mirror: sync kernel from GitHub source-of-truth

README.md

@@ -197,6 +197,91 @@ that mutating a past record is detected. It requires no GPU.
 
 ---
 
+## Attestation & compliance evidence (interop layer)
+
+A receipt is only as useful as the tools that can *carry* it. This module renders
+any receipt into the formats the wider ecosystem already understands — without
+changing a single measured value.
+
+```python
+import governed_inference_meter as gim
+
+rec, out = gim.meter(run, args=("hi",), model="my-llm", tokens_in=2, tokens_out=7)
+
+# 1) The receipt as an in-toto Statement v1 — the exact payload that
+#    Sigstore / DSSE / SCITT tooling signs and stores in a transparency log.
+stmt = gim.to_intoto_statement(rec)          # SLSA-shaped predicate, our own type URI
+
+# 2) EU AI Act / NIST AI RMF controls this receipt provides EVIDENCE for,
+#    with an explicit does_not_establish note per control (honest, not a cert).
+ev = gim.compliance_evidence(rec)
+
+# 3) Confirm the Statement is cryptographically bound to this exact receipt.
+ok, why = gim.verify_statement(stmt, rec)    # -> (True, "ok")
+```
+
+Honest boundaries (doctrine):
+
+- The predicate uses **our own** `predicateType` URI and is only SLSA-*shaped*
+  for auditor recognizability — it is **not** a claim of official SLSA
+  conformance. Signing (DSSE/Sigstore) is out-of-band; this emits the unsigned
+  Statement payload a signer would then cover.
+- Energy fields are copied **verbatim**. On an unmeasured receipt, energy-dependent
+  controls (e.g. `NIST-AI-RMF-MEASURE-2.x`) report **`UNAVAILABLE`** — never a
+  fabricated joule. Logging / record-keeping controls (EU AI Act Art. 12 & 19)
+  are supported regardless of GPU.
+- A receipt is **evidence** toward a control, never a conformity assessment,
+  certification, or safety guarantee.
+
+---
+
+## Canonical PCGI receipt (spine fold)
+
+The meter is also a first-class **Proof-Carrying Governed Intelligence (PCGI)**
+receipt producer on the org-canonical [`szl-receipt`](https://huggingface.co/SZLHOLDINGS)
+spine. One call folds a metered inference into a single signed receipt that binds
+**model id + input digest + output digest + governing policy id + energy** — the
+same shape every other decision producer emits, so provenance unifies.
+
+```python
+import governed_inference_meter as gim
+from szl_receipt import generate_keypair
+
+priv, pub = generate_keypair()   # or sign_key=None for UNSIGNED-honest
+
+# End-to-end: meter the call AND emit ONE canonical szl-receipt for it.
+env, out = gim.meter_szl_receipt(
+    run, args=("hi",), model="my-llm",
+    policy_id="default-allow", sign_key=priv, organ="meter",
+)
+ok, why = gim.verify_szl_receipt(env, pub)      # -> (True, "ok")
+stmt = gim.to_statement(env)                     # in-toto Statement v1, SLSA-shaped
+ok2, _ = gim.verify_szl_statement(stmt, env)     # bound to this exact receipt
+
+# Or fold an existing meter receipt you already have:
+rec, out = gim.meter(run, args=("hi",), model="my-llm", tokens_in=2, tokens_out=7)
+env = gim.from_meter_receipt(rec, input="hi", output=out, policy_id="default-allow")
+```
+
+Honest boundaries (doctrine):
+
+- Reuses szl-receipt's **canonicalization + signing + in-toto shapes** — it does
+  **not** invent a new receipt shape.
+- **Energy** is bound **verbatim** only when the meter actually measured it
+  (NVML present). Otherwise `energy.joules` is the literal string
+  **`"UNAVAILABLE"`** and `energy.measured` is `False` — the meter is the one
+  place in the spine where energy *can* be real, and it is never fabricated.
+- The canonical body is **deterministic**: identical inputs serialize to
+  byte-identical canonical JSON (no timestamps in the body).
+- Keyless => **UNSIGNED-honest** (`signed=False`); a signature is never faked.
+- The receipt is **evidence** binding a decision, **not** a proof the model's
+  output is correct.
+
+Requires the shared `szl-receipt` library (install extra `[sign]`); the import is
+lazy, so importing this package stays zero-hard-dependency.
+
+---
+
 ## What's in the repo
 
 ```
@@ -206,9 +291,13 @@ build/torch-universal/governed_inference_meter/
   _energy.py      # NVML energy + power-integral measurement, honest degrade
   _receipt.py     # SHA-256 hash-chained, tamper-evident receipts
   _policy.py      # advisory policy gate (allow_all default, fail-closed)
+  _attest.py      # in-toto/SLSA-shaped Statements + EU AI Act / NIST AI RMF evidence
+  _spine.py       # PCGI spine fold: metered inference -> ONE canonical szl-receipt
   metadata.json
 pyproject.toml                              # also pip-installable from source
 tests/test_meter.py                         # runs on CPU, no GPU needed
+tests/test_attest.py                        # attestation + compliance, no GPU needed
+tests/test_spine.py                         # canonical PCGI receipt fold, no GPU needed
 LICENSE                                     # Apache-2.0
 ```
 

SECURITY.md

@@ -0,0 +1,63 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 1.x     | :white_check_mark: |
+| < 1.0   | :x:                |
+
+## Reporting a Vulnerability
+
+**Do NOT open a public GitHub issue for security vulnerabilities.**
+
+Please report security vulnerabilities via email to **security@szlholdings.ai** with:
+
+1. Description of the vulnerability
+2. Steps to reproduce
+3. Potential impact assessment
+4. Any suggested mitigations
+
+### Response SLA
+
+| Severity | Initial Response | Resolution Target |
+|---|---|---|
+| Critical | 24 hours | 7 days |
+| High | 48 hours | 30 days |
+| Medium | 5 business days | 90 days |
+| Low | 10 business days | 180 days |
+
+We follow a **90-day responsible disclosure** policy. After 90 days from initial report, details may be published regardless of patch status (with appropriate notice to reporter).
+
+## Supply-Chain Security
+
+- **SLSA Build Level 1** — build provenance generated per release (honest; not L2/L3)
+- **DCO required** — all commits carry `Signed-off-by:` trailers per [Linux Foundation DCO](https://developercertificate.org/)
+- **Cosign keyless signing** — containers signed via Sigstore OIDC keyless mode; verify with `cosign verify ghcr.io/szl-holdings/governed-inference-meter:<tag>`
+- **SBOM** — CycloneDX SBOM attached to each GitHub Release
+
+## Section 889 Attestation
+
+SZL Holdings attests that no covered telecommunications equipment or services from the following vendors are used in this software:
+
+1. Huawei Technologies Company
+2. ZTE Corporation
+3. Hytera Communications Corporation
+4. Hangzhou Hikvision Digital Technology Company
+5. Dahua Technology Company
+
+Per NDAA Section 889, 41 U.S.C. § 4713.
+
+## Doctrine
+
+- Doctrine v11 LOCKED — kernel commit `c7c0ba17` (749 declarations / 14 axioms / 163 sorries)
+- Λ = Conjecture 1 (never a theorem)
+- No Iron Bank, FedRAMP, CMMC, or SWFT claims
+
+## Contact
+
+- **Security disclosures:** security@szlholdings.ai
+- **General:** hello@szlholdings.ai
+- **Website:** https://szlholdings.ai
+
+*This policy follows [OpenSSF Vulnerability Disclosure Guide](https://github.com/ossf/oss-vulnerability-guide).*

