fix: cryptographically bind DGR-001 evidence

packages/node/meshnet_node/recipe_benchmark.py

@@ -35,7 +35,7 @@ from dataclasses import asdict, dataclass, field
 from difflib import SequenceMatcher
 from enum import Enum
 from pathlib import Path
-from typing import Any, Protocol, Sequence
+from typing import Any, Mapping, Protocol, Sequence
 
 # Layout of the report document produced by :func:`build_report`.
 REPORT_SCHEMA_VERSION = 1
@@ -581,6 +581,7 @@ def build_report(
     *,
     host: dict[str, Any],
     evidence_class: str,
+    provenance: Mapping[str, Any] | None = None,
 ) -> dict:
     """Assemble the machine-readable benchmark document.
 
@@ -590,6 +591,8 @@ def build_report(
     """
     if evidence_class not in {"synthetic", "local-real", "multi-machine-real"}:
         raise BenchmarkError(f"unknown evidence class {evidence_class!r}")
+    if evidence_class != "synthetic" and not isinstance(provenance, Mapping):
+        raise BenchmarkError("non-synthetic reports require canonical signed provenance")
 
     references = [m for m in measurements if m.recipe.is_reference]
     if len(references) != 1:
@@ -605,7 +608,7 @@ def build_report(
         for measurement in measurements
         if measurement is not reference and measurement.available
     ]
-    return {
+    report = {
         "schema_version": REPORT_SCHEMA_VERSION,
         "evidence_class": evidence_class,
         "plan": plan.to_dict(),
@@ -614,6 +617,9 @@ def build_report(
         "recipes": [measurement.to_dict() for measurement in measurements],
         "drift": drift,
     }
+    if provenance is not None:
+        report["provenance"] = dict(provenance)
+    return report
 
 
 def format_summary(report: dict) -> str: