Vaara

A verifiable receipt for every autonomous action, checkable by anyone.

Your AI agent transferred the funds, wrote the file, called the tool. Later, someone who does not trust you asks you to prove exactly what it did and why: a regulator, an auditor, a customer after an incident. Your own logs will not settle it, because you could have edited them.

pip install vaara # Python: CLI, MCP proxy, server brew tap vaaraio/tap && brew install vaara # macOS: CLI + menu-bar app (built from source) npm install @vaara/client # TypeScript client for the HTTP API

import vaara @vaara.govern def transfer_funds(to: str, amount: float) -> str: ...

That is the whole thing. Every call to a governed function is risk-scored and decided against your policy before the body runs. An allowed call runs, and the decision, the call, and the outcome land in a hash-chained, tamper-evident record anyone can verify offline. Sign it at export (vaara trail export) for third-party proof. Records persist to~/.vaara/trail/audit.dbby default, so evidence survives restarts. Python 3.10+, zero runtime dependencies.

Bothdenyandescalateraisevaara.Blocked, since an escalation means a human has not answered yet. Run the example above on a fresh install and it will raise: with no outcome history the scorer's confidence interval is wide, and atx.transferescalates on the interval's upper bound even though its point estimate sits under the allow threshold. That is the intended direction to fail, and it settles. Feeding real outcomes back throughreport_outcomenarrows the interval, and the same call starts allowing after a few dozen clean results. To watch decisions without acting on them while that happens, start with@vaara.govern(shadow=True).

vaara.io/verify.htmlis the Vaara Resin. One HTML file, no build step and no dependencies. Paste in a receipt and it recomputes the DSSE pre-authentication encoding, takes its digest, and checks the Ed25519 signature with WebCrypto. The receipt never leaves the tab, nothing uploads, and the page works with the network off, so verification is not a service and Vaara is not a party to it. Save the file and it keeps working.

vaara.io/conformance.htmlis the results page. It carries every suite and its verdict, and every party other than the maintainer who ran the checkers and reported what they found in public. Rows are chained, each holding the digest of the row before it, so removing or reordering one breaks every digest after it and the break is visible to anyone. The maintainer cannot take a row down either. A run that disagrees with ours is a row too, with the reason stated, and there is no blacklist.

python scripts/conformance_runner.py # grade the reference corpus python scripts/conformance_runner.py --vectors-dir ./your_vectors # grade your own

It prints a prefilled link at the end of every run, so asking for a row takes one click. The named, versioned rule set, what a pass does and does not establish, and the full suite list are indocs/conformance-profile.md.

from vaara.pipeline import InterceptionPipeline pipeline = InterceptionPipeline() result = pipeline.intercept( agent_id="agent-007", tool_name="fs.write_file", parameters={"path": "/etc/service.yaml", "content": "..."}, agent_confidence=0.8, ) if result.allowed: pipeline.report_outcome(result.action_id, outcome_severity=0.0) else: print(result.reason)

Every call gets a risk score and an allow / block / escalate decision against your policy, then the call, the decision, and the real outcome are written to the audit trail.report_outcomecloses the loop: the scorer reweights based on which signals actually predicted the outcome. Releases ship SLSA Build Level 3 provenance, verifiable withslsa-verifier verify-artifact. Optional ML classifier:pip install 'vaara[ml]'.

Writing a trail is the easy half. The half that matters is letting someone who does not trust you check it, with no key, no access, and none of your code. Every Vaara record is content-addressed and fail-closed on authenticity, and ships with public conformance vectors plus a standalone checker that imports no Vaara code, so an independent party reproduces every verdict offline.

vaara verify-bundle evidence-bundle.json

okonly when a signature is actually established, not merely present in a log. The same property drives the standards work behindthe Vaara Receipt Internet-Draft: evidence that holds up for someone who runs none of your software. The full verifier set, the trust model for each verb, and where trust comes from in each case are indocs/verifying-evidence.md.

git clone https://github.com/vaaraio/vaara cd vaara pip install cryptography rfc8785 # the checker's only dependencies python tests/vectors/external_evidence_v0/_check_independent.py

For the whole loop in one runnable file, produce a signed record, verify it yourself, then watch a single forged byte get caught, seeexamples/prove-it-yourself/. The logs-versus-evidence argument behind it is indocs/logs-vs-evidence.md.

{ "system_name": "Acme HR Assistant", "overall_status": "evidence_insufficient", "trail_integrity": {"size": 105, "chain_intact": true}, "articles": [ {"article": "Article 12(1)", "title": "Record-Keeping (Logging)", "status": "evidence_sufficient", "strength": "strong", "evidence_count": 105}, {"article": "Article 15(1)", "title": "Accuracy, Robustness and Cybersecurity", "status": "evidence_insufficient", "strength": "absent", "evidence_count": 0} ] }

Each verdict carries the threshold-versus-observed snapshot, the rationale, and the underlying records, so a reviewer tracesstatusback to a concrete event. The same data renders as a Notified-Body PDF, a static HTML dashboard, or a Sigstore-signed handoff envelope. See[docs/COMPLIANCE.md.

…