TRAI (Technology for Risk & Audit Infrastructure)

About

TRAI — Cryptographic Evidence Platform for AI ComplianceTechnology for Risk & Audit InfrastructurePost-quantum cryptographic evidence platform for AI-generated content. EU AI Act Art. 50 ready. Source-only technical IP acquisition — proprietary license, full IP transfer on sale.Live Demo: https://trai.apohara.ioSource Artifact: Available for qualified buyers (request access via listing platform)Product Overview & Value PropositionTRAI issues, timestamps, and independently verifies tamper-evident evidence packages using FIPS 204-aligned post-quantum hybrid cryptography. It solves a direct regulatory imperative:EU AI Act Article 50 (enforcement deadline: August 2, 2026) requires enterprises deploying AI systems to provide verifiable transparency disclosures.Non-Compliance Penalty: Up to €15M or 3% of global annual turnover.Acquisition Model: This is a pre-revenue, source-only technical IP acquisition distributed under a proprietary license. Clean solo-developer IP with zero existing customers, zero revenue, and zero debt.Key MetricsAll metrics are independently verifiable against the source code artifact:MetricValueVerification PathTotal Source LOC~175,000 (Rust: 83K | Python: 67K | Web: 21K | SDKs: 4K)README.mdRust Workspace Members31 (30 crates + 1 binary)Cargo.tomlSDKs7 native SDKs (Go, Kotlin/JVM, Python, Python-light, Ruby, Swift, TypeScript) + WASM bundledocs/BUYER_PACKAGE.mdMCP Tools37 tools (7 legacy v1 in main.rs + 30 v2 in tools/)crates/tl-mcp-server/src/main.rsRust Test Annotations1,496 #[test] annotations across 211 filesREADME.mdPython Test Files94 test filesREADME.mdCommit History786 commits in seller repository (source-only delivery archive does not include .git directory)docs/BUYER_PACKAGE.mdFormal Proofs4 F proof files* (COSE_Sign1, BLAKE3, Merkle consistency) + 1 Vale proof for Ed25519formal/fstar-cose-sign1/MerkleProofs.fstFuzz Targets5 fuzz targets (libFuzzer + cargo-fuzz)README.mdCI/CD Workflows19 workflows (SLSA Build Level 3 attestation).github/workflows/badge.ymlAPI Endpoints45 endpoints (33 v1 + 12 v2 compat shadow, FastAPI async)services/control_plane/app/main.pyWASM Bundle108KB browser-native verification enginecrates/tl-wasm/Cargo.tomlTechnical ArchitectureRust Core (83K LOC across 31 workspace members)Key Cratestrai-evidence: Core evidence engine featuring a hybrid Ed25519 + ML-DSA-65 signature scheme with multi-stage envelope verification (COSE, timestamp binding, key registry, SCITT anchor) in crates/trai-evidence/src/cose.rs.trai-orchestrator: 10-state async workflow engine with per-tenant DashMap state and BAAAR halt semantics in crates/trai-orchestrator/.trai-sandbox: Anti-bypass command parser, double-fork/pipe/thread isolation, combined with seccomp + Landlock in crates/trai-sandbox/.trai-orch-protocol: Internal protocol definitions in crates/trai-orch-protocol/.themis-compliance: Regulatory compliance mapping engine (EU AI Act, DORA, NIS-2, ISO 42001, NIST AI RMF) in crates/themis-compliance/.tl-mcp-server: Model Context Protocol server (37 tools for Claude, Cursor, Codex integration) in crates/tl-mcp-server/.Core Cryptographic CapabilitiesEd25519 + ML-DSA-65 hybrid signing (hybrid-ed25519-mldsa65-jcs-2026 cryptosuite) aligned with NIST FIPS 204.COSE_Sign1 / RFC 9052 envelope formatting in crates/trai-evidence/src/cose.rs.BLAKE3 canonical hash chaining.RFC 3161 timestamping (eIDAS-oriented).RFC 9943 SCITT receipt format with RFC 9162 Merkle inclusion proofs in crates/tl-scitt/.Code Quality: Zero todo!() or unimplemented!() stubs in core crates; #![deny(clippy::unwrap_used)] enforced; unsafe code strictly confined to the seccomp sandbox.Complete STRIDE threat model included (THREAT_MODEL.md).Python Control Plane (~67K LOC Total)Architecture: FastAPI async with 45 production REST API endpoints (33 v1 + 12 v2 compat shadow) in services/control_plane/app/main.py.Persistence: SQLAlchemy 2.0 async on PostgreSQL 16 with Alembic migrations and append-only audit logging.Multi-Tenant Isolation: JWT org resolution where unauthorized cross-tenant queries return 404 Not Found (never 403), preventing tenant enumeration.HSM Failover: Multi-provider failover supporting 5 major Hardware Security Module backends (AWS