Penrose can export an adjudication as a local, content-addressed research bundle. The feature is opt-in, writes files only, and never uses the network. Another researcher can verify the signature, recompute every declared input commitment, and reproduce the recorded verdict inside the reproduction sandbox.
Research-record signatures use Ed25519. PENROSE_PUBLISHER_PRIVATE_KEY is a
write-only setting handled by the existing secret seam; it must contain an
unencrypted PKCS8 PEM. The private key is never written to a bundle or catalog.
penrose.publisher_keys.generate_publisher_keypair() creates a pair in memory
when the optional cryptography package is available.
The matching public PEM belongs in PUBLISHER_PUBKEY and is copied into every
bundle. The bundled key proves only that the bundle is internally self-consistent;
it is not its own trust anchor. commons-verify reports top-level
publisher_authenticated and verification_scope fields. A self-signed bundle
may pass with verification_scope=INTEGRITY_ONLY: that proves integrity and
reproducibility, not publisher identity or independent trustworthiness. Full
trust requires a signature authenticated by the verifier's shipped publisher
key. A verifier may additionally require a public key obtained independently
with --public-key.
A publishable adjudication declares data_manifest.series entries. Each
entry names a JSON series file and records its source, endpoint when known,
retrieval timestamp, license or provenance string, transformations, and
missing-data policy. The decision also declares a versioned reproduction
object with kind: python_entrypoint, a module path, callable, and structured
parameters. The callable receives (inputs, parameters) and returns either the
verdict string or {"verdict": "kill"}.
penrose publish DECISION_ID --writeup notes.md
penrose commons-verify corpus_publish/CONTENT_HASH --public-key trusted-publisher.pem
penrose catalog-publish
penrose digest --ids DECISION_ID,OTHER_DECISION_ID --out research-digest
penrose digest --ids DECISION_ID,OTHER_DECISION_ID --out offline-digest --with-bundles
The bundle's reproduction.json is data, not a shell command. Verification
accepts only its versioned schema, but always executes the verifier's installed,
reviewed sandbox_image/reproduction.py with the fixed reproduce callable.
The bundle's reproduction.py is never executed. The reproduction sandbox mounts the declared data
and parameters, disables networking, applies resource limits, and requires both
the reproduced verdict bytes and an independently observed exact consumed-series
set to match the signed receipt and manifest. The verifier also re-hashes the
exact input bytes admitted to the replay and compares them with the manifest.
The frozen strategy module currently executes in the same reproduction-sandbox interpreter as
P7/P8. Attacker-controlled parameters and gate_config are therefore acceptable
only under the explicit integrity-only trust label for self-signed bundles; they
do not establish independent trustworthiness. A hardening follow-up must isolate
the untrusted strategy phase from a fresh trusted P7/P8 process, or prevent the
frozen module from importing or mutating adjudicator state. This deeper
architecture is not yet implemented.
Each immutable signed catalog edition includes every recognized terminal attempt in decision-ledger order: kill, cannot_replicate, needs_data, survived, and underpowered. Watch and research-supported outcomes are classified as survived while preserving their original verdict. Inclusion rules, taxonomy, data domain, reproducibility tier, and any matching bundle content hash are recorded in the edition.
penrose digest composes a chosen set of already-adjudicated claims into a
local, pointers-only research package. By default the package contains
digest.md, the full signed catalog edition, and a signed digest manifest
binding the selection to the bundle content hashes and catalog hash. The
content-hash links identify bundles that can be requested, fetched, and
verified out of band. Pass --with-bundles to also copy the referenced signed
bundles and their input data for a self-contained offline set. This option
changes only the files placed alongside the digest; the signed manifest is
identical. Digest creation does not use the network or alter the decision
ledger.
Every digest labels itself a curated selection and links to the full catalog as
the denominator. --title and --audience adjust its reader-facing framing;
--writeup-dir may supply ID.md files when a selected bundle has not yet
been published.