eve-governance — EVE Governance SDK

Offline cryptographic governance verification for EVE AI Core enterprise artifacts. Verify HMAC-SHA256 signed governance artifacts without calling EVE's servers.

Installation

pip install eve-governance

Quick start

from eve_governance import (
    verify_decision_certificate,
    verify_chain,
    verify_iti_snapshot,
    health_band,
    load_replay_chain,
    analyze_replay_chain,
)

# Verify a single CoreGuard decision certificate
result = verify_decision_certificate(cert_dict)
print(f"Valid: {result.valid}")

# Verify a JSONL audit chain
events = load_replay_chain("audit_chain.jsonl")
chain_result = verify_chain(events)
print(f"Chain valid: {chain_result.valid}, gaps: {chain_result.gap_count}")

# Verify an ITI snapshot
iti = verify_iti_snapshot(snapshot_dict)
print(f"Score: {iti.composite_score}, band: {iti.health_band}")

# Health band classification
print(health_band(87.5))  # -> GOOD

CLI

# Verify a replay bundle
eve-gov verify-bundle export.zip

# Verify a decision certificate
eve-gov verify-decision cert.json

# Verify a deployment attestation
eve-gov verify-attestation attestation.json --key-env MY_SIGNING_KEY

# Verify an ITI snapshot
eve-gov verify-iti snapshot.json --json

# Verify a JSONL audit chain
eve-gov verify-chain audit.jsonl

# Human-readable replay summary
eve-gov replay-summary audit.jsonl

Signing

All artifacts use HMAC-SHA256 with this canonical form:

import hmac, hashlib, json
key = os.environ["JWT_SECRET_KEY"].encode()
canonical = json.dumps(payload, sort_keys=True, separators=(",", ":")).encode()
signature = hmac.new(key, canonical, hashlib.sha256).hexdigest()

Environment variables

Ed25519 decision-evidence verification (verify_decision_evidence) needs no secret — only the published public key from GET /.well-known/eve-pubkey.

License

Proprietary — EVE NeuroSystems LLC