Acquisition Brief
What you receive, what you don't, and how the transfer works.
What the Buyer Receives
| Category | Contents |
|---|---|
| Source code | 31 Rust workspace members (30 crates + 1 binary), Python FastAPI control plane, 4 SDKs (Python, Python-light, TypeScript, Go), web frontend |
| Documentation | Architecture, honest state, compliance maps, threat model, STRIDE analysis, data room docs |
| CI/CD | GitHub Actions workflows, SLSA Build L3 attestation, OpenSSF Scorecard + Best Practices badge |
| Audit artifacts | Smoke test fixtures, STRIDE threat model, spec facts audit, phase reports |
| Infrastructure config | .env.example, Fly.io deployment, AWS KMS integration, PostgreSQL schema + Alembic migrations |
| SDKs + WASM | @trai/core (npm), trai (PyPI), Go SDK, tl-wasm browser verification bundle (108KB) |
What is NOT Included
| Exclusion | Rationale |
|---|---|
| Brand, marks, or domain names | Source-only sale; buyer rebrands entirely. No "TRAI" or "TrustLayer" marks transferred. |
| HSM/KMS credentials | AWS KMS / Thales Luna key lifecycle requires buyer's own cloud accounts and compliance posture |
| Qualified TSP credentials | Actalis Italia, DigiCert, Sectigo accounts are buyer's responsibility to provision |
| Legal advice | TRAI is technical infrastructure; legal counsel is buyer's responsibility |
| Regulatory certification | No ISO 42001, SOC 2 Type II, or qualified TSP certification -- these require operating history and external audit |
| Customer contracts | No existing customer agreements -- pre-revenue product |
| Revenue | Pre-revenue; no existing revenue streams or billing infrastructure |
| Trademark registration | TRAI name/brand used but not registered as a trademark; NOT transferred in sale |
| Entity formation | Individual ownership; no legal entity currently holds IP |
| Production transparency log | SCITT receipt format implemented; live transparency log anchoring is a roadmap item |
Transfer Process
Sale model
This is a source-only, rebrand-ready sale. The buyer receives the full source code repository under an exclusive IP assignment (Asset Purchase Agreement). No brand, marks, domain names, or domain registrations are transferred. The buyer must rebrand entirely.
| Asset | Transferred? | Notes |
|---|---|---|
| Source code (all crates, SDKs, control plane) | Yes | Exclusive IP assignment via APA |
| Tests + CI/CD | Yes | Full reproducibility |
| Documentation + data room | Yes | Architectural decisions, compliance mappings |
| Brand / marks / "TRAI" name | No | Buyer rebrands |
| Domain names | No | Buyer provisions own domain |
| npm / PyPI / crates.io package names | No | Buyer publishes under own names |
| Qualified TSP credentials | No | Buyer provisions own accounts |
| HSM/KMS keys | No | Buyer provisions own keys |
Knowledge transfer
- All architectural decisions documented in
docs/ARCHITECTURE.md - All known gaps documented in
docs/HONEST_STATE.mdanddocs/KNOWN_LIMITATIONS.md - All compliance mappings in
docs/compliance_maps/ - Threat model in
audit_artifacts/threat_model/ - Maintainer guide in
docs/MAINTAINER_GUIDE.md
Known Limitations
TRAI's limitations are documented transparently. Every item below is
independently verifiable against cargo test, git log,
or the source code.
| Limitation | Details | Target |
|---|---|---|
| Dev default is Ed25519-only | ML-DSA-65 hybrid signing requires external HSM/KMS (AWS KMS or Thales Luna). Dev EphemeralEd25519Signer is NOT for production. | Q4 2026 |
| FreeTSA is NOT qualified | Dev/staging timestamps use FreeTSA (NOT qualified). Qualified TSP (Actalis Italia, DigiCert, Sectigo) requires external credentials. | Q4 2026 |
| SCITT is NOT live | Receipt format with Merkle inclusion proofs is implemented; production transparency log anchoring is a roadmap item. | Q4 2026 |
| Text-only scope | Art. 50(3) watermarking for images/audio/video not yet implemented. | v1.1.1+ |
| Single-tenant DB | Multi-tenant isolation is at the application layer; database-level multi-tenancy requires v1.2+. | v1.2+ |
| C2PA is a stub | tl-watermark::C2paWatermark is an empty struct; no /v1/c2pa/verify endpoint. | v1.1.1+ |
| Bus factor = 1 | Lead maintainer is the only person with write access. Co-maintainer expected Q3 2026. | Q3 2026 |
| No SOC 2 / ISO 42001 | Requires 6-12 months of operating history + external audit. | Q1 2027 |
Verification Checklist
# 1. Clone and build
git clone https://github.com/SuarezPM/trai
cd trai
make build
# 2. Run full test suite
cargo test --workspace --no-fail-fast
# 3. Python tests
cd services/control_plane && pytest tests/
# 4. Lint gates
ruff check
cargo clippy --workspace --all-targets -- -D warnings
# 5. End-to-end smoke test
bash services/control_plane/scripts/run_first_real_cert.sh
# 6. Demo (local)
make demoTRAI provides technical evidence generation capabilities. It does not constitute legal advice, regulatory certification, or a substitute for independent compliance review. Buyers must validate regulatory applicability in their jurisdiction. All claims in this brief are independently verifiable against the source code and test suites.