TRAI (Technology for Risk & Audit Infrastructure) - Sell Project

TRAI — Cryptographic Evidence Platform for AI Compliance Technology for Risk & Audit Infrastructure Post-quantum cryptographic evidence platform for AI-generated content. EU AI Act Art. 50 ready. Source-only technical IP acquisition — proprietary license, full IP transfer on sale. Live Demo: https://trai.apohara.io Source Artifact: Available for qualified buyers (request access via listing platform) Product Overview & Value Proposition TRAI issues, timestamps, and independently verifies tamper-evident evidence packages using FIPS 204-aligned post-quantum hybrid cryptography. It solves a direct regulatory imperative: EU AI Act Article 50 (enforcement deadline: August 2, 2026) requires enterprises deploying AI systems to provide verifiable transparency disclosures. Non-Compliance Penalty: Up to €15M or 3% of global annual turnover. Acquisition Model: This is a pre-revenue, source-only technical IP acquisition distributed under a proprietary license. Clean solo-developer IP with zero existing customers, zero revenue, and zero debt. Key Metrics All metrics are independently verifiable against the source code artifact: MetricValueVerification Path Total Source LOC175,000 (Rust: 83K | Python: 67K | Web: 21K | SDKs: 4K)README.md Rust Workspace Members31 (30 crates + 1 binary)Cargo.toml SDKs7 native SDKs (Go, Kotlin/JVM, Python, Python-light, Ruby, Swift, TypeScript) + WASM bundledocs/BUYERPACKAGE.md MCP Tools37 tools (7 legacy v1 in main.rs + 30 v2 in tools/)crates/tl-mcp-server/src/main.rs Rust Test Annotations1,496 #[test] annotations across 211 filesREADME.md Python Test Files94 test filesREADME.md Commit History786 commits in seller repository (source-only delivery archive does not include .git directory)docs/BUYERPACKAGE.md Formal Proofs4 F proof files (COSESign1, BLAKE3, Merkle consistency) + 1 Vale proof for Ed25519formal/fstar-cose-sign1/MerkleProofs.fst Fuzz Targets5 fuzz targets (libFuzzer + cargo-fuzz)README.md CI/CD Workflows19 workflows (SLSA Build Level 3 attestation).github/workflows/badge.yml API Endpoints45 endpoints (33 v1 + 12 v2 compat shadow, FastAPI async)services/controlplane/app/main.py WASM Bundle108KB browser-native verification enginecrates/tl-wasm/Cargo.toml Technical Architecture Rust Core (83K LOC across 31 workspace members) Key Crates trai-evidence: Core evidence engine featuring a hybrid Ed25519 + ML-DSA-65 signature scheme with multi-stage envelope verification (COSE, timestamp binding, key registry, SCITT anchor) in crates/trai-evidence/src/cose.rs. trai-orchestrator: 10-state async workflow engine with per-tenant DashMap state and BAAAR halt semantics in crates/trai-orchestrator/. trai-sandbox: Anti-bypass command parser, double-fork/pipe/thread isolation, combined with seccomp + Landlock in crates/trai-sandbox/. trai-orch-protocol: Internal protocol definitions in crates/trai-orch-protocol/. themis-compliance: Regulatory compliance mapping engine (EU AI Act, DORA, NIS-2, ISO 42001, NIST AI RMF) in crates/themis-compliance/. tl-mcp-server: Model Context Protocol server (37 tools for Claude, Cursor, Codex integration) in crates/tl-mcp-server/. Core Cryptographic Capabilities Ed25519 + ML-DSA-65 hybrid signing (hybrid-ed25519-mldsa65-jcs-2026 cryptosuite) aligned with NIST FIPS 204. COSESign1 / RFC 9052 envelope formatting in crates/trai-evidence/src/cose.rs. BLAKE3 canonical hash chaining. RFC 3161 timestamping (eIDAS-oriented). RFC 9943 SCITT receipt format with RFC 9162 Merkle inclusion proofs in crates/tl-scitt/. Code Quality: Zero todo!() or unimplemented!() stubs in core crates; #![deny(clippy::unwrapused)] enforced; unsafe code strictly confined to the seccomp sandbox. Complete STRIDE threat model included (THREATMODEL.md). Python Control Plane (67K LOC Total) Architecture: FastAPI async with 45 production REST API endpoints (33 v1 + 12 v2 compat shadow) in services/controlplane/app/main.py. Persistence: SQLAlchemy 2.0 async on PostgreSQL 16 with Alembic migrations and append-only audit logging. Multi-Tenant Isolation: JWT org resolution where unauthorized cross-tenant queries return 404 Not Found (never 403), preventing tenant enumeration. HSM Failover: Multi-provider failover supporting 5 major Hardware Security Module backends (AWS KMS, Azure Key Vault, GCP Cloud KMS, YubiHSM, Thales Luna) with fail-closed/circuit-open handling in services/controlplane/app/hsmfailover.py. Standards: Strict ruff and mypy enforcement. Frontend UI (21K LOC) Stack: Astro 7 + Svelte 5 + Tailwind CSS in web/. Client Crypto Engine: Live WASM execution pipeline running native SHA-256 and Ed25519 cryptography directly in the browser via Web Crypto API in crates/tl-wasm/. Deployment: Hosted on Vercel at trai.apohara.io. Native SDKs (4K LOC across 7 SDKs in sdk/) Go: 810 LOC (Pure Go, no CGO) in sdk/go/ Ruby: 617 LOC (Client, verification, hashing) in sdk/ruby/ TypeScript: 565 LOC (ESM + CJS dual build, includes WASM bundle) in sdk/typescript/package.json Swift: 533 LOC (iOS / macOS native) in sdk/...