build/torch-universal/governed_inference_meter/__init__.py

@@ -57,7 +57,15 @@ import contextlib
 import time
 from typing import Any, Callable, Dict, Optional, Sequence, Tuple
 
-from . import _energy, _policy, _receipt
+from . import _attest, _energy, _policy, _receipt
+from ._attest import (
+    IN_TOTO_STATEMENT_TYPE,
+    SZL_PREDICATE_TYPE,
+    attest,
+    compliance_evidence,
+    to_intoto_statement,
+    verify_statement,
+)
 from ._energy import (
     MODE_ENERGY_COUNTER,
     MODE_POWER_INTEGRAL,
@@ -68,6 +76,20 @@ from ._energy import (
 )
 from ._policy import ALLOW, DENY, PolicyResult, allow_all, deny_all, evaluate
 from ._receipt import ReceiptChain, default_chain
+from ._spine import (
+    CANONICAL_KIND,
+    ENERGY_UNAVAILABLE,
+    PREDICATE_TYPE,
+    SPEC_VERSION,
+    canonical_receipt_body,
+    digest,
+    emit_szl_receipt,
+    from_meter_receipt,
+    meter_szl_receipt,
+    to_statement,
+    verify_szl_receipt,
+    verify_szl_statement,
+)
 
 __all__ = [
     "meter",
@@ -84,16 +106,35 @@ __all__ = [
     "receipt_tail",
     "receipt_verify",
     "selfcheck",
+    "attest",
+    "to_intoto_statement",
+    "compliance_evidence",
+    "verify_statement",
+    "IN_TOTO_STATEMENT_TYPE",
+    "SZL_PREDICATE_TYPE",
     "DOCTRINE_FOOTER",
     "MODE_UNMEASURED",
     "MODE_ENERGY_COUNTER",
     "MODE_POWER_INTEGRAL",
     "ALLOW",
     "DENY",
+    # PCGI spine fold — canonical szl-receipt for a metered inference.
+    "emit_szl_receipt",
+    "from_meter_receipt",
+    "meter_szl_receipt",
+    "canonical_receipt_body",
+    "to_statement",
+    "verify_szl_receipt",
+    "verify_szl_statement",
+    "digest",
+    "CANONICAL_KIND",
+    "PREDICATE_TYPE",
+    "SPEC_VERSION",
+    "ENERGY_UNAVAILABLE",
     "__version__",
 ]
 
-__version__ = "0.1.0"
+__version__ = "0.2.0"
 DOCTRINE_FOOTER = (
     "SZL Holdings · governed, energy-metered inference receipts · "
     "MEASURED only with NVML · policy gate is advisory (host-enforced) · "

