SRT-1 Docs

SRT-1 is a 7-stage codebase intelligence pipeline that produces a verified Code Manifest. It gives any AI assistant a ground-truth map of your codebase — with every function tagged by architectural role and risk profile.

Start with the Quickstart to get indexed in under a minute, then read the Architecture guide to understand the pipeline stages.

Guides

⚡ Quickstart

Get your first verified Code Manifest in under 60 seconds.

1. Install

pip install srt1-core

2. Index your repository

srt1-index --repo_path /path/to/your/repo

3. Verify the manifest

from srt1_code_indexer import SRT1CodeIndexer

indexer = SRT1CodeIndexer(repo_path=".")
manifest = indexer.index_repository()

# Check the manifest integrity
print(manifest["integrity"]["manifest_hash"])  # SHA-256 hash

The indexer produces three outputs:

• code_manifest.json — The complete codebase intelligence map
• AGENTS.md — AI context file (auto-consumed by Cursor, Copilot, Claude)
• CLAUDE.md / .cursorrules — Tool-specific context files

🏗️ Architecture

The SCIA (Seed-Class Intelligence Architecture) pipeline processes your repository through 7 deterministic stages. Each stage produces a cryptographically chained output.

🔐 Trust Layer

Every Code Manifest includes a cryptographic trust chain that proves the manifest was produced by a clean, uninterrupted pipeline run.

Trust Chain Structure

Each pipeline stage appends a chained SHA-256 hash to the trust chain. The final signature combines all 7 stage hashes into a single verifiable root.

# Verify a manifest's integrity
import json, hashlib

manifest = json.load(open("srt1_code_manifest.json"))
integrity = manifest["integrity"]
print(integrity["manifest_hash"][:16])  # Integrity hash

Integrity Verification

Every artifact produced by SRT-1 carries an integrity hash — a SHA-256 digest of the full content. If any component has been modified, the hash will not match, detecting tampering or drift.

📖 API Reference

SRT1CodeIndexer

The main class for indexing repositories.

SRT1CodeIndexer(repo_path: str)

# Methods
.index_repository()     # Run full 7-stage pipeline, return verified manifest

# The manifest dict contains:
manifest["metadata"]           # File counts, symbol counts, timestamps
manifest["file_manifest"]      # SHA-256 hashes for every file
manifest["symbol_table"]       # Classes, functions, dependencies
manifest["curation_report"]   # Duplicates and overlaps
manifest["reflections"]       # Role + risk tags per symbol
manifest["trust_chain"]       # 7-stage SHA-256 chain
manifest["integrity"]        # SHA-256 integrity verification

CLI Flags

📱 Mobile PWA

SRT-1 includes a Progressive Web App that lets you monitor your codebase, plant seeds, and view coherence scores from your phone.

Setup

1. Start the SRT-1 middleware: srt1-code-indexer --repo_path .
2. Open on your phone (same network)
3. Tap "Install App" to add to your home screen
4. Generate a remote auth token from the Admin Dashboard for secure access

The mobile PWA works offline for seed planting and caches the latest coherence snapshot. Live data syncs when connectivity is restored.

🧠 AI Context Injection

When SRT-1 indexes your codebase, it generates context files that give any AI assistant complete comprehension of your repository — without re-reading every file.

Generated Files

What the Context Contains

Each context file is identical — the same document generated from the manifest. It contains:

• Project Synopsis — plain-English description of the entire codebase
• Codebase Map — every class and function with line numbers, parameters, and docstrings
• Call Flow — cross-file call chains showing who calls what
• Risk Tags — AUTH_SENSITIVE, FILE_IO, WRITES_TO_DB on every symbol
• Curation Warnings — duplicate functions, overlapping code that AI must not recreate
• Enforcement Blocks — active violations AI must resolve before proceeding

When an AI assistant reads this context, it immediately knows your full architecture, patterns, and constraints — without scanning every file. This is the anti-hallucination layer.

🔏 Signing (SeedSignature)

Every artifact produced by SRT-1 is signed by the SeedSignature authority — a standalone cryptographic signing service. Signing provides tamper-proof provenance: proof of what was produced, when, and by whom.

How It Works

SRT-1 calls the signing service through SigningServiceClient from the scia_security package. The service URL is configured via environment variable — no hardcoded references.

from scia_security.signing_client import SigningServiceClient

client = SigningServiceClient(os.environ["SCIA_SIGNING_SERVICE_URL"])
result = client.sign({"code_index": "abc123"}, phase="production")

What Gets Signed

Signature Envelope

Each signed artifact receives a sealed envelope containing a composite SHA-256 hash (content + semantic + timestamp), a unique SCIA-[hash] signature ID, and a chain link to the previous signature. The signing authority verifies via a three-pillar model: content integrity, registry presence, and digest validation.

📦 SCIA Packages

SRT-1 is built on two foundational packages from the Seed-Class Intelligence Architecture. These are shared infrastructure used across all tiers — SRT-1 Core, Seed Reflections, and SRT-1 Enterprise.

scia_security

The security and provenance layer. Provides:

scia_memory

The memory and intelligence layer. Provides:

Tier Access

⚡ Engine API (Port 7483)

The SRT-1 engine exposes a local HTTP API on port 7483. The developer dashboard and mobile PWA communicate through these endpoints.

GET Endpoints

POST Endpoints

All enforcement responses include a _provenance field when the signing service is connected — cryptographic proof of the action.