Metadata-Version: 2.5
Name: aat-verify
Version: 0.1.0
Summary: Standalone reference verifier for the Agent Audit Trail Internet-Draft (draft-sharif-agent-audit-trail).
Project-URL: Homepage, https://datatracker.ietf.org/doc/draft-sharif-agent-audit-trail/
Project-URL: Source, https://cybersecai.co.uk
Author-email: Raza Sharif <contact@agentsign.dev>
License: BUSL-1.1
License-File: LICENSE
Keywords: agent,ai,audit,ietf,ml-dsa,post-quantum,tamper-evident,verifier
Classifier: Development Status :: 4 - Beta
Classifier: Intended Audience :: Developers
Classifier: Programming Language :: Python :: 3
Classifier: Topic :: Security :: Cryptography
Requires-Python: >=3.9
Requires-Dist: cryptography>=41
Provides-Extra: pqc
Requires-Dist: dilithium-py>=1.0; extra == 'pqc'
Description-Content-Type: text/markdown

# aat-verify

Standalone reference verifier for the **Agent Audit Trail** Internet-Draft
([draft-sharif-agent-audit-trail](https://datatracker.ietf.org/doc/draft-sharif-agent-audit-trail/)).

It checks a JSONL audit trail **offline, from the records and public keys
alone**, with no access to the producing agent. That is the point: an auditor,
regulator, or court can verify what an agent did without trusting or contacting
the agent.

## Install

```
pip install "aat-verify[pqc]"
```

The `[pqc]` extra adds post-quantum (ML-DSA-65 / FIPS 204) verification.
Plain `pip install aat-verify` verifies classical (ES256) records only.

## Use

```
aat-verify trail.jsonl --keys keystore.json
```

Machine-readable output:

```
aat-verify trail.jsonl --keys keystore.json --json
```

Exit code is `0` if every check passes, `1` if any check fails.

## What it checks (draft -04)

- Hash-chain integrity (SHA-256 over each record, `batch` excluded)
- Signatures: ES256 (ECDSA P-256), ML-DSA-65 (FIPS 204), and hybrid, with the
  signing key resolved by `signer_kid` (RFC 7638 thumbprint)
- Independent recording on consequential actions (recorder key differs from the
  agent key)
- Attributable trust downgrades (`trust_assignment`)
- Monotonic timestamps
- Merkle batch inclusion (RFC 6962 construction, detached anchor)

## Keystore format

A JSON object mapping each `signer_kid` to a public key:

```json
{
  "<ec-thumbprint>":  { "alg": "ES256", "jwk_x_y": { "x": "...", "y": "..." } },
  "<mldsa-kid>":      { "alg": "ML-DSA-65", "pk": "<base64url public key>" }
}
```

Public keys only. The verifier never needs, accepts, or stores private keys.

## License

Business Source License 1.1 (converts to Apache-2.0 on the Change Date). See
`LICENSE`. (c) 2026 CyberSecAI Ltd, Raza Sharif.
