trustatom

Verify Ed25519 signed TrustAtom decision receipts (ML-DSA-65 post-quantum gate planned).

A TrustAtom is a signed decision receipt: who decided, what policy governed, what evidence supported it, when. This package verifies them. It does not mint them -- minting requires the Trust Gate backend with OPA policy evaluation and key management.

Install

pip install trustatom

Usage

from trustatom import TrustAtom, verify_receipt

atom = TrustAtom(
    agent_id="analyst-01",
    action="tool_call:database_query",
    policy="opa://compliance/data-access-v2",
    decision="ALLOW",
    evidence={"role": "analyst", "scope": "read_only"},
    timestamp="2026-06-30T00:00:00Z",
    signature=signature_bytes,
    public_key=public_key_bytes,
    pq_cosig=pq_cosig_bytes,  # optional; required when TRUST_GATE_REQUIRE_PQ=1 (default)
)

assert verify_receipt(atom)
print(atom.receipt_id)  # 128-bit content address, sha256[:32]

H3: PQ-required verify

By default, verify_receipt rejects any receipt missing pq_cosig (defends against signature-stripping). Set TRUST_GATE_REQUIRE_PQ=0 or pass require_pq=False to accept legacy Ed25519-only receipts.

ML-DSA-65 cosignature verification itself is not yet implemented in this package -- it checks that pq_cosig is present, not that it cryptographically verifies. A real ML-DSA-65 check ships when a NIST-compliant ML-DSA-65 Python library is available.

Links

• Trust Gate Demo
• TrustAtom Protocol Spec
• Trust Gate MCP

License

Apache-2.0