eatp-reference

name	eatp-reference
description	EATP SDK — TrustPlane/BudgetTracker/PostureStore. Use for implementing trust code, not concepts.
allowed-tools	["Read","Glob","Grep"]

EATP SDK Implementation Reference

Implementation reference for the EATP trust module in the Kailash SDK. For EATP spec/concepts (5 elements, verification gradient, trust postures), see co-reference/eatp-spec.md.

TrustPlane Reference Implementation

Production-grade Python library implementing the full EATP trust chain.

• 3 store backends: SQLite (default), Filesystem, PostgreSQL
• Key managers: LocalFileKeyManager (Ed25519), AWS KMS (ECDSA P-256), Azure Key Vault, HashiCorp Vault
• 11 hardened security patterns validated through 14 rounds of red teaming
• 22-class exception hierarchy, all tracing to TrustPlaneError
• 1473 tests, zero CRITICAL/HIGH findings

Entry Points

• CLI: attest command (Click-based)
• MCP Server: trustplane-mcp via FastMCP
• Python API: from kailash.trust.plane.project import TrustProject

Enterprise Features

RBAC (4 roles), OIDC (JWKS auto-discovery), SIEM (CEF/OCSF/TLS syslog), Dashboard (bearer token auth), Archive (ZIP + SHA-256), Shadow mode (non-blocking evaluation)

Implementation Reference (load on demand)

• eatp-trust-posture-canonical.md — Canonical TrustPosture names (AUTONOMOUS/DELEGATING/SUPERVISED/TOOL/PSEUDO), legacy aliases, mapper branch → posture table. Load first when touching trust posture tests.
• eatp-sdk-quickstart.md — Getting started, 4-operation lifecycle, store selection
• eatp-sdk-api-reference.md — Complete API surface, module reference, type signatures
• eatp-sdk-patterns.md — Implementation patterns, critical gotchas, architecture
• eatp-sdk-reasoning-traces.md — Reasoning trace extension, confidentiality, knowledge bridge
• eatp-budget-tracking.md — BudgetTracker API, SQLiteBudgetStore, integer microdollars, threshold callbacks
• eatp-posture-stores.md — PostureStore protocol, SQLitePostureStore, PostureEvidence
• eatp-security-patterns.md — Red team security patterns: lock ordering, integer arithmetic, symlink rejection
• eatp-store-backends.md — Adding new TrustPlaneStore backends (6-requirement security contract)
• eatp-trust-plane-security.md — 11 hardened security patterns (TrustPlane-specific)
• eatp-trust-plane-enterprise.md — RBAC, OIDC, SIEM, Dashboard, Archive, Shadow mode, Cloud KMS