Skip to content

Tamra 0.1.0

Choose a tag to compare

View all tags
@satyasivaprasad satyasivaprasad released this 07 Jul 19:00
v0.1.0
ee5290d

Tamra — the tamper-evident evidence ledger for AI agents. A copper plate for your agent.

This is the first public release. Self-hosted, Apache-2.0, your database, your keys — no API key, no cloud in the loop, zero marginal cost per event.

Add it to a Spring AI agent

One dependency turns an ordinary Spring AI agent into an evidence-producing one:

<dependency>
  <groupId>dev.tamra</groupId>
  <artifactId>tamra-spring-boot-starter</artifactId>
  <version>0.1.0</version>
</dependency>

Published to Maven Central:

  • dev.tamra:tamra-core:0.1.0 — canonical event model, RFC 8785 canonicalization, SHA-256 hash chain, Ed25519 Signer (pure Java, zero Spring)
  • dev.tamra:tamra-store:0.1.0 — Postgres append-only ledger (JDBC + Flyway)
  • dev.tamra:tamra-spring-boot-starter:0.1.0 — auto-configuration, Spring AI capture advisor, async ledger writer, HumanApproval API

The tamra CLI

Attached to this release as a runnable uber-jar (tamra.jar):

java -jar tamra.jar verify   --help   # verify a live ledger against the DB
java -jar tamra.jar export   --help   # export a signed Agent Tamrapatra bundle
java -jar tamra.jar verify --bundle …  # verify an exported bundle offline, air-gapped
java -jar tamra.jar keygen   --help
java -jar tamra.jar anchor   --help   # publish the chain head to git and/or an RFC 3161 TSA

What's in 0.1.0

  • Tamper-evident hash chain — every agent event (LLM call, tool call, human approval) sealed into a SHA-256 chain; mutate any row and tamra verify names the exact broken sequence.
  • Offline, openssl-verifiable signatures — Ed25519 over signed checkpoints; an auditor can verify a bundle with nothing but openssl, no network.
  • Agent Tamrapatra bundles — portable .tamrapatra evidence export (events + checkpoints + signatures + report), with key pinning and a signed manifest.
  • Edicts — YAML rule packs mapping event types to regulatory controls; ships the EU AI Act edict (Articles 12/14/19).
  • Anchoring — publish the chain head to a git repo and/or an RFC 3161 timestamp authority.
  • Hash-only by default — prompts/responses stored as SHA-256 hashes unless you opt into full payloads.

Verify this download

The CLI jar is signed with the maintainer's GPG key (rsa4096/20317677B4AD7D12,
Siva Jonnalagadda <satyasivaprasad.j@gmail.com>):

gpg --keyserver keyserver.ubuntu.com --recv-keys 20317677B4AD7D12
gpg --verify tamra.jar.asc tamra.jar

Links

  • Site: https://tamra.dev
  • Docs: SPEC.md, docs/TAMRA-CONCEPT.md, docs/comparison.md
  • Requires Java 21+ and PostgreSQL 15+.
Assets 4
Loading