forma-sdk 1.1.0__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- forma_sdk-1.1.0/LICENSE +21 -0
- forma_sdk-1.1.0/PKG-INFO +225 -0
- forma_sdk-1.1.0/README.md +172 -0
- forma_sdk-1.1.0/forma_sdk.egg-info/PKG-INFO +225 -0
- forma_sdk-1.1.0/forma_sdk.egg-info/SOURCES.txt +20 -0
- forma_sdk-1.1.0/forma_sdk.egg-info/dependency_links.txt +1 -0
- forma_sdk-1.1.0/forma_sdk.egg-info/entry_points.txt +3 -0
- forma_sdk-1.1.0/forma_sdk.egg-info/requires.txt +24 -0
- forma_sdk-1.1.0/forma_sdk.egg-info/top_level.txt +2 -0
- forma_sdk-1.1.0/provn/__init__.py +132 -0
- forma_sdk-1.1.0/pyproject.toml +3 -0
- forma_sdk-1.1.0/setup.cfg +4 -0
- forma_sdk-1.1.0/setup.py +46 -0
- forma_sdk-1.1.0/trustlayer/__init__.py +180 -0
- forma_sdk-1.1.0/trustlayer/approval.py +231 -0
- forma_sdk-1.1.0/trustlayer/auto.py +766 -0
- forma_sdk-1.1.0/trustlayer/cli.py +568 -0
- forma_sdk-1.1.0/trustlayer/client.py +158 -0
- forma_sdk-1.1.0/trustlayer/crypto.py +163 -0
- forma_sdk-1.1.0/trustlayer/gate_local.py +306 -0
- forma_sdk-1.1.0/trustlayer/models.py +96 -0
- forma_sdk-1.1.0/trustlayer/tracker.py +791 -0
forma_sdk-1.1.0/LICENSE
ADDED
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
MIT License
|
|
2
|
+
|
|
3
|
+
Copyright (c) 2026 FORMA
|
|
4
|
+
|
|
5
|
+
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
6
|
+
of this software and associated documentation files (the "Software"), to deal
|
|
7
|
+
in the Software without restriction, including without limitation the rights
|
|
8
|
+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
9
|
+
copies of the Software, and to permit persons to whom the Software is
|
|
10
|
+
furnished to do so, subject to the following conditions:
|
|
11
|
+
|
|
12
|
+
The above copyright notice and this permission notice shall be included in all
|
|
13
|
+
copies or substantial portions of the Software.
|
|
14
|
+
|
|
15
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
16
|
+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
17
|
+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
18
|
+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
19
|
+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
20
|
+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
21
|
+
SOFTWARE.
|
forma_sdk-1.1.0/PKG-INFO
ADDED
|
@@ -0,0 +1,225 @@
|
|
|
1
|
+
Metadata-Version: 2.4
|
|
2
|
+
Name: forma-sdk
|
|
3
|
+
Version: 1.1.0
|
|
4
|
+
Summary: FORMA — AI agent compliance SDK. Zero-config tracking, EU AI Act/DPDP/RBI compliance, cryptographic audit trails.
