Metadata-Version: 2.4
Name: trustatom
Version: 0.1.0
Summary: Verify Ed25519 signed TrustAtom decision receipts (ML-DSA-65 post-quantum gate planned)
Author-email: Cyber Warrior Network <apps@cyberwarriornetwork.com>
License-Expression: Apache-2.0
Project-URL: Homepage, https://cyberwarriornetwork.com
Project-URL: Documentation, https://github.com/CWNApps/openagentontology
Project-URL: Repository, https://github.com/CWNApps/trust-gate-mcp
Project-URL: Demo, https://cwn-trust-gate.onrender.com
Project-URL: MCP, https://mcp.so/server/trust-gate-mcp/Cyber-Warrior-Network
Keywords: trust,receipts,ed25519,post-quantum,ai-governance,decision-receipts,trustatom,agent-accountability
Classifier: Development Status :: 3 - Alpha
Classifier: Intended Audience :: Developers
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Topic :: Security :: Cryptography
Classifier: Topic :: Software Development :: Libraries
Requires-Python: >=3.10
Description-Content-Type: text/markdown
Requires-Dist: pynacl>=1.5.0

# trustatom

Verify Ed25519 signed TrustAtom decision receipts (ML-DSA-65 post-quantum gate planned).

A TrustAtom is a signed decision receipt: who decided, what policy governed, what
evidence supported it, when. This package verifies them. It does not mint them --
minting requires the Trust Gate backend with OPA policy evaluation and key management.

## Install

```bash
pip install trustatom
```

## Usage

```python
from trustatom import TrustAtom, verify_receipt

atom = TrustAtom(
    agent_id="analyst-01",
    action="tool_call:database_query",
    policy="opa://compliance/data-access-v2",
    decision="ALLOW",
    evidence={"role": "analyst", "scope": "read_only"},
    timestamp="2026-06-30T00:00:00Z",
    signature=signature_bytes,
    public_key=public_key_bytes,
    pq_cosig=pq_cosig_bytes,  # optional; required when TRUST_GATE_REQUIRE_PQ=1 (default)
)

assert verify_receipt(atom)
print(atom.receipt_id)  # 128-bit content address, sha256[:32]
```

## H3: PQ-required verify

By default, `verify_receipt` rejects any receipt missing `pq_cosig` (defends against
signature-stripping). Set `TRUST_GATE_REQUIRE_PQ=0` or pass `require_pq=False` to
accept legacy Ed25519-only receipts.

ML-DSA-65 cosignature verification itself is not yet implemented in this package --
it checks that `pq_cosig` is present, not that it cryptographically verifies. A real
ML-DSA-65 check ships when a NIST-compliant ML-DSA-65 Python library is available.

## Links

- [Trust Gate Demo](https://cwn-trust-gate.onrender.com)
- [TrustAtom Protocol Spec](https://github.com/CWNApps/openagentontology)
- [Trust Gate MCP](https://mcp.so/server/trust-gate-mcp/Cyber-Warrior-Network)

## License

Apache-2.0
