squash-ai 3.1.0

The pytest of AI compliance. Runs in your CI/CD pipeline. Ships in 10 seconds.

⏰ EU AI Act high-risk enforcement: August 2, 2026

Non-compliance: up to €35M or 7% of global turnover. Annex IV documentation alone takes 3–6 months manually. Squash does it in 10 seconds.

v3.0.0 — Bulletproof Edition

Every Tier-0/1 attestation is byte-identical on rerun. Every signed payload flows through RFC 8785 canonical JSON. Every cert ID is keyed on the input (UUIDv5, never UUIDv4). Every clock is injectable. Every release wheel + Docker image carries SLSA Build Level 3 provenance. The full chain — input manifest → canonical body → Ed25519 → RFC 3161 trusted timestamp → SLSA — is verifiable end-to-end via squash self-verify.

squash demo --walkthrough     # 10-section Bulletproof tour
squash demo --server          # interactive HTML demo at localhost:8002
squash self-verify -d ./out   # walk the chain on any attestation

See CHANGELOG.md §3.0.0, AUDIT_BASELINE.md, TIER_MAP.md, and demo/ for the full surface.

See it in 10 seconds

pip install squash-ai
squash demo

────────────────────────────────────────────────────
  Squash violations, not velocity.
  Running demo attestation on sample BERT model…
────────────────────────────────────────────────────

  Model:   bert-base-uncased (sample)
  Policy:  eu-ai-act

✅ Attestation PASSED

  Artifacts generated:
    cyclonedx-mlbom.json                   48,392 bytes
    sbom.spdx.json                         22,104 bytes
    attestation.json                        3,841 bytes
    annex-iv-technical-documentation.md    18,299 bytes
    provenance.json                         1,203 bytes

────────────────────────────────────────────────────
  This is squash. It runs in CI in <10 seconds.
  pip install squash-ai && squash attest ./your-model
────────────────────────────────────────────────────

Install

# Community (free, Apache 2.0)
pip install squash-ai

# With REST API server
pip install "squash-ai[api]"

# Full feature set
pip install "squash-ai[api,signing,sbom]"

CI/CD in one line

GitHub Actions

- uses: konjoai/squash@v1
  with:
    model-path: ./my-model
    policy: eu-ai-act
    fail-on-violation: true

GitLab CI

include:
  - remote: 'https://raw.githubusercontent.com/konjoai/squash/main/integrations/gitlab-ci/squash.gitlab-ci.yml'

CLI

squash attest ./my-model \
  --policy eu-ai-act \
  --policy nist-ai-rmf \
  --sign \
  --fail-on-violation

Output:

✓ CycloneDX 1.7 ML-BOM            → cyclonedx-mlbom.json
✓ SPDX 2.3 SBOM                   → sbom.spdx.json
✓ EU AI Act Annex IV: PASS        → annex-iv.md
✓ NIST AI RMF: PASS (42/42)
✓ OWASP LLM Top 10: PASS
✓ SLSA Level 2 provenance         → provenance.json
✓ ModelScan: PASS (0 findings)
✓ Signed via Sigstore Rekor

Why Squash

Features

Set up a new project in 60 seconds

squash init ./my-model
# Auto-detects PyTorch / TensorFlow / JAX / MLflow / HuggingFace
# Writes .squash.yml, runs a dry-run attestation

Compliance badge in your README

![Squash EU AI Act compliant](https://api.getsquash.dev/badge/eu-ai-act/compliant)

Available statuses: compliant · non-compliant · partial · unknown
Available frameworks: eu-ai-act · nist-ai-rmf · iso-42001 · anything

Policy Frameworks

Python API

from squash import AttestPipeline, AttestConfig

result = AttestPipeline.run(AttestConfig(
    model_path="./my-model",
    policies=["eu-ai-act", "owasp-llm"],
    sign=True,
    fail_on_violation=True,
))

print(f"Passed: {result.passed}")
print(f"Attestation ID: {result.attestation_id}")

REST API

pip install "squash-ai[api]"
uvicorn squash.api:app --host 0.0.0.0 --port 4444

curl -X POST http://localhost:4444/v1/attest \
  -H "Authorization: Bearer $SQUASH_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model_path": "/models/bert-base", "policies": ["eu-ai-act"]}'

Prometheus metrics

# HELP squash_attestations_total Total attestation runs
squash_attestations_total{result="passed",policy="eu-ai-act"} 142
squash_models_compliant_ratio 0.979
squash_api_latency_seconds_bucket{le="0.1"} 138

Tiers & Pricing

Start free → · Pricing →

Architecture

squash attest ./my-model
    │
    ├── ModelScanner      → Security scan (pickle, unsafe ops, CVEs)
    ├── CycloneDXBuilder  → ML-BOM (CycloneDX 1.7)
    ├── SpdxBuilder       → SBOM (SPDX 2.3)
    ├── PolicyEngine      → EU AI Act · NIST · OWASP · ISO checks
    ├── SlsaBuilder       → SLSA Level 1–3 provenance
    ├── AnnexIVGenerator  → All 12 Annex IV sections (MD/HTML/PDF)
    ├── VexEvaluator      → Live CVE vulnerability feed
    ├── OmsSigner         → Sigstore keyless signing
    ├── DriftDetector     → Baseline behavioral comparison
    └── AttestPipeline    → Signed audit record (JSON)

Development

git clone https://github.com/konjoai/squash
cd squash
pip install -e ".[api,signing,sbom,dev]"

# Run all tests (2,299 passing)
python -m pytest tests/ -v --timeout=120

# Try it immediately
squash demo

# Watch mode
squash watch ./my-model

License

Community edition: Apache 2.0

Enterprise features (cloud API, multi-tenant dashboard, VEX feed, on-premise) are available under a commercial license. Contact →

Built by Konjo AI · "Squash violations, not velocity."