build/torch-universal/governed_inference_meter/_attest.py

@@ -0,0 +1,223 @@
+# SPDX-License-Identifier: Apache-2.0
+# © 2026 SZL Holdings · Stephen P. Lutar · ORCID 0009-0001-0110-4173
+"""Standards-interop + compliance-evidence layer for governed-inference receipts.
+
+A governed-inference receipt (see :mod:`._receipt`) is an honest, tamper-evident,
+hash-chained record of one metered inference call. This module lets that record
+*speak the wider ecosystem's language* without changing a single measured value:
+
+  1. :func:`to_intoto_statement` renders a receipt as an **in-toto Statement v1**
+     — the exact JSON payload that Sigstore / DSSE / IETF SCITT tooling already
+     knows how to carry, sign, and store in a transparency log. The predicate is
+     laid out in SLSA-v1 provenance shape (``buildDefinition`` / ``runDetails``).
+  2. :func:`compliance_evidence` maps the receipt onto the specific **EU AI Act**
+     articles and **NIST AI RMF** functions it provides operational evidence for
+     and — per the honesty doctrine — states plainly what it does **NOT** establish.
+  3. :func:`verify_statement` re-derives the receipt body digest and confirms the
+     Statement's subject is bound to that exact receipt.
+
+CONSOLIDATION (the ecosystem shapes + regulator catalogue live in ONE place):
+  The in-toto Statement envelope, the SLSA-shaped predicate skeleton, the
+  EU AI Act / NIST AI RMF control catalogue, and the subject-digest verifier are
+  the SHARED :mod:`szl_receipt.attest` module — the same library that already
+  provides receipt signing. This module is a thin, receipt-schema-specific
+  adapter over it: it maps this package's receipt fields onto capability flags
+  and predicate parameters, then delegates the ecosystem-facing shapes. That
+  keeps a single source of truth so the regulator mapping can never drift
+  between SZL packages. Attestation is therefore an interop feature that, like
+  signing, requires the shared ``szl-receipt`` library (install extra ``[sign]``);
+  the import is lazy so importing this package stays zero-hard-dependency.
+
+HONESTY (Λ = Conjecture 1, advisory — NOT a theorem):
+  * We emit our OWN predicate type URI. We do NOT claim official SLSA-provenance
+    conformance; the shape is SLSA-*inspired* for recognizability only.
+  * Energy fields are copied verbatim from the receipt. When the receipt is
+    ``mode="unmeasured"`` the energy evidence is reported ``UNAVAILABLE`` — never
+    a fabricated joule or efficiency number.
+  * A receipt is EVIDENCE toward a control, never a conformity assessment,
+    certification, or safety guarantee. Every mapping entry carries an explicit
+    ``does_not_establish`` note.
+  * Stdlib only in this module. Nothing is written to disk or the network here;
+    signing (DSSE/Sigstore) is a separate, out-of-band concern.
+"""
+import hashlib
+import json
+from typing import Any, Dict, Optional, Tuple
+
+from ._receipt import _BODY_FIELDS, canonical_json
+
+# In-toto Statement envelope type — the stable, ecosystem-standard URI. Defined
+# locally (not imported) so importing this package never requires szl-receipt at
+# import time; it mirrors the identical constant in ``szl_receipt.attest``.
+IN_TOTO_STATEMENT_TYPE = "https://in-toto.io/Statement/v1"
+
+# Our OWN predicate type. Honest: this is an SZL predicate, SLSA-*shaped* for
+# recognizability — it is NOT a claim of official SLSA-provenance conformance.
+SZL_PREDICATE_TYPE = "https://a-11-oy.com/attest/governed-inference/v0.1"
+
+ATTEST_DOCTRINE = (
+    "SZL Holdings · in-toto/SLSA-shaped attestation over an honest, hash-chained "
+    "governed-inference receipt · MEASURED energy only (else UNAVAILABLE) · "
+    "EVIDENCE toward a control, NOT a conformity assessment or safety guarantee · "
+    "Lambda = Conjecture 1 (advisory) · trust never 100%"
+)
+
+
+def _shared():
+    """Lazily import the shared :mod:`szl_receipt.attest` layer.
+
+    Attestation is an interop feature that reuses the ONE canonical home for the
+    ecosystem shapes and the regulator catalogue (the same ``szl-receipt`` library
+    used for signing). If it is not installed we raise a clear, honest error —
+    never a silent, drift-prone local reimplementation.
+    """
+    try:
+        from szl_receipt import attest as _a  # type: ignore
+    except Exception as exc:  # noqa: BLE001
+        raise ImportError(
+            "governed_inference_meter attestation requires the shared 'szl-receipt' "
+            "library (pip install 'governed-inference-meter[sign]', or "
+            "pip install szl-receipt). Underlying import error: %r" % (exc,)
+        ) from exc
+    return _a
+
+
+def _receipt_body(receipt: Dict[str, Any]) -> Dict[str, Any]:
+    """Extract the exact canonical body (the hashed fields) from a receipt."""
+    return {k: receipt[k] for k in _BODY_FIELDS}
+
+
+def _body_digest(body: Dict[str, Any]) -> str:
+    return hashlib.sha256(canonical_json(body).encode("utf-8")).hexdigest()
