Metadata-Version: 2.5
Name: truassure
Version: 1.5.1
Summary: TruAssure: black-box, evidence-based quality engineering for AI agents (chat, task and multi-agent).
Author: Shan Konduru
License-Expression: MIT
License-File: LICENSE
Classifier: Development Status :: 5 - Production/Stable
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Topic :: Software Development :: Quality Assurance
Classifier: Topic :: Software Development :: Testing
Classifier: Typing :: Typed
Requires-Python: >=3.11
Requires-Dist: jsonschema>=4.21
Requires-Dist: pyyaml>=6.0
Provides-Extra: anthropic
Requires-Dist: anthropic>=0.40; extra == 'anthropic'
Provides-Extra: azure
Requires-Dist: openai>=1.40; extra == 'azure'
Provides-Extra: azure-blob
Requires-Dist: azure-identity>=1.15; extra == 'azure-blob'
Requires-Dist: azure-storage-blob>=12.19; extra == 'azure-blob'
Provides-Extra: chat
Requires-Dist: websockets>=12; extra == 'chat'
Provides-Extra: dev
Requires-Dist: build>=1.2; extra == 'dev'
Requires-Dist: fastapi>=0.115; extra == 'dev'
Requires-Dist: httpx>=0.27; extra == 'dev'
Requires-Dist: langgraph>=0.2; extra == 'dev'
Requires-Dist: mcp>=2.3; extra == 'dev'
Requires-Dist: mypy>=1.11; extra == 'dev'
Requires-Dist: psycopg[binary]>=3.2; extra == 'dev'
Requires-Dist: pymysql>=1.1; extra == 'dev'
Requires-Dist: pytest-asyncio>=0.24; extra == 'dev'
Requires-Dist: pytest-cov>=5.0; extra == 'dev'
Requires-Dist: pytest>=8.0; extra == 'dev'
Requires-Dist: ruff>=0.6; extra == 'dev'
Requires-Dist: sqlalchemy>=2.0; extra == 'dev'
Requires-Dist: starlette>=0.37; extra == 'dev'
Requires-Dist: types-jsonschema>=4.21; extra == 'dev'
Requires-Dist: types-pyyaml>=6.0; extra == 'dev'
Requires-Dist: uvicorn>=0.30; extra == 'dev'
Requires-Dist: websockets>=12; extra == 'dev'
Provides-Extra: kafka
Requires-Dist: confluent-kafka>=2.3; extra == 'kafka'
Provides-Extra: langgraph
Requires-Dist: langgraph>=0.2; extra == 'langgraph'
Provides-Extra: mcp
Requires-Dist: mcp>=2.3; extra == 'mcp'
Provides-Extra: mysql
Requires-Dist: pymysql>=1.1; extra == 'mysql'
Requires-Dist: sqlalchemy>=2.0; extra == 'mysql'
Provides-Extra: oracle
Requires-Dist: oracledb>=2.0; extra == 'oracle'
Requires-Dist: sqlalchemy>=2.0; extra == 'oracle'
Provides-Extra: otel
Requires-Dist: starlette>=0.37; extra == 'otel'
Requires-Dist: uvicorn>=0.30; extra == 'otel'
Provides-Extra: postgres
Requires-Dist: psycopg[binary]>=3.2; extra == 'postgres'
Requires-Dist: sqlalchemy>=2.0; extra == 'postgres'
Provides-Extra: proxy
Requires-Dist: httpx>=0.27; extra == 'proxy'
Requires-Dist: starlette>=0.37; extra == 'proxy'
Requires-Dist: uvicorn>=0.30; extra == 'proxy'
Provides-Extra: s3
Requires-Dist: boto3>=1.34; extra == 's3'
Provides-Extra: servicebus
Requires-Dist: azure-identity>=1.15; extra == 'servicebus'
Requires-Dist: azure-servicebus>=7.11; extra == 'servicebus'
Provides-Extra: sql
Requires-Dist: sqlalchemy>=2.0; extra == 'sql'
Provides-Extra: sqlserver
Requires-Dist: pyodbc>=5.1; extra == 'sqlserver'
Requires-Dist: sqlalchemy>=2.0; extra == 'sqlserver'
Description-Content-Type: text/markdown

# TruAssure

**Know what your AI agents actually did, not just what they said.**

TruAssure is a black-box, evidence-based quality engineering framework for AI agents: chat assistants, task
agents (LangGraph, OpenAI Agents SDK, custom loops) and multi-agent workflows. It judges every checkpoint on
independent evidence (the agent's tool calls as a recording proxy saw them, its handoffs, the data it changed)
and compares that with what the agent claims. It runs the same scenarios under injected faults, rephrasings and
repeats, and turns the results into release decisions.

```bash
pip install truassure                    # the ta / truassure commands and the library
pip install "truassure[mcp,proxy,otel]"  # plus the MCP server, the recording proxy and A2A tap, the OTel receiver
```

Python 3.11 or later, on Windows, Linux or macOS. MIT licence.

