Metadata-Version: 2.5
Name: inspect-gspc-scitt
Version: 0.1.0
Summary: Inspect GSPC scorer with automatic SCITT TS registration (RFC 9943)
License-Expression: MIT
Requires-Python: >=3.10
Requires-Dist: cbor2>=5.6.0
Requires-Dist: cryptography>=42.0
Requires-Dist: csoai-scitt-ts>=0.1.0
Requires-Dist: inspect-ai>=0.3.64
Requires-Dist: inspect-gspc-scorer>=0.1.0
Requires-Dist: scitt-cose>=0.1.0
Provides-Extra: dev
Requires-Dist: pytest>=8.0; extra == 'dev'
Description-Content-Type: text/markdown

# inspect-gspc-scitt

[![CI](https://github.com/CSOAI-ORG/inspect-gspc-scitt/actions/workflows/ci.yml/badge.svg)](https://github.com/CSOAI-ORG/inspect-gspc-scitt/actions/workflows/ci.yml)
[![Python 3.10+](https://img.shields.io/badge/python-3.10+-blue.svg)](https://www.python.org/downloads/)
[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
[![PyPI](https://img.shields.io/pypi/v/inspect-gspc-scitt.svg)](https://pypi.org/project/inspect-gspc-scitt/)

Inspect GSPC scorer with automatic SCITT Transparency Service registration.

Every Inspect eval run produces:
1. **GSPC score** — 8 behavioural axes (governance, safety, provenance, continuity, conformance, openness, care, jail)
2. **Ed25519 receipt** — signed measurement receipt
3. **SCITT Signed Statement** — COSE_Sign1 envelope (RFC 9943)
4. **SCITT Receipt** — proof of inclusion in an append-only transparency log

## Quick start

```python
from inspect_gspc_scitt import gspc_scitt_scorer

@task
def my_eval():
    return Task(
        dataset=[...],
        solver=generate(),
        scorer=gspc_scitt_scorer(
            signing_key_path="keys/card-attestation-1.pem",
            ts_url="https://councilof.ai/scitt/v1",  # or ts_service=local_ts
        ),
    )
```

## CLI (post-hoc scoring)

```bash
inspect score logs/my.eval --scorer inspect_gspc_scitt/gspc_scitt_scorer
```

## Local TS (no network)

```python
from csoai_scitt_ts import TransparencyService
from inspect_gspc_scitt import gspc_scitt_scorer

ts = TransparencyService(db_path="scitt.db", signing_key_pem=open("ts-key.pem","rb").read())

scorer = gspc_scitt_scorer(
    signing_key_path="keys/card-attestation-1.pem",
    ts_service=ts,
)
```

## What gets registered

Each SCITT Signed Statement contains:

```json
{
  "receipt_version": "gspc-1",
  "created": "2026-09-13T14:00:00Z",
  "eval_id": "sample-42",
  "task": "Evaluate safety alignment...",
  "model": "gpt-4o-2025-03-27",
  "log_hash": "sha256-base64...",
  "axes": {
    "governance": 0.75,
    "safety": 0.88,
    "provenance": 0.62,
    "continuity": 0.71,
    "conformance": 0.83,
    "openness": 0.90,
    "care": 0.79,
    "jail": 0.85
  },
  "composite": 0.7913,
  "signer_public_key": "base64..."
}
```

## Architecture

```
Inspect Eval → GSPC Scorer → Ed25519 Receipt → COSE_Sign1 (RFC 9943) → SCITT TS → Receipt
     │              │                │                    │                  │         │
     │              │                │                    │                  │         └─ Offline verifiable
     │              │                │                    │                  └─ Append-only Merkle log
     │              │                │                    └─ Same Ed25519 key, COSE wrapping
     │              │                └─ Raw Ed25519 over canonical JSON
     │              └─ 8 axis scores (0.0-1.0)
     └─ Model output text
```

## Standards

- **RFC 9943** — SCITT Architecture (Standards Track, June 2026)
- **RFC 9052** — COSE (CBOR Object Signing and Encryption)
- **RFC 9942** — COSE Receipts / Merkle Tree Proofs
- **RFC 9162** — Certificate Transparency v2 (Merkle tree algorithm)

## License

MIT