|
|
5
|
+
Home-page: https://github.com/amit5115/forma-sdk
|
|
6
|
+
Author: FORMA
|
|
7
|
+
Author-email: sdk@forma.ai
|
|
8
|
+
Keywords: ai agents compliance eu-ai-act rbi dpdp audit cryptography llm openai
|
|
9
|
+
Classifier: Development Status :: 4 - Beta
|
|
10
|
+
Classifier: Intended Audience :: Developers
|
|
11
|
+
Classifier: License :: OSI Approved :: MIT License
|
|
12
|
+
Classifier: Programming Language :: Python :: 3
|
|
13
|
+
Classifier: Programming Language :: Python :: 3.8
|
|
14
|
+
Classifier: Programming Language :: Python :: 3.9
|
|
15
|
+
Classifier: Programming Language :: Python :: 3.10
|
|
16
|
+
Classifier: Programming Language :: Python :: 3.11
|
|
17
|
+
Classifier: Programming Language :: Python :: 3.12
|
|
18
|
+
Classifier: Topic :: Software Development :: Libraries :: Python Modules
|
|
19
|
+
Classifier: Topic :: Scientific/Engineering :: Artificial Intelligence
|
|
20
|
+
Requires-Python: >=3.8
|
|
21
|
+
Description-Content-Type: text/markdown
|
|
22
|
+
License-File: LICENSE
|
|
23
|
+
Requires-Dist: httpx>=0.24.0
|
|
24
|
+
Requires-Dist: pydantic>=2.0
|
|
25
|
+
Provides-Extra: cli
|
|
26
|
+
Requires-Dist: click>=8.0; extra == "cli"
|
|
27
|
+
Provides-Extra: openai
|
|
28
|
+
Requires-Dist: openai>=1.0; extra == "openai"
|
|
29
|
+
Provides-Extra: anthropic
|
|
30
|
+
Requires-Dist: anthropic>=0.20; extra == "anthropic"
|
|
31
|
+
Provides-Extra: litellm
|
|
32
|
+
Requires-Dist: litellm>=1.0; extra == "litellm"
|
|
33
|
+
Provides-Extra: langchain
|
|
34
|
+
Requires-Dist: langchain-core>=0.1; extra == "langchain"
|
|
35
|
+
Provides-Extra: all
|
|
36
|
+
Requires-Dist: click>=8.0; extra == "all"
|
|
37
|
+
Requires-Dist: openai>=1.0; extra == "all"
|
|
38
|
+
Requires-Dist: anthropic>=0.20; extra == "all"
|
|
39
|
+
Requires-Dist: litellm>=1.0; extra == "all"
|
|
40
|
+
Requires-Dist: langchain-core>=0.1; extra == "all"
|
|
41
|
+
Dynamic: author
|
|
42
|
+
Dynamic: author-email
|
|
43
|
+
Dynamic: classifier
|
|
44
|
+
Dynamic: description
|
|
45
|
+
Dynamic: description-content-type
|
|
46
|
+
Dynamic: home-page
|
|
47
|
+
Dynamic: keywords
|
|
48
|
+
Dynamic: license-file
|
|
49
|
+
Dynamic: provides-extra
|
|
50
|
+
Dynamic: requires-dist
|
|
51
|
+
Dynamic: requires-python
|
|
52
|
+
Dynamic: summary
|
|
53
|
+
|
|
54
|
+
# FORMA SDK
|
|
55
|
+
|
|
56
|
+
**Make non-compliance impossible — in one line of code.**
|
|
57
|
+
|
|
58
|
+
FORMA doesn't just record what your AI did; it **blocks non-compliant decisions before they execute**. Add `enforce=[...]` and PII leaks, prompt injections, and policy violations are stopped at runtime — then every decision is cryptographically signed and mapped to RBI, DPDP, EU AI Act, and ISO 42001.
|
|
59
|
+
|
|
60
|
+
[](LICENSE)
|
|
61
|
+
[](https://www.python.org/downloads/)
|
|
62
|
+
|
|
63
|
+
---
|
|
64
|
+
|
|
65
|
+
## Install
|
|
66
|
+
|
|
67
|
+
```bash
|
|
68
|
+
pip install forma-sdk
|
|
69
|
+
```
|
|
70
|
+
|
|
71
|
+
Import name is `trustlayer` (the legacy alias `provn` also works):
|
|
72
|
+
|
|
73
|
+
```python
|
|
74
|
+
import trustlayer as tl
|
|
75
|
+
```
|
|
76
|
+
|
|
77
|
+
## Quickstart — runtime enforcement
|
|
78
|
+
|
|
79
|
+
```python
|
|
80
|
+
import trustlayer as tl
|
|
81
|
+
|
|
82
|
+
tl.init(api_key="tl_live_YOUR_KEY") # from forma.2bd.net → Settings
|
|
83
|
+
|
|
84
|
+
@tl.agent(
|
|
85
|
+
purpose="Loan application evaluation",
|
|
86
|
+
risk_level="HIGH",
|
|
87
|
+
enforce=["rbi_ml_risk", "dpdp"], # ← blocks violations BEFORE they run
|
|
88
|
+
)
|
|
89
|
+
def approve_loan(application: dict) -> dict:
|
|
90
|
+
return run_underwriting_model(application)
|
|
91
|
+
```
|
|
92
|
+
|
|
93
|
+
Now, before any LLM or tool call executes:
|
|
94
|
+
|
|
95
|
+
- An Aadhaar / PAN / card number in the prompt → **blocked** (DPDP)
|
|
96
|
+
- "Ignore previous instructions…" / jailbreaks → **blocked**
|
|
97
|
+
- "Auto-approve without review" → **blocked** (RBI human-review rule)
|
|
98
|
+
|
|
99
|
+
A blocked action raises `ComplianceViolation`, and every decision (allow / warn / block) lands in your signed audit trail. The gate runs **locally in ~1 ms** — no network hop in your request path.