+
+
+def _measured(receipt: Dict[str, Any]) -> bool:
+    """True only when real energy was measured (mode set and joules present)."""
+    return receipt.get("mode") != "unmeasured" and receipt.get("joules") is not None
+
+
+def to_intoto_statement(
+    receipt: Dict[str, Any],
+    *,
+    subject_name: Optional[str] = None,
+) -> Dict[str, Any]:
+    """Render *receipt* as an in-toto Statement v1 with an SLSA-shaped predicate.
+
+    The Statement's single subject is the receipt itself, bound by its SHA-256
+    body digest, so the attestation is inseparable from the exact record it
+    describes. All energy fields are copied verbatim (honest ``null`` when the
+    receipt was unmeasured). The returned dict is the *unsigned* payload that a
+    DSSE/Sigstore signer would then wrap.
+    """
+    a = _shared()
+    body = _receipt_body(receipt)
+    digest = receipt.get("digest") or _body_digest(body)
+    measured = _measured(receipt)
+    name = subject_name or "governed-inference-receipt/seq-{}".format(
+        receipt.get("seq", "?")
+    )
+    predicate = a.slsa_predicate(
+        build_type=SZL_PREDICATE_TYPE,
+        external_parameters={
+            "model": receipt.get("model"),
+            "tokens_in": receipt.get("tokens_in"),
+            "tokens_out": receipt.get("tokens_out"),
+        },
+        internal_parameters={
+            "policy_decision": receipt.get("policy_decision"),
+            "policy_reason": receipt.get("policy_reason"),
+        },
+        builder_id=SZL_PREDICATE_TYPE,
+        metadata={
+            "energy_mode": receipt.get("mode"),
+            "measured": measured,
+            # Verbatim, honest-null when unmeasured. Never fabricated.
+            "joules": receipt.get("joules"),
+            "wall_seconds": receipt.get("wall_seconds"),
+            "tokens_per_joule": receipt.get("tokens_per_joule"),
+        },
+        extra={"doctrine": ATTEST_DOCTRINE},
+    )
+    # Bind the receipt's chain position into the run details (product-specific).
+    predicate["runDetails"]["receipt"] = {
+        "seq": receipt.get("seq"),
+        "prev": receipt.get("prev"),
+        "digest": digest,
+    }
+    return a.build_statement(
+        subject_name=name,
+        subject_digest=digest,
+        predicate=predicate,
+        predicate_type=SZL_PREDICATE_TYPE,
+    )
+
+
+def compliance_evidence(receipt: Dict[str, Any]) -> Dict[str, Any]:
+    """Map *receipt* onto EU AI Act / NIST AI RMF controls it evidences.
+
+    Returns a dict with per-control ``status`` — ``"supports"`` when the receipt
+    provides operational evidence for that control, or ``"UNAVAILABLE"`` for an
+    energy-dependent control on an unmeasured receipt. Every entry carries an
+    explicit ``does_not_establish`` note. This is EVIDENCE, never a conformity
+    assessment or certification.
+    """
+    a = _shared()
+    measured = _measured(receipt)
+    # A governed-inference receipt always logs (hash chain), is tamper-evident,
+    # and records an advisory governance decision; energy is capability-gated.
+    capabilities = {
+        "logging": True,
+        "integrity": True,
+        "governance": True,
+        "energy": measured,
+    }
+    ev = a.compliance_evidence(
+        capabilities=capabilities,
+        subject_digest=receipt.get("digest"),
+        extra={
+            "receipt_seq": receipt.get("seq"),
+            "receipt_digest": receipt.get("digest"),
+            "doctrine": ATTEST_DOCTRINE,
+        },
+    )
+    return ev
+
+
+def attest(
+    receipt: Dict[str, Any],
+    *,
+    subject_name: Optional[str] = None,
+) -> Dict[str, Any]:
+    """Convenience: the in-toto Statement plus its compliance-evidence mapping."""
+    return {
+        "statement": to_intoto_statement(receipt, subject_name=subject_name),
+        "compliance": compliance_evidence(receipt),
+    }
+
+
+def verify_statement(
+    statement: Dict[str, Any],
+    receipt: Dict[str, Any],
+) -> Tuple[bool, str]:
+    """Confirm *statement* is bound to *receipt*. Returns ``(ok, reason)``.
+
+    Re-derives the receipt body digest and checks it matches BOTH the receipt's
+    own ``digest`` and the Statement subject digest — so an attestation cannot
+    drift from, or be swapped away from, the exact record it claims to describe.
+    """
+    a = _shared()
+    try:
+        body = _receipt_body(receipt)
+    except KeyError as exc:  # receipt missing a hashed field
+        return (False, "receipt-missing-field:{}".format(exc.args[0]))
+    recomputed = _body_digest(body)
+    if receipt.get("digest") != recomputed:
+        return (False, "receipt-digest-mismatch")
+    return a.verify_statement(
+        statement, expected_digest=recomputed, predicate_type=SZL_PREDICATE_TYPE
+    )
+
+
+def to_json(obj: Dict[str, Any]) -> str:
+    """Canonical (sorted, compact) JSON — the bytes a DSSE signer would cover."""
+    return json.dumps(obj, sort_keys=True, separators=(",", ":"))

