aat-verify

Standalone reference verifier for the Agent Audit Trail Internet-Draft (draft-sharif-agent-audit-trail).

It checks a JSONL audit trail offline, from the records and public keys alone, with no access to the producing agent. That is the point: an auditor, regulator, or court can verify what an agent did without trusting or contacting the agent.

Install

pip install "aat-verify[pqc]"

The [pqc] extra adds post-quantum (ML-DSA-65 / FIPS 204) verification. Plain pip install aat-verify verifies classical (ES256) records only.

Use

aat-verify trail.jsonl --keys keystore.json

Machine-readable output:

aat-verify trail.jsonl --keys keystore.json --json

Exit code is 0 if every check passes, 1 if any check fails.

What it checks (draft -04)

• Hash-chain integrity (SHA-256 over each record, batch excluded)
• Signatures: ES256 (ECDSA P-256), ML-DSA-65 (FIPS 204), and hybrid, with the signing key resolved by signer_kid (RFC 7638 thumbprint)
• Independent recording on consequential actions (recorder key differs from the agent key)
• Attributable trust downgrades (trust_assignment)
• Monotonic timestamps
• Merkle batch inclusion (RFC 6962 construction, detached anchor)

Keystore format

A JSON object mapping each signer_kid to a public key:

{
  "<ec-thumbprint>":  { "alg": "ES256", "jwk_x_y": { "x": "...", "y": "..." } },
  "<mldsa-kid>":      { "alg": "ML-DSA-65", "pk": "<base64url public key>" }
}

Public keys only. The verifier never needs, accepts, or stores private keys.

License

Business Source License 1.1 (converts to Apache-2.0 on the Change Date). See LICENSE. (c) 2026 CyberSecAI Ltd, Raza Sharif.