RootSign SDK · v0.3.0

Tamper-evident provenance logging for AI agents.

Open-source · Apache 2.0 · Python 3.11+

View on GitHub

Install

Base install: pip install rootsign. Framework extras pull in the matching connector.

Quickstart

Wrap your existing tools. Provenance is captured automatically.

agent.pypython

from rootsign import wrap_tools, session
from langchain_core.tools import tool

@tool
def send_invoice(customer_id: str, amount: float) -> str:
    """Send an invoice."""
    return "sent"

async with session(agent_id=agent.agent_id, client=client) as ctx:
    tools = wrap_tools([send_invoice], ctx=ctx)
    # your graph runs here — every tool call is captured

Verify the chain

One command proves the record chain is intact — or flags tampering.

terminalbash

$ rootsign verify <session_id>
VALID ✓  —  47 records, chain intact

Hand it to someone who doesn't read JSONL

verify answers a developer's question. export answers everyone else's — one command turns a session into a self-contained evidence bundle: JSON for machines, an HTML report for people, and a SHA-256 for every file in it.

terminalbash

$ rootsign export --local ~/.rootsign/sessions/<session_id>.jsonl
VALID — 3 records, chain intact
  Bundle:   ./evidence-<session_id>
            manifest.json  verification.json  timeline.json  redaction.json
            report.md  report.html

  manifest.json SHA-256:  a1d61338d0f793ea03ac472863fadea5660e1e94846913ce7613d8c117d67cc5
  Record that hash outside the bundle — a ticket, an email, a chain-of-custody log.

The generated evidence report: a VALID verdict banner, the session and agent identity block, and a per-record chain table showing each action's self_hash and prev_action_hash — report.html — the verdict first, then the chain, then what happened.

Further down the same report: a wire_transfer action recorded as human_rejected with no output hash, above the approval that refused it — approver, reason, latency, and the context they were shown — A £250,000 transfer the agent proposed, the human who refused it, and the context they were shown — recorded, hashed, and readable without a terminal.

The recipient runs rootsign export --check to re-hash every file. That proves the bundle is internally consistent — comparing the manifest hash against the value you recorded out of band is what proves it is the bundle you generated.

What's in v0.3.0

✓ Shipped

rootsign export: self-verifying evidence bundles with an HTML report (ADR-014)
Cloud transport behind rootsign[cloud] — the chain is sealed client-side (ADR-013)
Offline spool: an unreachable endpoint costs you nothing; rootsign-admin sync replays it
Three verdicts — VALID / TAMPERED / INCOMPLETE — with exit codes 0/1/2
Published wire spec: envelope, error registry, idempotency, batch semantics
JSONL default backend: zero dependencies, no Docker or database (ADR-011)
LangGraph 0.1.x and 0.2.x · CrewAI 0.28+, 0.40+, 1.x · MCP proxy (ADR-010)
Human-in-the-loop checkpoints and PII redaction before hashing
847 tests · 14 ADRs · Apache 2.0

View full release notes →GitHub →PyPI →

GitHubPyPIRelease notesDocumentation (coming soon)