Metadata-Version: 2.4
Name: crovia-tacet
Version: 0.5.1
Summary: Reference implementation of TACET: verifiable silence proofs for AI training disclosure (Crovia Trust)
Author-email: Crovia Trust <info@croviatrust.com>
License: Apache-2.0
Project-URL: Homepage, https://croviatrust.com
Project-URL: Specification, https://croviatrust.com/registry/tacet/spec/
Project-URL: Source, https://github.com/croviatrust/countersign/tree/main/tacet
Project-URL: Internet-Draft, https://datatracker.ietf.org/doc/draft-crovia-tacet/
Keywords: ai,transparency,eu-ai-act,merkle,non-inclusion,provenance,crovia,pnx,non-exfiltration,ai-agents,dlp,litellm
Classifier: Development Status :: 3 - Alpha
Classifier: Intended Audience :: Developers
Classifier: Intended Audience :: Legal Industry
Classifier: License :: OSI Approved :: Apache Software License
Classifier: Programming Language :: Python :: 3
Classifier: Topic :: Security :: Cryptography
Requires-Python: >=3.10
Description-Content-Type: text/markdown
Requires-Dist: cryptography>=41.0.0
Provides-Extra: seal
Requires-Dist: crovia-seal>=0.5.0; extra == "seal"
Provides-Extra: litellm
Requires-Dist: litellm!=1.107.0,!=1.82.7,!=1.82.8,>=1.40; extra == "litellm"
Provides-Extra: test
Requires-Dist: pytest>=7.0; extra == "test"

# crovia-tacet (reference implementation)

Reference Python implementation of [TACET](../../SPEC.md): sparse Merkle map,
epoch sheets, surface snapshots, delta-encoded silence proofs, and delivery as
an unmodified `crovia.seal.v1`.

Dependencies: `cryptography` (Ed25519). The Seal wrapper additionally needs the
Crovia Seal reference package (`crovia_seal`).

```bash
pip install -e .
python3 -m pytest
```

## PNX command line

`pip install crovia-tacet` also installs `tacet-pnx`, the Proof of
Non-Exfiltration tool (profile `crovia.pnx.v1`, see `../../PNX.md`):

```bash
tacet-pnx keygen  --id urn:example:pnx:witness --out witness.key.json
tacet-pnx witness egress/ logs/gateway.jsonl --run-id run-42 --key witness.key.json \
                  --sheet run.sheet.json --state run.state.json      # state is private
tacet-pnx prove   --state run.state.json --sheet run.sheet.json \
                  --asset api_key=secret.txt --assets-dir protected/ --asset-env OPENAI_API_KEY \
                  --out pnx.proof.json [--seal-key issuer.key.json]  # deliver as crovia.seal.v1
tacet-pnx verify  pnx.proof.json --asset api_key=secret.txt --assets-dir protected/
```

Where the run connected (the reach record, PNX §4a) is added at witness time
from a connection log and checked against the policy document:

```bash
tacet-pnx witness egress/ --reach logs/connect.jsonl --policy egress-policy.json \
                  --reach-mode enforce [--reach-salted] ...                  # one {"at","host","port",...} per line
tacet-pnx verify  pnx.proof.json --policy egress-policy.json [--name api.github.com]
tacet-pnx verify  run.sheet.json --policy egress-policy.json   # a sheet alone: reach receipt, no asset judged
```

Exit codes: 0 valid and every asset absent (or a sheet alone) · 1 valid but present, undetectable,
partial or outside-policy · 2 invalid. The GitHub Action `croviatrust/pnx-action` wraps the same
three steps for CI (`../../action/`).

## PNX witness for LiteLLM

`tacet.integrations.litellm` turns LiteLLM (SDK or proxy) into a PNX egress
witness: every request about to leave for a model provider is appended, as the
exact provider request body, to a capture log that `tacet-pnx witness` reads.

```python
import litellm
from tacet.integrations.litellm import PNXEgressLogger
litellm.callbacks = [PNXEgressLogger("pnx/egress.jsonl")]
```

```yaml
# LiteLLM proxy config.yaml (log path from PNX_EGRESS_LOG, default pnx/egress.jsonl)
litellm_settings:
  callbacks: tacet.integrations.litellm.pnx_egress_logger
```

```bash
tacet-pnx witness pnx/egress.jsonl --run-id run-42 --key witness.key.json --sheet run.sheet.json --state run.state.json
tacet-pnx prove   --state run.state.json --sheet run.sheet.json --asset-env STRIPE_KEY --asset customers=customers.csv --out pnx.proof.json
```

The capture log contains what left, so it is as private as the witness state.
Traffic that does not go through LiteLLM (tool calls, shell, browser) is outside
this witness (PNX §7); pair it with `re proxy --pnx` for those.