build/torch-universal/governed_inference_meter/_spine.py

@@ -0,0 +1,376 @@
+# SPDX-License-Identifier: Apache-2.0
+# © 2026 SZL Holdings · Stephen P. Lutar · ORCID 0009-0001-0110-4173
+"""PCGI spine fold — a metered inference as ONE canonical szl-receipt.
+
+This is the WAVE-2 spine UNIFY step: it folds a governed-inference metering
+result onto the org-canonical ``szl-receipt`` shape so the meter becomes a
+first-class *Proof-Carrying Governed Intelligence* (PCGI) receipt producer on
+the same spine as every other decision producer (a11oy, yarqa, killinchu, ...).
+
+A canonical receipt binds, in ONE signed record:
+
+  * ``model``          — the model id that produced the output,
+  * ``input_digest``   — SHA-256 over the canonical input,
+  * ``output_digest``  — SHA-256 over the canonical output,
+  * ``policy``         — the governing policy id + advisory decision/reason,
+  * ``energy``         — MEASURED joules verbatim, or honest ``UNAVAILABLE``.
+
+It does NOT invent a new receipt shape: it uses ``szl_receipt.Receipt`` +
+``szl_receipt.sign_receipt`` for the canonical body + DSSE signing, and
+``szl_receipt.build_statement`` / ``slsa_predicate`` / ``verify_statement`` for
+the in-toto Statement. The shared library is the ONE source of truth for
+canonicalization, signing, and the ecosystem shapes.
+
+HONESTY (Λ = Conjecture 1, advisory — NOT a theorem):
+  * Energy is bound VERBATIM only when the meter actually measured it (NVML
+    present, ``mode != "unmeasured"``, ``joules`` present). Otherwise the
+    ``energy.joules`` field is the literal string ``"UNAVAILABLE"`` and
+    ``energy.measured`` is ``False``. A joule figure is NEVER fabricated. This
+    meter is the one place in the spine where energy CAN be real — the honest
+    counterpart to killinchu's edge ``UNAVAILABLE``.
+  * The receipt is EVIDENCE binding a decision (model+input+output+policy+
+    energy), NOT a proof that the model's output is correct.
+  * Keyless => UNSIGNED-honest (``signed=False``); a signature is never faked.
+  * The canonical body is deterministic: given identical inputs it serializes to
+    byte-identical canonical JSON (no timestamps / wall-clock in the body).
+
+Import stays zero-hard-dependency: ``szl_receipt`` is imported lazily, so
+importing this package never requires it. Producing a canonical receipt does
+require it (install extra ``[sign]``), and its absence raises a clear error.
+"""
+import hashlib
+from typing import Any, Callable, Dict, Optional, Sequence, Tuple, Union
+
+# Canonical receipt kind (matches the additive signing layer in _receipt.py).
+CANONICAL_KIND = "governed-inference"
+
+# Our OWN predicate type — SLSA-*shaped* for recognizability, NOT a claim of
+# official SLSA-provenance conformance (mirrors _attest.SZL_PREDICATE_TYPE).
+PREDICATE_TYPE = "https://a-11-oy.com/attest/governed-inference/v0.1"
+
+# Canonical body schema version for the PCGI fold.
+SPEC_VERSION = "pcgi-governed-inference/0.1"
+
+# Honest sentinel for energy that was not measured (never a fabricated joule).
+ENERGY_UNAVAILABLE = "UNAVAILABLE"
+
+# Default logical signing-authority label stamped onto the envelope.
+_ORGAN = "governed-inference-meter"
+
+SPINE_DOCTRINE = (
+    "SZL Holdings · PCGI spine · a metered inference as ONE canonical "
+    "szl-receipt binding model+input+output+policy+energy · MEASURED joules "
+    "verbatim else UNAVAILABLE (never fabricated) · receipt = evidence trail, "
+    "NOT a proof the output is correct · Lambda = Conjecture 1 (advisory) · "
+    "trust never 100%"
+)
+
+
+def _shared():
+    """Lazily import the shared ``szl_receipt`` library (the ONE canonical home).
+
+    Producing a canonical receipt reuses szl-receipt's canonicalization, signing,
+    and in-toto shapes. If it is not installed we raise a clear, honest error —
+    never a silent, drift-prone local reimplementation.
+    """
+    try:
+        import szl_receipt as _s  # type: ignore
+    except Exception as exc:  # noqa: BLE001
+        raise ImportError(
+            "governed_inference_meter canonical szl-receipt output requires the "
+            "shared 'szl-receipt' library (pip install "
+            "'governed-inference-meter[sign]', or pip install szl-receipt). "
+            "Underlying import error: %r" % (exc,)
+        ) from exc
+    return _s
+
+
+def _canonical_bytes(obj: Any) -> bytes:
+    """Deterministic bytes for *obj*, reusing szl-receipt's canonicalization.
+
+    ``bytes`` are hashed as-is; ``str`` as its UTF-8 bytes; any JSON-serialisable
+    object via szl-receipt's ``canonical_json`` (sorted, compact) so digests are
+    stable across processes. Non-JSON objects fall back to a stable ``repr`` —
+    honest and deterministic, never an exception that would hide the binding.
+    """
+    if isinstance(obj, bytes):
+        return obj
+    if isinstance(obj, str):
+        return obj.encode("utf-8")
+    try:
+        # Reuse szl-receipt's ONE canonicalization when available.
+        from szl_receipt._canonical import canonical_json  # type: ignore
+    except Exception:  # noqa: BLE001 - defensive against version drift
+        import json as _json
+
+        def canonical_json(o):  # byte-identical fallback to szl-receipt's
+            return _json.dumps(
+                o, sort_keys=True, separators=(",", ":"), ensure_ascii=False
+            ).encode("utf-8")
+
+    try:
+        return canonical_json(obj)
+    except TypeError:
+        # Not JSON-serialisable (e.g. a tensor/handle): bind a stable repr so the
+        # digest is still deterministic and honest about what it covers.
+        return ("repr::" + repr(obj)).encode("utf-8")
+
+
+def digest(obj: Any) -> str:
+    """SHA-256 hex digest over the canonical bytes of *obj* (see ``_canonical_bytes``)."""
+    return hashlib.sha256(_canonical_bytes(obj)).hexdigest()
+
+
+def _energy_binding(energy: Optional[Dict[str, Any]]) -> Dict[str, Any]:
+    """Honest energy binding from a meter ``energy`` dict OR a meter receipt.
+
+    Both an ``EnergyMeter.stop()`` dict and a receipt carry ``mode``/``joules``.
+    MEASURED joules are copied verbatim; otherwise ``joules`` is the literal
+    ``"UNAVAILABLE"`` sentinel and ``measured`` is ``False``. Never fabricated.
+    """
+    e = dict(energy or {})
+    mode = e.get("mode", "unmeasured")
+    joules = e.get("joules", None)
+    measured = (mode != "unmeasured") and (joules is not None)
+    if measured:
+        return {
+            "measured": True,
+            "mode": str(mode),
+            "joules": round(float(joules), 6),  # verbatim measured value
+        }
+    return {
+        "measured": False,
+        "mode": str(mode),
+        "joules": ENERGY_UNAVAILABLE,  # honest sentinel — no fabricated joule
+    }
+
+
+def canonical_receipt_body(
+    *,
+    model: str,
+    input: Any = None,
+    output: Any = None,
+    policy_id: str = "unspecified",
+    policy_decision: str = "allow",
+    policy_reason: str = "",
+    energy: Optional[Dict[str, Any]] = None,
+    input_digest: Optional[str] = None,
+    output_digest: Optional[str] = None,
+) -> Dict[str, Any]:
+    """Assemble the DETERMINISTIC canonical receipt body (the PCGI binding).
+
+    Provide either the raw ``input``/``output`` (they will be digested) or a
+    precomputed ``input_digest``/``output_digest``. The body contains no
+    timestamp or wall-clock, so identical inputs serialize byte-identically.
+    """
+    idig = input_digest if input_digest is not None else digest(input)
