# TRAI — Cryptographic Evidence Platform for AI Compliance

> Technology for Risk & Audit Infrastructure

> Post-quantum cryptographic evidence platform for AI-generated content. EU AI Act Art. 50 ready. Source-only technical IP acquisition — proprietary license, full IP transfer on sale.

* Live Demo: https://trai.apohara.io

* Source Artifact: Available for qualified buyers (request access via listing platform)

---

## Product Overview & Value Proposition

TRAI issues, timestamps, and independently verifies tamper-evident evidence packages using FIPS 204-aligned post-quantum hybrid cryptography. It solves a direct regulatory imperative:

* EU AI Act Article 50 (enforcement deadline: August 2, 2026) requires enterprises deploying AI systems to provide verifiable transparency disclosures.

* Non-Compliance Penalty: Up to €15M or 3% of global annual turnover.

> Acquisition Model: This is a pre-revenue, source-only technical IP acquisition distributed under a proprietary license. Clean solo-developer IP with zero existing customers, zero revenue, and zero debt.

---

## Key Metrics

All metrics are independently verifiable against the source code artifact:

| Metric | Value | Verification Path |

| :--- | :--- | :--- |

| Rust Workspace Members | 31 (30 crates + 1 binary) | Cargo.toml |

| SDKs | 7 native SDKs (Go, Kotlin/JVM, Python, Python-light, Ruby, Swift, TypeScript) + WASM bundle | docs/BUYER_PACKAGE.md |

| MCP Tools | 37 tools (7 legacy v1 in main.rs + 30 v2 in tools/) | crates/tl-mcp-server/src/main.rs |

| Rust Test Annotations | 1,496 #[test] annotations across 211 files | README.md |

| Python Test Files | 94 test files | README.md |

| Commit History | 786 commits in seller repository (source-only delivery archive does not include .git directory) | docs/BUYER_PACKAGE.md |

| Formal Proofs | **4 F* proof files** (COSE_Sign1, BLAKE3, Merkle consistency) + 1 Vale proof for Ed25519 | formal/fstar-cose-sign1/MerkleProofs.fst |

| Fuzz Targets | 5 fuzz targets (libFuzzer + cargo-fuzz) | README.md |

| CI/CD Workflows | 19 workflows (SLSA Build Level 3 attestation) | .github/workflows/badge.yml |

| API Endpoints | 45 endpoints (33 v1 + 12 v2 compat shadow, FastAPI async) | services/control_plane/app/main.py |

| WASM Bundle | 108KB browser-native verification engine | crates/tl-wasm/Cargo.toml |

---

## Technical Architecture

### Rust Core (83K LOC across 31 workspace members)

#### Key Crates

* trai-evidence: Core evidence engine featuring a hybrid Ed25519 + ML-DSA-65 signature scheme with multi-stage envelope verification (COSE, timestamp binding, key registry, SCITT anchor) in crates/trai-evidence/src/cose.rs.

* trai-orchestrator: 10-state async workflow engine with per-tenant DashMap state and BAAAR halt semantics in crates/trai-orchestrator/.

* trai-sandbox: Anti-bypass command parser, double-fork/pipe/thread isolation, combined with seccomp + Landlock in crates/trai-sandbox/.

* trai-orch-protocol: Internal protocol definitions in crates/trai-orch-protocol/.

* themis-compliance: Regulatory compliance mapping engine (EU AI Act, DORA, NIS-2, ISO 42001, NIST AI RMF) in crates/themis-compliance/.

* tl-mcp-server: Model Context Protocol server (37 tools for Claude, Cursor, Codex integration) in crates/tl-mcp-server/.

#### Core Cryptographic Capabilities

* Ed25519 + ML-DSA-65 hybrid signing hybrid-ed25519-mldsa65-jcs-2026 cryptosuite) aligned with NIST FIPS 204.

* COSE_Sign1 / RFC 9052 envelope formatting in crates/trai-evidence/src/cose.rs.

* BLAKE3 canonical hash chaining.

* RFC 3161 timestamping (eIDAS-oriented).

* RFC 9943 SCITT receipt format with RFC 9162 Merkle inclusion proofs in crates/tl-scitt/.

* Code Quality: Zero todo!() or unimplemented!() stubs in core crates; #![deny(clippy::unwrap_used)] enforced; unsafe code strictly confined to the seccomp sandbox.

Complete *STRIDE** threat model included THREAT_MODEL.md).

---

### Python Control Plane (~67K LOC Total)

* Architecture: FastAPI async with 45 production REST API endpoints (33 v1 + 12 v2 compat shadow) in services/control_plane/app/main.py.

* Persistence: SQLAlchemy 2.0 async on PostgreSQL 16 with Alembic migrations and append-only audit logging.

* Multi-Tenant Isolation: JWT org resolution where unauthorized cross-tenant queries return 404 Not Found (never 403), preventing tenant enumeration.

* HSM Failover: Multi-provider failover supporting 5 major Hardware Security Module backends (AWS KMS, Azure Key Vault, GCP Cloud KMS, YubiHSM, Thales Luna) with fail-closed/circuit-open handling in services/control_plane/app/hsm_failover.py.

