# How to independently verify this audit bundle

**Ryedore Predictive-Maintenance — Competitive Benchmark Audit** — generated 2026-09-01T13:39:43Z

You do NOT need Ryedore's source or trust to verify these numbers. Three levels:

## 1. File integrity (any machine, no dependencies)
```
sha256sum -c SHA256SUMS      # every file matches its recorded hash
```

## 2. Cryptographic authenticity (needs python + `cryptography`)
The whole bundle is signed with RSA-PSS/SHA-256 under the public key shipped here
as `license_public.pem` (MD5 fingerprint recorded in each report's integrity block).
```
python build_audit_bundle.py --verify manifest.json
# => ✓ BUNDLE AUTHENTIC — manifest_hash + files + signature all True
```
Each per-task report under `evidence/` is *also* independently signed:
```
python generate_benchmark_report.py --verify evidence/<name>.json
# => ✓ REPORT AUTHENTIC
```
Signatures are over a canonical JSON payload with the integrity block excluded, so
the numbers cannot be changed without breaking the signature.

## 3. Reproduce the numbers (needs the public datasets + harness)
The benchmark harness (`scripts/benchmark/`) is Apache-2.0, isolated (read-only over
`audit_results/`, writes only to its out-dir), uses **public datasets only**, and
reports multi-seed mean±std + ensemble (no single-seed cherry-picking). Provenance of
this run: `v2.0.0+harness:a244307a` · Python 3.10.18 · deps in `environment.json`.

## Trust summary
- **Tamper-evident:** SHA256SUMS + a signed manifest over every file.
- **Attributable:** one canonical signing key; public key included.
- **Honest:** losses and academic-SOTA gaps are disclosed in the report, not hidden.
- **Reproducible:** public data + open harness + pinned environment.