The verification docs, before you download anything

# How to independently verify this audit bundle

**Ryedore Predictive-Maintenance — Competitive Benchmark Audit** — generated 2026-09-01T13:39:43Z

You do NOT need Ryedore's source or trust to verify these numbers. Three levels:

## 1. File integrity (any machine, no dependencies)
```
sha256sum -c SHA256SUMS      # every file matches its recorded hash
```

## 2. Cryptographic authenticity (needs python + `cryptography`)
The whole bundle is signed with RSA-PSS/SHA-256 under the public key shipped here
as `license_public.pem` (MD5 fingerprint recorded in each report's integrity block).
```
python build_audit_bundle.py --verify manifest.json
# => ✓ BUNDLE AUTHENTIC — manifest_hash + files + signature all True
```
Each per-task report under `evidence/` is *also* independently signed:
```
python generate_benchmark_report.py --verify evidence/<name>.json
# => ✓ REPORT AUTHENTIC
```
Signatures are over a canonical JSON payload with the integrity block excluded, so
the numbers cannot be changed without breaking the signature.

## 3. Reproduce the numbers (needs the public datasets + harness)
The benchmark harness (`scripts/benchmark/`) is Apache-2.0, isolated (read-only over
`audit_results/`, writes only to its out-dir), uses **public datasets only**, and
reports multi-seed mean±std + ensemble (no single-seed cherry-picking). Provenance of
this run: `v2.0.0+harness:a244307a` · Python 3.10.18 · deps in `environment.json`.

## Trust summary
- **Tamper-evident:** SHA256SUMS + a signed manifest over every file.
- **Attributable:** one canonical signing key; public key included.
- **Honest:** losses and academic-SOTA gaps are disclosed in the report, not hidden.
- **Reproducible:** public data + open harness + pinned environment.

#!/bin/bash
# Offline verification of this audit bundle. Requires python + cryptography.
cd "$(dirname "$0")"
python -c "import sys; sys.path.insert(0,'scripts/benchmark')" 2>/dev/null
python "$(git rev-parse --show-toplevel 2>/dev/null || echo .)/scripts/benchmark/build_audit_bundle.py" --verify manifest.json 2>/dev/null   || python - <<'PY'
import json,hashlib,base64,glob
m=json.load(open('manifest.json')); itg=m.pop('integrity',{})
canon=json.dumps(m,sort_keys=True,separators=(',',':')).encode()
print('manifest sha256:', hashlib.sha256(canon).hexdigest()==itg.get('sha256'))
ok=all(hashlib.sha256(open(f['path'],'rb').read()).hexdigest()==f['sha256'] for f in m['files'])
print('all files intact:', ok)
PY