* Standards: Strict ruff and mypy enforcement.

---

### Frontend UI (~21K LOC)

* Stack: Astro 7 + Svelte 5 + Tailwind CSS in web/.

* Client Crypto Engine: Live WASM execution pipeline running native SHA-256 and Ed25519 cryptography directly in the browser via Web Crypto API in crates/tl-wasm/.

* Deployment: Hosted on Vercel at trai.apohara.io.

---

### Native SDKs (~4K LOC across 7 SDKs in sdk/)

* Go: 810 LOC (Pure Go, no CGO) in sdk/go/

* Ruby: 617 LOC (Client, verification, hashing) in sdk/ruby/

* TypeScript: 565 LOC (ESM + CJS dual build, includes WASM bundle) in sdk/typescript/package.json

* Swift: 533 LOC (iOS / macOS native) in sdk/swift/

* Kotlin/JVM: 395 LOC (Gradle build, native Kotlin) in sdk/kotlin/

* Python: 375 LOC (Full SDK wrapping Rust via PyO3 + CLI) in sdk/python/

* Python-light: 267 LOC (Pure HTTP client with zero Rust dependency) in sdk/python-light/

---

### CI/CD & DevSecOps (19 Workflows)

* Attestation: SLSA Build Level 3 attestation.

* Static Analysis & Testing: CodeQL, fuzzing across 5 targets (libFuzzer + cargo-fuzz), and adversarial testing across security frameworks.

* Verification: F* proof files checked into CI/CD pipeline formal/fstar-cose-sign1/MerkleProofs.fst).

* Platform Matrix: Cross-platform support across Linux, macOS, and Windows.

* Compliance: Automated IP chain auditing and DCO sign-off checks.

---

## Commercialization & Monetization Playbook

| Model | Price Point | Target Market |

| :--- | :--- | :--- |

| Hosted SaaS | $500 – $5,000 / month per tenant | Enterprise EU Compliance |

| Source Licensing | $50,000 – $400,000 one-time | Enterprise Security / Compliance teams |

| Consulting + Managed Deploy | $10,000 – $50,000 setup + $2,000/mo | Regulated Industries |

| MCP Marketplace | $100 – $500 / month per seat | AI Developers (Cursor / Claude / Codex) |

| Product Integration | IP acquisition / internal capability | Existing GRC, SIEM, or IAM vendors |

> Break-Even Threshold: Estimated at 3–4 enterprise customers at $2,000–$5,000/month.

### Estimated Buyer Infrastructure Operating Costs

| Infrastructure Item | Estimated Monthly Cost |

| :--- | :--- |

| PostgreSQL RDS + AWS KMS / HSM | $500 – $1,000 |

| TLS + DNS Infrastructure | $50 – $100 |

| CI/CD (GitHub Actions) | $0 – $200 |

| Total Operating Overhead | $550 – $1,300 / month |

---

## What Is Included in the Sale

* Source Code: Full ownership & complete source snapshot (~175K LOC).

* SDKs: All 7 native SDKs (Go, Kotlin/JVM, Python, Python-light, Ruby, Swift, TypeScript).

* Cryptographic Core: 31 Rust workspace members, 4 F* proof files, 1 Vale proof, and 5 fuzz targets.

* AI Developer Tools: 37 Model Context Protocol (MCP) tools.

* Brand Assets: trai.apohara.io domain and associated seller brand assets.

* Documentation: Full architecture specs, STRIDE threat model, and dependency SBOM SBOM.spdx.json).

* Deployment Assets: Production Docker Compose configurations & Alembic database migrations.

* Transfer Support: Private buyer data room access, formal written IP assignment agreement, and 30 days of direct developer transition support.

---

## What Is NOT Included

* No Financials: Zero existing revenue, active customers, or recurring contracts (Pre-revenue asset).

* No Infrastructure: Cloud hosting accounts are not included (Buyer must provision AWS/GCP/KMS).

* No Legal Certifications: No formal QTSP (Qualified Trust Service Provider) legal status or formal legal opinions.

---

## Buyer Due Diligence Steps

Buyers can verify codebase integrity using the following sequence:

1. Run cargo test --workspace — Verify pass rates across 1,496 #[test] annotations in 211 files.

2. Execute make ci — Run the full SLSA Level 3 CI pipeline (19 GitHub Actions workflows).

3. Run pytest services/control_plane/tests tests/ — Confirm pass rates across all 94 Python test files.

4. Review docs/KNOWN_LIMITATIONS.md inside the repository.

---

## Reason for Sale

TRAI was architected and executed by a solo senior engineer. While the cryptographic and core software engineering is complete, production-grade, and thoroughly tested, commercial scaling requires enterprise sales operations, cloud HSM provisioning, enterprise marketing, and legal certification—activities beyond the scope of a single developer.

Selling this proprietary asset provides a strategic buyer or funded startup with an immediate, turnkey foundation to capture the EU AI Act compliance market ahead of the August 2, 2026 enforcement deadline.

TRAI (Technology for Risk & Audit Infrastructure)

Description

Reviews