+    odig = output_digest if output_digest is not None else digest(output)
+    return {
+        "spec_version": SPEC_VERSION,
+        "model": str(model),
+        "input_digest": "sha256:" + idig,
+        "output_digest": "sha256:" + odig,
+        "policy": {
+            "id": str(policy_id),
+            "decision": str(policy_decision),
+            "reason": str(policy_reason),
+        },
+        "energy": _energy_binding(energy),
+    }
+
+
+def emit_szl_receipt(
+    *,
+    model: str,
+    input: Any = None,
+    output: Any = None,
+    policy_id: str = "unspecified",
+    policy_decision: str = "allow",
+    policy_reason: str = "",
+    energy: Optional[Dict[str, Any]] = None,
+    input_digest: Optional[str] = None,
+    output_digest: Optional[str] = None,
+    sign_key: Optional[Union[str, bytes]] = None,
+    organ: str = _ORGAN,
+) -> Dict[str, Any]:
+    """Produce ONE canonical szl-receipt (DSSE envelope) for a metered inference.
+
+    Binds model id + input digest + output digest + governing policy id + energy
+    into a ``szl_receipt.Receipt`` and signs it. With a PEM ECDSA-P256 *sign_key*
+    the envelope is signed; keyless it is UNSIGNED-honest (``signed=False``). The
+    envelope's ``digest`` is the SHA-256 over the canonical body — byte-stable
+    for identical inputs.
+    """
+    s = _shared()
+    body = canonical_receipt_body(
+        model=model,
+        input=input,
+        output=output,
+        policy_id=policy_id,
+        policy_decision=policy_decision,
+        policy_reason=policy_reason,
+        energy=energy,
+        input_digest=input_digest,
+        output_digest=output_digest,
+    )
+    return s.sign_receipt(s.Receipt(kind=CANONICAL_KIND, body=body), sign_key, organ=organ)
+
+
+def from_meter_receipt(
+    meter_receipt: Dict[str, Any],
+    *,
+    input: Any = None,
+    output: Any = None,
+    policy_id: str = "unspecified",
+    input_digest: Optional[str] = None,
+    output_digest: Optional[str] = None,
+    sign_key: Optional[Union[str, bytes]] = None,
+    organ: str = _ORGAN,
+) -> Dict[str, Any]:
+    """Fold an existing meter receipt (from :func:`meter`) onto a canonical receipt.
+
+    Reads ``model``, ``mode``/``joules`` (energy), and ``policy_decision``/
+    ``policy_reason`` from the meter receipt, and binds the given ``input``/
+    ``output`` (or precomputed digests). Energy honesty is preserved verbatim.
+    """
+    return emit_szl_receipt(
+        model=meter_receipt.get("model", "unspecified"),
+        input=input,
+        output=output,
+        policy_id=policy_id,
+        policy_decision=meter_receipt.get("policy_decision", "allow"),
+        policy_reason=meter_receipt.get("policy_reason", ""),
+        energy={
+            "mode": meter_receipt.get("mode", "unmeasured"),
+            "joules": meter_receipt.get("joules", None),
+        },
+        input_digest=input_digest,
+        output_digest=output_digest,
+        sign_key=sign_key,
+        organ=organ,
+    )
+
+
+def meter_szl_receipt(
+    fn: Callable[..., Any],
+    *,
+    args: Sequence[Any] = (),
+    kwargs: Optional[Dict[str, Any]] = None,
+    model: str = "unspecified",
+    policy_id: str = "unspecified",
+    policy: Optional[Callable[..., Any]] = None,
+    chain: Optional[Any] = None,
+    device_index: int = 0,
+    sample_hz: float = 100.0,
+    sign_key: Optional[Union[str, bytes]] = None,
+    organ: str = _ORGAN,
+) -> Tuple[Dict[str, Any], Any]:
+    """End-to-end: meter ``fn`` AND emit a canonical szl-receipt for the call.
+
+    Runs the standard energy meter + advisory policy gate (so the existing
+    tamper-evident chain still records the call), then folds the result onto a
+    canonical szl-receipt binding the input (args/kwargs) and output digests.
+    Returns ``(envelope, output)``. On a policy DENY, ``fn`` is not executed and
+    the receipt binds a ``null`` output digest with energy ``UNAVAILABLE``.
+    """
+    import governed_inference_meter as _pkg  # package fully loaded by call time
+
+    kwargs = dict(kwargs or {})
+    rec, output = _pkg.meter(
+        fn,
+        args=args,
+        kwargs=kwargs,
+        model=model,
+        policy=policy,
+        chain=chain,
+        device_index=device_index,
+        sample_hz=sample_hz,
+    )
+    env = from_meter_receipt(
+        rec,
+        input={"args": list(args), "kwargs": kwargs},
+        output=output,
+        policy_id=policy_id,
+        sign_key=sign_key,
+        organ=organ,
+    )
+    return env, output
+
+
+def to_statement(
+    envelope_or_body: Dict[str, Any],
+    *,
+    subject_name: Optional[str] = None,
+) -> Dict[str, Any]:
+    """Render a canonical receipt as an in-toto Statement v1 (SLSA-shaped).
+
+    Accepts either a DSSE envelope (from :func:`emit_szl_receipt`, whose
+    ``payload`` is the base64 canonical body) or a raw body dict. The Statement's
+    single subject is bound to the receipt body's SHA-256 digest, so the
+    attestation is inseparable from the exact record. All energy fields are
+    copied verbatim (honest ``"UNAVAILABLE"`` when unmeasured).
+    """
+    s = _shared()
+    body = _body_of(envelope_or_body)
+    subject_digest = s.Receipt(kind=CANONICAL_KIND, body=body).digest()
+    energy = body.get("energy", {})
+    predicate = s.slsa_predicate(
+        build_type=PREDICATE_TYPE,
+        external_parameters={
+            "model": body.get("model"),
+            "input_digest": body.get("input_digest"),
+            "output_digest": body.get("output_digest"),
+        },
+        internal_parameters={"policy": body.get("policy")},
+        builder_id=PREDICATE_TYPE,
+        metadata={
+            "energy_measured": bool(energy.get("measured", False)),
+            "energy_mode": energy.get("mode"),
+            # Verbatim: a float when measured, the "UNAVAILABLE" sentinel else.
+            "joules": energy.get("joules"),
+        },
+        extra={"doctrine": SPINE_DOCTRINE},
+    )
+    name = subject_name or "governed-inference-receipt/{}".format(subject_digest[:16])
+    return s.build_statement(
+        subject_name=name,
+        subject_digest=subject_digest,
+        predicate=predicate,
+        predicate_type=PREDICATE_TYPE,
+    )
+
+
+def _body_of(envelope_or_body: Dict[str, Any]) -> Dict[str, Any]:
+    """Return the canonical body from a DSSE envelope or pass a raw body through."""
+    if "payload" in envelope_or_body and "payloadType" in envelope_or_body:
+        import base64
+        import json
+
+        return json.loads(base64.b64decode(envelope_or_body["payload"]).decode("utf-8"))
+    return envelope_or_body
+
+
+def verify_szl_receipt(
+    envelope: Dict[str, Any],
+    public_key_pem: Optional[Union[str, bytes]] = None,
+) -> Tuple[bool, str]:
+    """Verify a canonical receipt envelope. Delegates to ``szl_receipt.verify_receipt``.
+
+    Signed => ``(True, "ok")`` with the right key; keyless => the honest
+    ``(False, "unsigned-honest")``; tamper/wrong-key => ``(False, ...)``.
+    """
+    s = _shared()
+    return s.verify_receipt(envelope, public_key_pem)
+
+
+def verify_szl_statement(
+    statement: Dict[str, Any],
+    envelope_or_body: Dict[str, Any],
+) -> Tuple[bool, str]:
+    """Confirm *statement* is bound to the exact canonical receipt. ``(ok, reason)``."""
+    s = _shared()
+    body = _body_of(envelope_or_body)
+    expected = s.Receipt(kind=CANONICAL_KIND, body=body).digest()
+    return s.verify_statement(
+        statement, expected_digest=expected, predicate_type=PREDICATE_TYPE
+    )

