Standard: .h33bundle · Version: v1 · Status: Locked
One drag-droppable artifact bundles the receipts, envelopes, proofs, and parameter captures produced by a Federal L5 session window, with file-level SHA3-512 integrity hashes and registry-bound product_id / bundle_id attribution.
A recipient feeds the bundle to one verifier instead of routing the component artifacts through five different binaries.
.h33bundle is the portable container that carries the evidence H33-74 produces — receipts, envelopes, proofs, and parameter captures — as one drag-droppable artifact whose integrity stands on hash cryptography alone and verifies fully offline. Unlike the H33-74 receipt (the primitive it wraps unchanged) or the Conformance Suite (the vectors it is tested against), .h33bundle is the on-wire package format, not the proof primitive and not the test corpus.
The verifier rejects any drift in:
receipt_id — field-level mutation)product_id must exist; bundle_id, when set, must reference a real bundle)A .h33bundle is an uncompressed POSIX tar archive. The recipient can inspect contents without any H33 binary present.
manifest.json is at the root of the bundle tree. The verifier asserts:
manifest.json exists, parses, and conforms to §2's schema.manifest.files exists at the path stated.manifest.files exists in the archive (explicit extra-file failure).INSTRUCTIONS.md exists./, no .../ separators.<receipt_id>.json (lowercase hex).The manifest cannot directly contain its own SHA3-512. v1 handles this by:
files[] with one entry whose kind: "manifest" and sha3_512: "" (empty string).sha3_512 field with the actual hex of SHA3-512(canonical_bytes).sha3_512 field to "", re-serializing in struct order, and computing SHA3-512.Receipts (§3) are byte-equivalent to what GET /v1/fhe/l5/receipts/<id> returns. The bundle adds no envelope around the receipt; the file IS the receipt. The canonical SHA3-256 (= receipt_id) MUST match the file's base name. A mismatch is an explicit receipt-id-mismatch failure.
Envelopes (§4) carry the H33PqEnvelope JSON that the receipt's envelope_hash field commits to. The verifier recomputes envelope_hash(env) and compares to the receipt's envelope_hash. Any mismatch is an envelope-mismatch failure.
Output: a .h33bundle file at --output. Exit 0 on success, non-zero on any input validation failure.
Stderr on failure: a single explicit reason and a non-zero exit code.
The verifier returns non-zero on any of the following. There is no warning state; a v1 bundle either passes every gate or it does not verify.
| Gate | Reason code |
|---|---|
| Tarball cannot be opened | tar-open-failed |
manifest.json missing | manifest-missing |
manifest.json malformed | manifest-malformed |
manifest.format != "h33bundle" | format-mismatch |
manifest.version != "v1" | version-unsupported |
| File listed in manifest not present in tar | file-missing |
| File present in tar not listed in manifest | extra-file |
| File's actual SHA3-512 ≠ manifest hash | file-hash-mismatch |
| Receipt file name ≠ receipt's canonical SHA3-256 | receipt-id-mismatch |
Receipt canonical recomputed ≠ stated receipt_id | receipt-canonical-fail |
Envelope hash recomputed ≠ receipt's envelope_hash | envelope-mismatch |
Manifest receipts[] summary ≠ receipt file fields | receipt-summary-drift |
Receipt's product_id not in canonical registry | unknown-product |
Receipt's bundle_id not in canonical bundles | unknown-bundle |
INSTRUCTIONS.md missing | instructions-missing |
| Manifest self-hash recipe (§2.2) doesn't recover | manifest-self-hash-fail |
Each non-goal is a v2 conversation, not a v1 omission to argue with.
A single session produces receipts, envelopes, proofs, and parameter captures across several artifact types. Without a container, a recipient has to route each through a different binary. .h33bundle exists so the whole session ships as one artifact that a recipient verifies with one offline verifier, with no vendor infrastructure in the loop — which is what makes the evidence H33-74 produces genuinely portable.
Use it when you need to hand a complete, self-contained session's evidence to an auditor, insurer, or counterparty who will verify it independently and offline.
Do not reach for it when you need a continuous, live evidence stream rather than a snapshot of a session window — that is continuous post-quantum attestation's job — or when you expect v1 to re-verify STARK soundness or carry signatures. Per the v1 non-goals above, the v1 verifier checks hash integrity only; signing under ML-DSA-87 lands after the production key ceremony closes, and encryption is out of v1 scope.
A portable audit bundle standard: one uncompressed POSIX tar artifact that packages the receipts, envelopes, proofs, and parameter captures from a session window, with per-file SHA3-512 hashes and canonical SHA3-256 receipt IDs, so a recipient can verify it offline with no H33 binary required.
The verifier rejects any drift in a file's SHA3-512, a receipt's canonical SHA3-256 (its receipt_id), the registry mapping (product_id/bundle_id), or the manifest's file enumeration. Integrity stands on hash cryptography alone, and the verifier runs fully offline.
When handing a complete, self-contained session's evidence to an auditor, insurer, or counterparty who will verify it independently and offline. It is a snapshot of a session window, not a continuous stream.
v1 does not sign (ML-DSA-87 authenticity lands after the production key ceremony closes), does not encrypt (receipts carry commitments, not plaintexts), does not compress, makes no remote calls, does not re-verify STARK proof soundness, and does not provide live attestation. Each is an explicit v1 non-goal, not an omission.
H33-74 is the 74-byte post-quantum attestation primitive that produces the receipts. .h33bundle is the portable container that wraps those receipts unchanged, sharing the same canonical SHA3-256 join key. One is the proof; the other is how the proof travels.
Version 1 · Locked 2026-06-10 · Author: Eric Beans, CEO, H33.ai, Inc.