Post-quantum cryptographic evidence infrastructure for AI content, audit and risk workflows. 132,000+ lines of Rust, Python and Web code. 31 crates. 4 SDKs. Built, tested, and available for acquisition. No customers. No revenue. Just the engineering.
Every line backed by a test. Every module auditable. Every claim verifiable against the source repository.
pub async fn sign_cose(
payload: &[u8],
key: &SigningKey<Ed25519>,
) -> Result<CoseSign1> // Ed25519 + ML-DSA-65 hybrid signing
// FIPS 204 aligned · COSE_Sign1 / RFC 9052
// 0 todo!() · 0 unimplemented!()
// #![deny(clippy::unwrap_used)]
let sig = key.sign(payload);
let cose = build_cose_envelope(payload, sig);
Ok(cose)
@router.post("/v1/notarize")
async def notarize(
req: NotarizeRequest,
db: AsyncSession = Depends(get_db),
):
# Multi-tenant · JWT org resolution
# Append-only audit tables
# HSM failover · 5 providers
evidence = await create_evidence(
text=req.text,
framework=req.framework,
)
return EvidenceResponse(certificate_id=evidence.id)# Sign content and generate evidence certificate
$ trai sign --text "$(cat report.txt)" \
--framework eu-ai-act-art50 \
--disclosure "Generated by AI system v2.1"
✓ SHA-256 hash computed (0.3ms)
✓ Ed25519 + ML-DSA-65 signed (0.8ms)
✓ SCITT receipt anchored
✓ eIDAS timestamp via Actalis Italia
Certificate: cert_9f8a2b1d5f3e9c7a
Verify: trai.apohara.io/verify/cert_9f8a...Every hash, every signature, every timestamp runs in your browser via Web Crypto API. No mock data. No fake latency. Real cryptographic primitives. The SCITT receipt uses a verified sample artifact. Tamper detection demonstrates signature invalidation.
Four integrated components. Complete source code. No vendor lock-in. No subscription required.
Model Context Protocol integration for AI coding assistants. Each tool is independently callable and backed by Rust cryptographic primitives.
Self-hosted cryptographic compliance SDKs. No SaaS dependency. Python, TypeScript, Go, and a 108KB WASM bundle for browser-native verification.
Court-grade evidence certificates with QR verification, embedded SCITT receipts, and qualified eIDAS timestamps from Actalis Italia.
Monitor AI agent compliance status, evidence chains, and verification outcomes. Integrates with existing SIEM and GRC workflows.
Three categories of compliance tooling. Each serves a different need. TRAI is a source asset for organizations that want to own their evidence substrate.
| Need | Dashboard / GRC Vendor-managed | TRAI Source Asset Buyer-operated |
|---|---|---|
| Framework mapping | ✓ Vendor-managed compliance databases | ✓ Technical mapping (buyer-operated) |
| Cryptographic evidence per output | ~ Varies by vendor; most use API calls, not local crypto | ✓ Ed25519 + ML-DSA-65 hybrid signatures computed locally |
| Ownership model | ✗ Subscription / vendor lock-in | ✓ Buyer-operated source code; full IP assignment |
| Post-quantum readiness | ✗ Roadmap dependent; most lack ML-DSA-65 | ✓ Ed25519 + ML-DSA-65 hybrid (FIPS 204) implemented today |
| Production operation | ✓ Vendor-managed infrastructure | ✗ Buyer provisions own infrastructure and keys |
| Offline verification | ✗ Requires vendor platform connectivity | ✓ 4 SDKs + WASM; fully offline capable |
| SCITT transparency anchoring | ✗ Not implemented in most compliance tools | ✓ RFC 9943 receipt format with Merkle inclusion proofs |
| eIDAS-qualified timestamps | ✗ Some offer timestamping; rarely qualified TSP | ✓ RFC 3161 format; qualified credentials transferred with sale |
Comparison reflects category-level capabilities. Dashboard/GRC tools excel at workflow automation and regulatory database management. TRAI focuses on cryptographic evidence generation at the output level. The approaches are complementary, not mutually exclusive.
What's production-ready, what needs buyer infrastructure, and known gaps. Transparency for informed due diligence.
132,000+ lines of code. 31 Rust crates. 4 SDKs. 2,775+ tests. SLSA L3 build attestation. F* formal proofs. Full IP assignment. No subscription. No vendor lock-in. A buyer should be able to understand the core system in an afternoon, operate a demo in a day, and decide what to productionize next.
TRAI provides technical evidence generation capabilities. It does not constitute legal advice, regulatory certification, or a substitute for independent compliance review. Buyers must validate regulatory applicability in their jurisdiction. Built to support Article 50 transparency workflows — not a substitute for legal compliance assessment.