pyproject.toml

@@ -10,7 +10,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "governed-inference-meter"
-version = "0.1.0"
+version = "0.3.0"
 description = "Energy-metered, governed inference receipts: NVML joules, tokens/joule, an advisory policy gate, and a tamper-evident SHA-256 hash-chained receipt. Honest by design — MEASURED only with NVML."
 readme = "README.md"
 requires-python = ">=3.8"
@@ -43,9 +43,10 @@ dependencies = []
 gpu = ["pynvml>=11.0.0"]
 # torch is optional and only used to synchronize CUDA around the metered call.
 torch = ["torch"]
-# Optional DSSE/ECDSA-P256 signing of receipts via the shared szl-receipt lib.
-# Core stays zero-hard-dependency: signing is opt-in and import is lazy.
-sign = ["szl-receipt>=0.1.0"]
+# Optional DSSE/ECDSA-P256 signing AND in-toto/SLSA + EU AI Act / NIST AI RMF
+# attestation of receipts, both via the shared szl-receipt lib (one source of
+# truth). Core stays zero-hard-dependency: these are opt-in and imported lazily.
+sign = ["szl-receipt>=0.2.0"]
 test = ["pytest"]
 
 [project.urls]

tests/test_attest.py

@@ -0,0 +1,119 @@
+# SPDX-License-Identifier: Apache-2.0
+# © 2026 SZL Holdings · Stephen P. Lutar · ORCID 0009-0001-0110-4173
+"""Tests for the standards-interop + compliance-evidence attestation layer.
+
+Runs WITHOUT a GPU. On a GPU-less box every receipt is honestly
+``unmeasured``; the tests assert the attestation preserves that honesty
+(no fabricated joules, energy-dependent controls report ``UNAVAILABLE``) and
+that the in-toto Statement is cryptographically bound to its exact receipt.
+
+Run directly (no pytest needed):  python tests/test_attest.py
+Or with pytest:                    pytest tests/
+"""
+import json
+import os
+import sys
+
+sys.path.insert(
+    0,
+    os.path.join(os.path.dirname(__file__), "..", "build", "torch-universal"),
+)
+
+import governed_inference_meter as gim  # noqa: E402
+
+
+def _one_receipt():
+    ch = gim.ReceiptChain()
+    rec, _ = gim.meter(
+        lambda p: p.upper(), args=("hi",),
+        model="attest-stub", tokens_in=1, tokens_out=2, chain=ch,
+    )
+    return rec
+
+
+def test_statement_shape_and_binding():
+    rec = _one_receipt()
+    stmt = gim.to_intoto_statement(rec)
+    assert stmt["_type"] == gim.IN_TOTO_STATEMENT_TYPE
+    assert stmt["predicateType"] == gim.SZL_PREDICATE_TYPE
+    # Subject is bound to the receipt's own digest.
+    assert stmt["subject"][0]["digest"]["sha256"] == rec["digest"]
+    # SLSA-shaped predicate is present and echoes the call parameters.
+    ext = stmt["predicate"]["buildDefinition"]["externalParameters"]
+    assert ext["model"] == "attest-stub"
+    assert ext["tokens_in"] == 1 and ext["tokens_out"] == 2
+    # Verifier confirms the statement is bound to this receipt.
+    ok, why = gim.verify_statement(stmt, rec)
+    assert ok and why == "ok", (ok, why)
+
+
+def test_verifier_rejects_wrong_receipt():
+    rec = _one_receipt()
+    stmt = gim.to_intoto_statement(rec)
+    # A different receipt (different seq/model) must NOT verify against stmt.
+    ch = gim.ReceiptChain()
+    other, _ = gim.meter(
+        lambda p: p, args=("x",), model="other", tokens_in=9, tokens_out=9,
+        chain=ch,
+    )
+    ok, why = gim.verify_statement(stmt, other)
+    assert ok is False, (ok, why)
+
+    # Tampering with the receipt body must break verification (real digest check).
+    tampered = dict(rec)
+    tampered["tokens_out"] = rec["tokens_out"] + 1
+    bad_ok, bad_why = gim.verify_statement(stmt, tampered)
+    assert bad_ok is False and bad_why == "receipt-digest-mismatch", bad_why
+
+
+def test_energy_honesty_when_unmeasured():
+    # On a GPU-less box the receipt is unmeasured; the attestation must NOT
+    # invent joules and energy-dependent controls must report UNAVAILABLE.
+    if gim.nvml_available():
+        return  # only assert the honest-degrade path when there is no GPU
+    rec = _one_receipt()
+    assert rec["mode"] == gim.MODE_UNMEASURED
+    stmt = gim.to_intoto_statement(rec)
+    md = stmt["predicate"]["runDetails"]["metadata"]
+    assert md["measured"] is False
+    assert md["joules"] is None
+    assert md["tokens_per_joule"] is None
+
+    ev = gim.compliance_evidence(rec)
+    by_id = {c["id"]: c for c in ev["controls"]}
+    assert by_id["NIST-AI-RMF-MEASURE-2.x"]["status"] == "UNAVAILABLE"
+    # Logging/record-keeping controls are supported regardless of GPU.
+    assert by_id["EU-AI-Act-Art-12"]["status"] == "supports"
+    assert by_id["EU-AI-Act-Art-19"]["status"] == "supports"
+
+
+def test_compliance_is_evidence_not_conformity():
+    rec = _one_receipt()
+    ev = gim.compliance_evidence(rec)
+    # Doctrine: every control states what it does NOT establish.
+    for c in ev["controls"]:
+        assert c["does_not_establish"], c
+    assert "not a conformity assessment" in ev["disclaimer"].lower()
+    # Art-15 must be explicit that it does not establish model accuracy.
+    art15 = next(c for c in ev["controls"] if c["id"] == "EU-AI-Act-Art-15")
+    assert "does not establish model accuracy" in art15["does_not_establish"].lower()
+
+
+def test_statement_is_json_serializable():
+    rec = _one_receipt()
+    bundle = gim.attest(rec)
+    # Must round-trip through canonical JSON (the bytes a DSSE signer covers).
+    s = gim.to_intoto_statement(rec)
+    from governed_inference_meter._attest import to_json  # noqa: E402
+    reparsed = json.loads(to_json(s))
+    assert reparsed == s
+    assert "statement" in bundle and "compliance" in bundle
+
+
+if __name__ == "__main__":
+    test_statement_shape_and_binding()
+    test_verifier_rejects_wrong_receipt()
+    test_energy_honesty_when_unmeasured()
+    test_compliance_is_evidence_not_conformity()
+    test_statement_is_json_serializable()
+    print("ok: all attest tests passed")

