipt.json>"
   },
   "verify_kwargs": {}
  },
  {
   "attack": "append an unsealed tool call after issuance",
   "expected": {
    "claim_binding_ok": false,
    "valid": false
   },
   "name": "tool_call_smuggle",
   "receipt": {
    "chain": [
     {
      "payload_hash": "96b2ad1f908d6c08ab2fab4feb85a1d38f37e6c1bc512e730f09f134914da48b",
      "prev_hash": "",
      "record_hash": "d583bd04ca302e995edb06215fb9a9cd8b8784c8b4cc83df81d544c547f449e2",
      "sator_hmac": null,
      "seq": 0,
      "stage": "SEED",
      "ts_ms": 1789832544161
     },
     {
      "payload_hash": "5c9d4deeebe45d175cc4ce4935d7e12808ed4a0474c237b4dcaa34a28a01e330",
      "prev_hash": "d583bd04ca302e995edb06215fb9a9cd8b8784c8b4cc83df81d544c547f449e2",
      "record_hash": "c15437f84601595628cc443e60fe938991ff2aa2004e8e30bd4b55ebc791ba16",
      "sator_hmac": null,
      "seq": 1,
      "stage": "LOG",
      "ts_ms": 1789832544161
     }
    ],
    "claim": {
     "confidence": 0.87,
     "inference_ts": "2026-09-03T00:00:00Z",
     "input_fingerprint": "sha3-256:e3aa00aff57a949b6a69c7cd6725ccfff2444ffe13ea4f8be985dc301fc82717",
     "meta": {
      "suite": "counterfoil-conformance"
     },
     "model_id": "conformance-model-v1",
     "output_label": "LABEL",
     "tool_calls": [
      {
       "args_fingerprint": "sha3-256:89e481b7a295050251f3a9f838743a62588be58ca0974a8e0382f3d8b775e88b",
       "metadata_fingerprint": "sha3-256:3ea445410f608e6453cdcb7dbe42d57a89aca018993d7e87da85993cbccc6308",
       "name": "http_get",
       "ok": true,
       "output_fingerprint": "sha3-256:da5514081ee9e06e09cc71aba043264cc34c6bdb7a9ef6b58e72929360681d19",
       "seq": 0,
       "server": ""
      },
      {
       "args_fingerprint": "sha3-256:3ea445410f608e6453cdcb7dbe42d57a89aca018993d7e87da85993cbccc6308",
       "name": "smuggled",
       "ok": true,
       "output_fingerprint": "sha3-256:741efa311f97686956946758e0d95f70f11ff2da4f2feb7c54314f44134ac49f",
       "seq": 1
      }
     ]
    },
    "counterfoil_receipt_version": "1",
    "guarantees": {
     "authenticity": "Ed25519 seal over the terminal record_hash; only the holder of the private key for the embedded public_key could issue it. Establish trust in that key out of band via key_fingerprint.",
     "integrity": "SHA3-256 hash chain re-verifies offline with NO secret; any field tamper, reorder, or splice fails.",
     "tool_integrity": "1 tool call(s) bound by args+output fingerprint into the sealed claim; any tampered tool output fails claim-binding on verify. Proves what the tools returned, not only that the model emitted text."
    },
    "issued_ns": "2026-09-19T18:42:24.161936726+03:00",
    "kind": "ai-inference-attestation",
    "seal": {
     "alg": "ed25519",
     "key_fingerprint": "330e2f256ffd8d4b",
     "public_key": "d09263f54bb8d6cf8248fd7b5f2b515c82b439f5f40f459c8df107d3515ea03c",
     "sealed_field": "chain[-1].record_hash",
     "sealed_value": "c15437f84601595628cc443e60fe938991ff2aa2004e8e30bd4b55ebc791ba16",
     "signature": "193a029e7fbd94245b1e8642c41e880aef9112851221a4fb8772d62b9d4a0bd59793e247186ee3b5ec73d618826f48774324a2c59d2bdafa17918a7a7eadf80f"
    },
    "seed_anchor": "96b2ad1f908d6c08ab2fab4feb85a1d38f37e6c1bc512e730f09f134914da48b",
    "verify_cmd": "python verify_counterfoil.py <receipt.json>"
   },
   "verify_kwargs": {}
  }
 ],
 "vectors_version": 3
}