TealProof

pip install tealtiger

import asyncio
from tealtiger import TealEngine, TealProof

engine = TealEngine(
    policy=my_policy,
    modules=[
        TealProof(
            merkle={"algorithm": "sha256", "max_leaves": 10000},
            timestamp={"tsa": "https://freetsa.org/tsr"},
            passport={"enabled": True, "window_size": "1h", "retention": "90d"},
        )
    ],
)

async def main():
    decision = await engine.evaluate(request, ctx)

    # Access the cryptographic receipt
    receipt = decision.metadata["governance_receipt"]
    print(receipt.receipt_id)       # "rcpt-abc123"
    print(receipt.decision_hash)    # "sha256:..."
    print(receipt.merkle_root)      # Current tree root
    print(receipt.timestamp)        # RFC 3161 timestamp token

asyncio.run(main())

from tealtiger.proof import MerkleTree

tree = MerkleTree(algorithm="sha256")

# Add governance decisions as leaves
tree.add_leaf(decision1)
tree.add_leaf(decision2)
tree.add_leaf(decision3)

# Build the tree
root = tree.build()
print(root.hash)  # "sha256:7f83b165..."

# Generate and verify inclusion proof
proof = tree.get_proof(decision2)
assert MerkleTree.verify(proof)

from dataclasses import dataclass

@dataclass
class GovernanceReceipt:
    receipt_id: str           # Unique receipt identifier
    decision_hash: str        # SHA-256 hash of canonical decision
    merkle_root: str          # Merkle tree root at inclusion time
    inclusion_proof: list[str]  # Sibling hashes
    leaf_index: int           # Leaf index in the tree
    timestamp: str            # RFC 3161 timestamp token (base64)
    tsa: str                  # Time Stamping Authority used
    policy_version: str       # Policy version at evaluation time
    engine_version: str       # Engine version
    correlation_id: str       # Link to original request

from tealtiger.proof import GovernancePassport

passport = GovernancePassport(
    agent_id="agent-support-bot-001",
    window_size="1h",
    tsa="https://freetsa.org/tsr",
    retention="90d",
)

# Query coverage for a time range
coverage = await passport.get_coverage(
    from_time="2026-06-01T00:00:00Z",
    to_time="2026-06-01T23:59:59Z",
)

print(coverage.windows)         # 24 sealed Merkle trees
print(coverage.total_decisions) # 1,847 decisions governed
print(coverage.chain_valid)     # True (all roots chain correctly)
print(coverage.gaps)            # [] (no coverage gaps)

from tealtiger.proof import VerificationSDK

verifier = VerificationSDK()

# Level 1: Local verification (offline, fast)
result = await verifier.verify_local(receipt)
assert result.valid
assert result.checks["merkle"] is True
assert result.checks["hash"] is True

# Level 2: Timestamp verification (requires network)
result = await verifier.verify_timestamp(receipt)
assert result.checks["timestamp"] is True
assert result.checks["tsa_cert"] is True

# Level 3: Full chain verification (compliance audits)
result = await verifier.verify_passport(
    passport,
    from_time="2026-06-01T00:00:00Z",
    to_time="2026-06-07T23:59:59Z",
)
print(f"Windows verified: {result.windows_verified}")
print(f"Decisions verified: {result.decisions_verified}")
print(f"Gaps: {len(result.gaps)}")

TealProof(
    enabled=True,
    merkle={
        "algorithm": "sha256",       # sha256 | sha384 | sha512
        "max_leaves": 10000,
        "auto_rotate": True,
    },
    timestamp={
        "tsa": "https://freetsa.org/tsr",
        "fallback_tsa": ["https://timestamp.digicert.com"],
        "timeout": "5s",
    },
    passport={
        "enabled": True,
        "window_size": "1h",
        "retention": "90d",
        "storage": "local",          # local | s3 | gcs | azure_blob
    },
    receipts={
        "attach_to_decision": True,
        "storage": "local",
    },
)

# Auditor asks: "Prove agent-001 was governed between June 1-7"
passport = await GovernancePassport.load("agent-support-bot-001")

audit_report = await verifier.verify_passport(
    passport,
    from_time="2026-06-01T00:00:00Z",
    to_time="2026-06-07T23:59:59Z",
)

if audit_report.valid and audit_report.checks["coverage"]:
    print("✓ Continuous governance coverage confirmed")
    print(f"  Windows: {audit_report.windows_verified}")
    print(f"  Decisions: {audit_report.decisions_verified}")
    await audit_report.export_pdf("governance-audit-june-2026.pdf")