tests/test_spine.py

@@ -0,0 +1,215 @@
+# SPDX-License-Identifier: Apache-2.0
+# © 2026 SZL Holdings · Stephen P. Lutar · ORCID 0009-0001-0110-4173
+"""PCGI spine fold: a metered inference as ONE canonical szl-receipt.
+
+Proves the doctrine contract for the WAVE-2 spine UNIFY:
+  * The canonical receipt binds model id + input digest + output digest +
+    governing policy id + energy, using the shared szl-receipt shapes (no new
+    receipt shape is invented).
+  * Determinism: identical inputs => byte-identical canonical body/digest.
+  * A signed receipt verifies; a wrong key does not; tamper is rejected.
+  * Energy honesty: MEASURED joules are bound verbatim; unmeasured energy is the
+    literal "UNAVAILABLE" sentinel — never a fabricated joule.
+  * The in-toto Statement is cryptographically bound to its exact receipt.
+
+Runs WITHOUT a GPU. On a GPU-less box every metered call is honestly unmeasured
+and the tests assert exactly that honest-degrade behavior.
+
+Run directly (no pytest needed):  python tests/test_spine.py
+Or with pytest:                    pytest tests/
+"""
+import base64
+import json
+import os
+import sys
+
+sys.path.insert(
+    0,
+    os.path.join(os.path.dirname(__file__), "..", "build", "torch-universal"),
+)
+
+import governed_inference_meter as gim  # noqa: E402
+from szl_receipt import generate_keypair, verify_receipt  # noqa: E402
+
+
+def _body(env):
+    return json.loads(base64.b64decode(env["payload"]).decode("utf-8"))
+
+
+def test_binds_the_five_pcgi_fields():
+    env = gim.emit_szl_receipt(
+        model="llm-7b",
+        input="hello",
+        output="olleh",
+        policy_id="default-allow",
+        policy_decision="allow",
+        policy_reason="allow_all",
+    )
+    body = _body(env)
+    assert body["model"] == "llm-7b"
+    assert body["input_digest"] == "sha256:" + gim.digest("hello")
+    assert body["output_digest"] == "sha256:" + gim.digest("olleh")
+    assert body["policy"]["id"] == "default-allow"
+    assert body["policy"]["decision"] == "allow"
+    assert "energy" in body and "joules" in body["energy"]
+    # Uses the canonical szl-receipt kind (not a new shape).
+    assert env["payloadType"].startswith("application/vnd.szl.receipt")
+
+
+def test_energy_unavailable_is_honest_not_fabricated():
+    # No energy provided => honest UNAVAILABLE, never a fabricated joule.
+    env = gim.emit_szl_receipt(model="m", input="i", output="o")
+    e = _body(env)["energy"]
+    assert e["measured"] is False
+    assert e["joules"] == gim.ENERGY_UNAVAILABLE
+    assert e["joules"] == "UNAVAILABLE"
+
+
+def test_energy_measured_is_bound_verbatim():
+    # When the meter DID measure, joules are copied verbatim (the one real place).
+    env = gim.emit_szl_receipt(
+        model="m",
+        input="i",
+        output="o",
+        energy={"mode": gim.MODE_ENERGY_COUNTER, "joules": 12.5},
+    )
+    e = _body(env)["energy"]
+    assert e["measured"] is True
+    assert e["mode"] == gim.MODE_ENERGY_COUNTER
+    assert e["joules"] == 12.5
+
+
+def test_determinism_byte_identical_canonical():
+    kw = dict(
+        model="m", input={"prompt": "x", "n": 3}, output=["a", "b"],
+        policy_id="p1", policy_decision="allow", policy_reason="ok",
+        energy={"mode": gim.MODE_ENERGY_COUNTER, "joules": 3.25},
+    )
+    e1 = gim.emit_szl_receipt(**kw)
+    e2 = gim.emit_szl_receipt(**kw)
+    # Canonical payload + digest are byte-identical for identical inputs.
+    assert e1["payload"] == e2["payload"]
+    assert e1["digest"] == e2["digest"]
+    assert _body(e1) == _body(e2)
+
+
+def test_signed_receipt_verifies_and_wrong_key_fails():
+    priv, pub = generate_keypair()
+    env = gim.emit_szl_receipt(
+        model="m", input="i", output="o", sign_key=priv, organ="meter",
+    )
+    assert env["signed"] is True and env["organ"] == "meter"
+    ok, why = gim.verify_szl_receipt(env, pub)
+    assert ok and why == "ok", (ok, why)
+    # Delegation matches the shared library directly.
+    assert verify_receipt(env, pub) == (ok, why)
+    # Wrong key must NOT verify (real crypto).
+    _, other_pub = generate_keypair()
+    bad_ok, _ = gim.verify_szl_receipt(env, other_pub)
+    assert bad_ok is False
+
+
+def test_keyless_is_unsigned_honest():
+    env = gim.emit_szl_receipt(model="m", input="i", output="o")  # no key
+    assert env["signed"] is False
+    ok, why = gim.verify_szl_receipt(env)
+    assert (ok, why) == (False, "unsigned-honest")
+
+
+def test_tamper_is_rejected():
+    priv, pub = generate_keypair()
+    env = gim.emit_szl_receipt(
+        model="m", input="i", output="o", sign_key=priv, organ="meter",
+    )
+    # Tamper the output digest inside the signed payload; signature must fail.
+    body = _body(env)
+    body["output_digest"] = "sha256:" + "0" * 64
+    tampered = dict(env)
+    tampered["payload"] = base64.b64encode(
+        json.dumps(body, sort_keys=True, separators=(",", ":")).encode("utf-8")
+    ).decode("ascii")
+    ok, _ = gim.verify_szl_receipt(tampered, pub)
+    assert ok is False
+
+
+def test_statement_binds_to_exact_receipt():
+    env = gim.emit_szl_receipt(
+        model="m", input="i", output="o",
+        energy={"mode": gim.MODE_ENERGY_COUNTER, "joules": 7.0},
+    )
+    stmt = gim.to_statement(env)
+    assert stmt["_type"] == "https://in-toto.io/Statement/v1"
+    assert stmt["predicateType"] == gim.PREDICATE_TYPE
+    ext = stmt["predicate"]["buildDefinition"]["externalParameters"]
+    assert ext["model"] == "m"
+    md = stmt["predicate"]["runDetails"]["metadata"]
+    assert md["energy_measured"] is True and md["joules"] == 7.0
+    ok, why = gim.verify_szl_statement(stmt, env)
+    assert ok and why == "ok", (ok, why)
+    # A statement for one receipt must not verify against a different receipt.
+    other = gim.emit_szl_receipt(model="other", input="x", output="y")
+    bad_ok, _ = gim.verify_szl_statement(stmt, other)
+    assert bad_ok is False
+
+
+def test_end_to_end_meter_szl_receipt_honest_degrade():
+    priv, pub = generate_keypair()
+    env, out = gim.meter_szl_receipt(
+        lambda p: p.upper(), args=("hi",), model="t",
+        policy_id="default-allow", sign_key=priv, organ="meter",
+    )
+    assert out == "HI"
+    body = _body(env)
+    assert body["model"] == "t"
+    assert body["input_digest"].startswith("sha256:")
+    assert body["output_digest"] == "sha256:" + gim.digest("HI")
+    # On a GPU-less box energy must be honest UNAVAILABLE, never fabricated.
+    if not gim.nvml_available():
+        assert body["energy"]["measured"] is False
+        assert body["energy"]["joules"] == "UNAVAILABLE"
+    ok, why = gim.verify_szl_receipt(env, pub)
+    assert ok and why == "ok", (ok, why)
+
+
+def test_deny_binds_null_output_and_unavailable_energy():
+    env, out = gim.meter_szl_receipt(
+        lambda p: p, args=("p",), model="t",
+        policy_id="lockdown", policy=gim.deny_all,
+    )
+    assert out is None
+    body = _body(env)
+    assert body["policy"]["decision"] == gim.DENY
+    assert body["output_digest"] == "sha256:" + gim.digest(None)
+    assert body["energy"]["joules"] == "UNAVAILABLE"
+
+
+def test_from_meter_receipt_fold_preserves_energy_state():
+    ch = gim.ReceiptChain()
+    rec, out = gim.meter(
+        lambda p: p.upper(), args=("hi",), model="foldme",
+        tokens_in=1, tokens_out=2, chain=ch,
+    )
+    env = gim.from_meter_receipt(rec, input="hi", output=out, policy_id="p")
+    body = _body(env)
+    assert body["model"] == "foldme"
+    # Energy binding must mirror the meter receipt's real measured/unmeasured state.
+    if rec["mode"] == gim.MODE_UNMEASURED:
+        assert body["energy"]["measured"] is False
+        assert body["energy"]["joules"] == "UNAVAILABLE"
+    else:
+        assert body["energy"]["measured"] is True
+        assert body["energy"]["joules"] == rec["joules"]
+
+
+if __name__ == "__main__":
+    failures = 0
+    for name, obj in sorted(globals().items()):
+        if name.startswith("test_") and callable(obj):
+            try:
+                obj()
+                print(f"PASS {name}")
+            except AssertionError as e:  # noqa: PERF203
+                failures += 1
+                print(f"FAIL {name}: {e}")
+    print(f"\n{'ALL PASS' if failures == 0 else str(failures) + ' FAILED'}")
+    sys.exit(1 if failures else 0)