|
|
100
|
+
|
|
101
|
+
```python
|
|
102
|
+
from trustlayer import ComplianceViolation
|
|
103
|
+
|
|
104
|
+
try:
|
|
105
|
+
result = approve_loan(application)
|
|
106
|
+
except ComplianceViolation as e:
|
|
107
|
+
print(e.reason) # "PII detected in LLM prompt: Aadhaar number. ..."
|
|
108
|
+
```
|
|
109
|
+
|
|
110
|
+
## Zero-config tracking (no enforcement)
|
|
111
|
+
|
|
112
|
+
```python
|
|
113
|
+
import trustlayer as tl
|
|
114
|
+
tl.init(api_key="tl_live_YOUR_KEY")
|
|
115
|
+
|
|
116
|
+
# Every OpenAI / Anthropic / LangChain / LiteLLM call is now auto-captured —
|
|
117
|
+
# tokens, cost, latency, anomaly score — with no other code changes.
|
|
118
|
+
```
|
|
119
|
+
|
|
120
|
+
## Human approvals (EU AI Act Article 14 / RBI human review)
|
|
121
|
+
|
|
122
|
+
```python
|
|
123
|
+
@tl.track
|
|
124
|
+
@tl.require_approval(
|
|
125
|
+
when=lambda result: result["amount"] > 1_000_000, # only high-stakes
|
|
126
|
+
message="Loan above ₹10L requires human review.",
|
|
127
|
+
)
|
|
128
|
+
def approve_loan(application: dict) -> dict:
|
|
129
|
+
return run_underwriting_model(application)
|
|
130
|
+
```
|
|
131
|
+
|
|
132
|
+
The decision pauses in your FORMA Approvals inbox until a human approves or rejects. Fail-closed: a timeout or unreachable API is treated as a denial — a skipped review never silently passes.
|
|
133
|
+
|
|
134
|
+
---
|
|
135
|
+
|
|
136
|
+
## Policy packs
|
|
137
|
+
|
|
138
|
+
| Pack | Region | Enforces |
|
|
139
|
+
|------|--------|----------|
|
|
140
|
+
| `dpdp` | India | Aadhaar / PAN / card / phone blocked from prompts & tool args; consent-bypass blocked |
|
|
141
|
+
| `rbi_ml_risk` | India Banking | auto-approval-without-review blocked; fund-disbursal routed to approval |
|
|
142
|
+
| `eu_ai_act` | EU | human-oversight bypass (Art. 14) & logging suppression (Art. 12) blocked; PII protection |
|
|
143
|
+
| `iso42001` | Global | concealing AI involvement blocked |
|
|
144
|
+
|
|
145
|
+
---
|
|
146
|
+
|
|
147
|
+
## Manual step control
|
|
148
|
+
|
|
149
|
+
```python
|
|
150
|
+
import openai
|
|
151
|
+
import trustlayer as tl
|
|
152
|
+
|
|
153
|
+
tracker = tl.init(api_key="tl_live_YOUR_KEY", auto_capture=False)
|
|
154
|
+
|
|
155
|
+
@tracker.track(name="my-agent")
|
|
156
|
+
def my_agent(task: str) -> str:
|
|
157
|
+
with tracker.llm_call(label="generate", model="gpt-4o", prompt=task) as step:
|
|
158
|
+
resp = openai.chat.completions.create(
|
|
159
|
+
model="gpt-4o",
|
|
160
|
+
messages=[{"role": "user", "content": task}],
|
|
161
|
+
)
|
|
162
|
+
step.prompt_tokens = resp.usage.prompt_tokens
|
|
163
|
+
step.completion_tokens = resp.usage.completion_tokens
|
|
164
|
+
return resp.choices[0].message.content
|
|
165
|
+
|
|
166
|
+
# For tools: with tracker.tool_call("send_email", {"to": addr}): ...
|
|
167
|
+
```
|
|
168
|
+
|
|
169
|
+
## Kill switch
|
|
170
|
+
|
|
171
|
+
Pass `kill_switch=True` to `@tl.agent(...)` (or `tl.init(kill_switch=True)`). When you trigger a kill from the dashboard, the next LLM/tool call raises `KillSwitchTriggered` in under ~100 ms.
