Metadata-Version: 2.4
Name: daleeq-provenance
Version: 0.1.0
Summary: Cryptographic action provenance SDK for Daleeq
Project-URL: Homepage, https://github.com/hassansh111/Shadow-Sec-AI/tree/main/sdk/python
Project-URL: Documentation, https://github.com/hassansh111/Shadow-Sec-AI/blob/main/sdk/python/README.md
Project-URL: Repository, https://github.com/hassansh111/Shadow-Sec-AI
Author-email: Daleeq Team <security@shadowsec.ai>
License: Apache-2.0
Classifier: Development Status :: 3 - Alpha
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: Apache Software License
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Topic :: Security
Requires-Python: >=3.11
Requires-Dist: cryptography>=42.0
Requires-Dist: httpx>=0.27
Provides-Extra: dev
Requires-Dist: pytest-asyncio>=0.23; extra == 'dev'
Requires-Dist: pytest-cov>=4.1; extra == 'dev'
Requires-Dist: pytest>=8.0; extra == 'dev'
Description-Content-Type: text/markdown

# shadowsec-provenance

Cryptographic action-provenance SDK for **Daleeq** — sign agent actions, observe
agent calls, and **independently verify Daleeq receipts offline with zero backend
access**.

A Daleeq *receipt* is an Ed25519-signed record of one event in the proof loop
(`detect → reproduce → retest → prove`). This package lets a buyer, auditor, or
any third party confirm a receipt is authentic and unmodified using only the
open-source verifier, a published public key, and the receipt JSON — **no Daleeq
backend, no database, no account.**

## Install

```bash
pip install shadowsec-provenance
```

The only runtime dependencies are `cryptography` and `httpx`.

## Verify a receipt offline (the headline guarantee)

This package installs a console script, `daleeq-verify-receipt`:

```bash
# Verify the shipped sample receipt → "RECEIPT VERIFIED", exit 0.
daleeq-verify-receipt receipt.json --pubkey published.pub

# Machine-readable result + walk the full lineage chain.
daleeq-verify-receipt receipt.json --registry keys.json --chain chain.json --json
```

Exit codes: `0` valid · `1` invalid/tampered/wrong-key/broken-chain · `2` key
could not be loaded · `3` bad input. See [`VERIFY.md`](VERIFY.md) for the full
walkthrough (including the deliberately-tampered sample that proves the verifier
checks bytes, not rubber-stamps) and [`RECEIPT-SCHEMA.md`](RECEIPT-SCHEMA.md) for
the open wire-format spec an independent implementer can reproduce.

## Importable API

```python
from shadowsec_provenance import (
    sign_action,                 # sign an agent action → Receipt
    verify_receipt,              # verify a receipt
    verify_receipt_standalone,   # offline, zero-backend verification (MOAT-13)
    observe,                     # telemetry decorator for agent calls
    wrap_anthropic, wrap_openai, # provider client wrappers
)
```

The full public surface is enumerated in `shadowsec_provenance.__all__`.

## What a valid signature does and does NOT prove

A `RECEIPT VERIFIED` result proves the signed fields are byte-for-byte unmodified
since signing and were signed by the holder of the named key. It does **not**
prove the underlying detection/verdict was correct — the signature authenticates
the *claim*, it does not validate the claim's truth. The CLI prints this
`NOT asserted` boundary on every run.

## License

Apache-2.0.
