Aevum

The independent black box for AI agents. Tamper-evident, independently verifiable records of what your agents did — so when an auditor, regulator, or court asks you to prove it, you can.

Aevum records every agent action into a cryptographically signed, hash-chained ledger (a sigchain) and wraps each entry in a portable signed receipt (COSE_Sign1 + RFC 3161 trusted timestamp) that anyone can verify — without trusting Aevum, your model provider, or your cloud. It is the flight recorder, not the autopilot: a neutral evidence layer alongside whatever agent stack you already run.

Why a black box, and why independent

A flight recorder matters not because the airline keeps logs — it matters because the recorder is independent, tamper-evident, and defensible: an outside investigator reads it, and it holds up under challenge. Most AI logging today is the opposite. Observability tools (OpenTelemetry, Langfuse, Datadog) and cloud-native agent logs (Bedrock, Foundry, Vertex) are mutable, self-attested, and operator-controlled — excellent for debugging, weak as evidence. The operator is logging its own behavior, and nothing stops the record from being changed after the fact.

Aevum produces records that are:

• Tamper-evident — every entry is Ed25519-signed and SHA3-256 hash-chained;

altering any past entry breaks the chain and fails verification.

• Independently verifiable — a third party verifies a chain export with

the public key alone using the standalone aevum-verify tool (pip install aevum-verify), which shares no code with Aevum's own runtime. No access to your systems required. See Verify It Yourself for the copy-paste walkthrough.

• Portable and timestamped — each entry is wrapped in a COSE_Sign1 receipt

with an RFC 3161 trusted timestamp, and can be anchored to a public transparency log (Rekor v2).

• Built for the record-keeping rules you already face — designed to be

auditor- and court-defensible (an FRE 902(13) self-authentication certification template is included in docs/legal/).

Tamper-evidence is a property of the record; faithfulness-at-capture is a property of the integration. Aevum proves that what was recorded has not been altered after the fact. It does not, by itself, guarantee that every action an agent took was captured, or that a recorded action faithfully reflects what happened at the boundary where Aevum observes it. Aevum records the capture surface and emits an explicit capture.gap event whenever it detects a gap, so the boundary is visible rather than silent — see Capture Faithfulness.

The problem it solves

When an autonomous agent does something consequential — moves money, touches PII, takes an irreversible action — three questions follow, and the standard stack cannot answer them with evidence that survives a challenge:

1. What did the agent actually do, and in what order? Mutable logs can be

edited; you cannot prove they were not.

1. Can you prove it to someone who does not trust you? Self-attested logs

are worth little to a regulator or an opposing party.

1. Will it still hold up months from now? Records must be retained and

remain verifiable long after the event (EU AI Act Art. 12 ≥6-month retention; SEC 17a-4; FDA 21 CFR Part 11.10(e); HIPAA §164.312(b)).

Aevum makes the record structural rather than procedural: the evidence is produced as a byproduct of the agent running, not bolted on after an incident.

Quick start (zero config)

pip install aevum-core
export AEVUM_DEV=1

from aevum.core import Engine

engine = Engine()  # AEVUM_DEV=1 grants consent automatically
result = engine.ingest(
    data={"message": "User asked about billing"},
    provenance={"source_id": "support-chat", "chain_of_custody": ["support-chat"],
                "classification": 0},
    purpose="customer-support", subject_id="user-42", actor="my-agent",
)
print(result.audit_id)   # urn:aevum:audit:<uuid7>  — signed, chained, replayable
print(result.status)     # ok

AEVUM_DEV=1 is for local development only — see the Dev to Production checklist before deploying. For explicit consent grants, see the Pure Python guide.

For coding agents: llms.txt and llms-full.txt provide machine-readable API summaries for use with Claude, Copilot, and similar tools.

Record from the framework you already use

Aevum attaches to your existing stack as a recorder. Eight adapters ship with CI coverage across Python 3.11–3.13:

# LangGraph drop-in — every superstep signed and hash-chained
from aevum.core.adapters.langgraph import AevumCheckpointer
checkpointer = AevumCheckpointer.local()
graph = builder.compile(checkpointer=checkpointer)
# delete_thread(thread_id) → GDPR Art. 17 crypto-erasure

Adapters record agent activity into the sigchain and apply policy checks. The five unconditional barriers (below) run in Aevum's own kernel path — route enforcement-critical actions through the kernel when you need them enforced, not just recorded.

Install

pip install aevum-core                     # kernel only
pip install "aevum-core[server]"           # + HTTP API
pip install "aevum-core[langgraph]"        # + LangGraph checkpointer
pip install "aevum-core[anthropic]"        # + Anthropic SDK adapter
pip install "aevum-core[langchain]"        # + LangChain callback
pip install "aevum-core[openai-agents]"    # + OpenAI Agents SDK
pip install "aevum-core[crewai]"           # + CrewAI hooks
pip install "aevum-core[oxigraph]"         # + embedded RDF graph
pip install "aevum-core[postgres]"         # + PostgreSQL backend
pip install "aevum-core[mcp]"              # + MCP integration
pip install "aevum-core[all]"              # everything

Note: The bare name aevum on PyPI is an unrelated project. Always use aevum-core (or another aevum-* package).

Supporting layer: the governed kernel

Beyond recording, Aevum includes an optional governed execution path — five functions and five hardcoded safety barriers — for teams that want enforcement, not just evidence.

The five functions (CRE protocol)

In the kernel path, all five are consent-checked, barrier-enforced, and ledger-recorded.

The five unconditional barriers

The five barriers are enforced as hardcoded checks in `barriers.py` that run first, on every operation, before the policy engine — independent of any operator setting, environment variable, or runtime argument, and not bypassed even by dev mode (AEVUM_DEV=1). If a barrier fires, the operation halts. The same five are also expressed as Cedar `forbid` policies (`barriers.cedar`), enforced by the policy engine when the [cedar] extra is installed — defense-in-depth: the hardcoded layer is the unconditional guarantee (it fires even without Cedar); the Cedar layer is a redundant expression.

Compliance

What Aevum does and does not claim. Aevum is a tool that helps firms meet recordkeeping obligations; it does not itself constitute compliance, and it has not been certified or audited under any framework. For the capability-by-capability mapping (SEC 17a-4(f), FRE 902(13)/(14)) and an explicit list of what Aevum does not claim, see Regulatory Alignment and Non-Goals. Not legal advice.

Conformance

Aevum ships a machine-verifiable conformance suite:

pip install aevum-conformance
python -c "from aevum.conformance.suite import ConformanceSuite; \
    r = ConformanceSuite().run_all(); print(r.passed_count, '/', r.total_count)"

Aevum ships an 11-invariant machine-verifiable conformance suite. Run it against any installation; it reports passed/skipped/failed (some invariants skip when optional dependencies are absent — e.g. liboqs for dual-signature, cedarpy for policy invariants). See docs/conformance_report.txt for a reference run.

Packages

Self-governance pipeline

Aevum governs its own maintenance workflow using its own governed functions — a working dogfood of the library. Implementation in packages/aevum-maintainer:

Maintainer

Aevum is actively maintained by @bnyhil under the aevum-labs GitHub organization. This is a solo open-source research project — not a commercial product or formal legal entity.

Contributing

See CONTRIBUTING.md.

Security vulnerabilities: GitHub Security Advisories (private disclosure).

License

Code: Apache-2.0 · Specification: CC-BY-4.0 + OWFa 1.0.1