KMS, Azure Key Vault, GCP Cloud KMS, YubiHSM, Thales Luna) with fail-closed/circuit-open handling in services/control_plane/app/hsm_failover.py.Standards: Strict ruff and mypy enforcement.Frontend UI (~21K LOC)Stack: Astro 7 + Svelte 5 + Tailwind CSS in web/.Client Crypto Engine: Live WASM execution pipeline running native SHA-256 and Ed25519 cryptography directly in the browser via Web Crypto API in crates/tl-wasm/.Deployment: Hosted on Vercel at trai.apohara.io.Native SDKs (~4K LOC across 7 SDKs in sdk/)Go: 810 LOC (Pure Go, no CGO) in sdk/go/Ruby: 617 LOC (Client, verification, hashing) in sdk/ruby/TypeScript: 565 LOC (ESM + CJS dual build, includes WASM bundle) in sdk/typescript/package.jsonSwift: 533 LOC (iOS / macOS native) in sdk/swift/Kotlin/JVM: 395 LOC (Gradle build, native Kotlin) in sdk/kotlin/Python: 375 LOC (Full SDK wrapping Rust via PyO3 + CLI) in sdk/python/Python-light: 267 LOC (Pure HTTP client with zero Rust dependency) in sdk/python-light/CI/CD & DevSecOps (19 Workflows)Attestation: SLSA Build Level 3 attestation.Static Analysis & Testing: CodeQL, fuzzing across 5 targets (libFuzzer + cargo-fuzz), and adversarial testing across security frameworks.Verification: F* proof files checked into CI/CD pipeline (formal/fstar-cose-sign1/MerkleProofs.fst).Platform Matrix: Cross-platform support across Linux, macOS, and Windows.Compliance: Automated IP chain auditing and DCO sign-off checks.Commercialization & Monetization PlaybookModelPrice PointTarget MarketHosted SaaS$500 – $5,000 / month per tenantEnterprise EU ComplianceSource Licensing$50,000 – $400,000 one-timeEnterprise Security / Compliance teamsConsulting + Managed Deploy$10,000 – $50,000 setup + $2,000/moRegulated IndustriesMCP Marketplace$100 – $500 / month per seatAI Developers (Cursor / Claude / Codex)Product IntegrationIP acquisition / internal capabilityExisting GRC, SIEM, or IAM vendorsBreak-Even Threshold: Estimated at 3–4 enterprise customers at $2,000–$5,000/month.Estimated Buyer Infrastructure Operating CostsInfrastructure ItemEstimated Monthly CostPostgreSQL RDS + AWS KMS / HSM$500 – $1,000TLS + DNS Infrastructure$50 – $100CI/CD (GitHub Actions)$0 – $200Total Operating Overhead$550 – $1,300 / monthWhat Is Included in the SaleSource Code: Full ownership & complete source snapshot (~175K LOC).SDKs: All 7 native SDKs (Go, Kotlin/JVM, Python, Python-light, Ruby, Swift, TypeScript).Cryptographic Core: 31 Rust workspace members, 4 F* proof files, 1 Vale proof, and 5 fuzz targets.AI Developer Tools: 37 Model Context Protocol (MCP) tools.Brand Assets: trai.apohara.io domain and associated seller brand assets.Documentation: Full architecture specs, STRIDE threat model, and dependency SBOM (SBOM.spdx.json).Deployment Assets: Production Docker Compose configurations & Alembic database migrations.Transfer Support: Private buyer data room access, formal written IP assignment agreement, and 30 days of direct developer transition support.What Is NOT IncludedNo Financials: Zero existing revenue, active customers, or recurring contracts (Pre-revenue asset).No Infrastructure: Cloud hosting accounts are not included (Buyer must provision AWS/GCP/KMS).No Legal Certifications: No formal QTSP (Qualified Trust Service Provider) legal status or formal legal opinions.Buyer Due Diligence StepsBuyers can verify codebase integrity using the following sequence:Run cargo test --workspace — Verify pass rates across 1,496 #[test] annotations in 211 files.Execute make ci — Run the full SLSA Level 3 CI pipeline (19 GitHub Actions workflows).Run pytest services/control_plane/tests tests/ — Confirm pass rates across all 94 Python test files.Review docs/KNOWN_LIMITATIONS.md inside the repository.Reason for SaleTRAI was architected and executed by a solo senior engineer. While the cryptographic and core software engineering is complete, production-grade, and thoroughly tested, commercial scaling requires enterprise sales operations, cloud HSM provisioning, enterprise marketing, and legal certification—activities beyond the scope of a single developer.Selling this proprietary asset provides a strategic buyer or funded startup with an immediate, turnkey foundation to capture the EU AI Act compliance market ahead of the August 2, 2026 enforcement deadline.