## Five minutes, offline

```bash
ta demo                               # the whole tour on a scripted agent: no Docker, no LLM, no network
ta console --runs-dir ta_demo --open  # browse the runs, reports, comparisons and gates
ta docs --open                        # the full guide, shipped inside the package
```

## Test your own agent

```bash
ta new task my-agent-tests            # or: ta new workflow ... / ta new chat ...
cd my-agent-tests                     # catalog.yaml, environment.py, truassure-gate.yaml, .env.example, README.md
ta validate catalog.yaml
ta run catalog.yaml --env environment:environment --repeats 3 --perturbations all
ta report latest
ta gate latest --policy truassure-gate.yaml
ta init --ci github --catalog catalog.yaml --env environment:environment   # or --ci azure
```

## Enterprise systems

```bash
pip install "truassure[postgres]"     # or [sqlserver], [mysql], [oracle], [sql] for SQLAlchemy alone
```

```python
from truassure.adapters.state.factory import make_state
from truassure.adapters.drivers.queue import QueueDriver, ServiceBusTransport
from truassure.profiles.task import task_environment


def environment(worker):
    return task_environment(
        name="claims",
        driver=QueueDriver(ServiceBusTransport.from_env(), request="claims-events", reply="claims-results"),
        state=[
            make_state("oracle+oracledb://reader:***@db:1521/?service_name=CLAIMS", schema="CLAIMS"),
            make_state("https://crm.test.example/api", resources={"cases": "/cases"}),
        ],
    )
```

Any SQL database SQLAlchemy supports, read-only, with tables and keys found by reflection. A factory picks the
adapter from a URL or path. There are drivers for HTTP, chat, OpenAI-compatible endpoints, Azure Service Bus and
Kafka. `ta library` lists reusable scenario packs (privacy, prompt injection, unsafe writes, payments and
approvals, identity across handoffs, conversation handling, answers and boundaries, tone and policy) that a catalog
includes with its own parameters; each tags its scenarios with catalogue test types.

## Across initiatives

```bash
pip install "truassure[s3]"           # or [azure-blob], or [postgres] etc. for a database store; a folder needs nothing
ta push                               # share the latest run (store, initiative and team in truassure.yaml)
ta run catalog.yaml --env environment:environment --publish
ta portfolio --store s3://quality-results/truassure --csv portfolio.csv
ta console --store s3://quality-results/truassure --open
```

The portfolio shows every initiative and project: the latest gate verdict, pass rate, pass^k, open defects by
severity, the trend, and each run's report. Nothing is shared without `ta push` or `--publish`.

The starter project connects to an agent behind HTTP. Put `ta proxy` in front of the agent's tools, and
`ta a2a` between its agents, to get an independent record of every call and handoff and to inject faults.

## How an agent is judged

Each checkpoint is judged at five stages, and TruAssure reports the first one that failed:

| Stage | Question |
|---|---|
| goal | Did it understand the request? |
| plan | Was its course sensible (steps, loops, handoffs, approvals before writes)? |
| action | Did it take only allowed, correct actions, with the right arguments, for the right person? |
| end state | Is the data right afterwards, and did nothing else change? |
| output | Is what it told the user true, complete and consistent with what it did? |

Seven **evidence seams** (SE-01 to SE-07) catch the failures an agent's own account hides. Examples: a call it
reported that never happened, a write it never mentioned, success announced after a failure, a handoff that
carries another customer's identity, and a different deployment that behaves differently.

## What you get

- **Profiles:** conversational, task and workflow (handoffs, identity on every hop, failure containment).
- **Reliability:** repeats and perturbations, pass^k, robustness and flaky detection, plus fault injection in
  the tool server's own format.
- **Change:** run-by-run comparison, and deployment parity (model, host, framework) judged against
  run-to-run noise.
- **Governance:**
  - defect lists (JSON and CSV) and JUnit for CI;
  - capability packs and a release gate with per-capability thresholds;
  - a 71-type test scorecard, with each type's catalogue metrics measured or marked not measured;
  - grader calibration (Cohen's kappa), and rubric grading for tone and written policy.
- **Reports:** a customer-facing execution report (`execution-report.html` and `.json`): a readiness statement,
  KPI cards and charts, test-type and test-data coverage, persona views, findings with evidence and next actions,
  and the trend against the previous comparable run; personal details masked. Plus the one-file engineering report.
- **Sharing:** a local token-protected console and a shared store across initiatives.
- **Automation:** `ta mcp` gives an AI assistant one tool per command. GitHub Actions and Azure DevOps
  templates come from `ta init`.
- **Security defaults:**
  - listeners bind to 127.0.0.1 and need tokens;
  - secrets come only from the environment or `.env` and are never printed;
  - personal data is masked before evidence is stored, and retention is enforced.

## Commands

| Command | Purpose |
|---|---|
| `demo`, `new`, `docs` | The offline tour, a starter project, the guide |
| `library` | The scenario library: list packs, show one, add it to a catalog |
| `push`, `pull`, `portfolio` | Share runs to a folder, S3 or Azure Blob store; copy them back; the cross-initiative view |
| `validate`, `translate` | Check catalogs; convert a suite catalog |
| `run`, `show`, `report`, `gc` | Run a catalog; inspect runs; the engineering and execution reports; retention |
| `compare`, `defects`, `junit`, `scorecard`, `pack`, `gate`, `calibrate` | Run-level analysis and governance |
| `init` | A CI pipeline that runs, reports and gates |
| `console`, `mcp` | The browser console; the MCP server |
| `proxy`, `a2a`, `otel` | Observers: recording MCP proxy, agent-to-agent tap, OpenTelemetry receiver |

`ta <command> --help` lists every option. Examples use fictitious data (Harbor Mutual).