|
|
172
|
+
|
|
173
|
+
## CI/CD compliance gate
|
|
174
|
+
|
|
175
|
+
```bash
|
|
176
|
+
# Blocks the deploy (exit 1) if any agent is below the threshold
|
|
177
|
+
trustlayer gate --pre-deploy --fail-below 80
|
|
178
|
+
```
|
|
179
|
+
|
|
180
|
+
---
|
|
181
|
+
|
|
182
|
+
## `tl.init()` parameters
|
|
183
|
+
|
|
184
|
+
| Parameter | Type | Description |
|
|
185
|
+
|-----------|------|-------------|
|
|
186
|
+
| `api_key` | `str` | Your FORMA API key (`tl_live_…` / `tl_test_…`) |
|
|
187
|
+
| `enforce` | `list[str]` | Framework packs enforced on every call, e.g. `["dpdp"]` |
|
|
188
|
+
| `human_sponsor` | `str` | Accountable human (EU AI Act Art. 14 / RBI) |
|
|
189
|
+
| `auto_capture` | `bool` | Auto-patch OpenAI/Anthropic/LangChain/LiteLLM (default `True`) |
|
|
190
|
+
| `kill_switch` | `bool` | Start the process-level kill watcher (default `False`) |
|
|
191
|
+
| `compliance` | `list[str]` | Frameworks for scoring/reports |
|
|
192
|
+
| `agent_name` | `str` | Display name for ambient auto-captured runs |
|
|
193
|
+
|
|
194
|
+
---
|
|
195
|
+
|
|
196
|
+
## Node.js / TypeScript
|
|
197
|
+
|
|
198
|
+
```bash
|
|
199
|
+
npm install forma-sdk
|
|
200
|
+
```
|
|
201
|
+
|
|
202
|
+
```ts
|
|
203
|
+
import * as tl from "forma-sdk";
|
|
204
|
+
|
|
205
|
+
tl.init({ apiKey: "tl_live_YOUR_KEY" });
|
|
206
|
+
|
|
207
|
+
const myAgent = tl.track(
|
|
208
|
+
async (task: string) => { /* your code */ return "done"; },
|
|
209
|
+
{ name: "my-agent" },
|
|
210
|
+
);
|
|
211
|
+
```
|
|
212
|
+
|
|
213
|
+
> **Note:** runtime enforcement (`enforce`), `agent`, and approvals are **Python-only** today. The Node SDK currently provides auto-tracking (`init` + `track`); enforcement parity is on the roadmap.
|
|
214
|
+
|
|
215
|
+
---
|
|
216
|
+
|
|
217
|
+
## Dashboard & docs
|
|
218
|
+
|
|
219
|
+
- Dashboard: **[forma.2bd.net](https://forma.2bd.net)**
|
|
220
|
+
- Developer guide: [forma.2bd.net/developer-guide](https://forma.2bd.net/developer-guide)
|
|
221
|
+
- Generate a tailored snippet: [forma.2bd.net/snippet-generator](https://forma.2bd.net/snippet-generator)
|
|
222
|
+
|
|
223
|
+
## License
|
|
224
|
+
|
|
225
|
+
MIT — see [LICENSE](LICENSE).
|
|
@@ -0,0 +1,172 @@
|
|
|
1
|
+
# FORMA SDK
|
|
2
|
+
|
|
3
|
+
**Make non-compliance impossible — in one line of code.**
|
|
4
|
+
|
|
5
|
+
FORMA doesn't just record what your AI did; it **blocks non-compliant decisions before they execute**. Add `enforce=[...]` and PII leaks, prompt injections, and policy violations are stopped at runtime — then every decision is cryptographically signed and mapped to RBI, DPDP, EU AI Act, and ISO 42001.
|
|
6
|
+
|
|
7
|
+
[](LICENSE)
|
|
8
|
+
[](https://www.python.org/downloads/)
|
|
9
|
+
|
|
10
|
+
---
|
|
11
|
+
|
|
12
|
+
## Install
|
|
13
|
+
|
|
14
|
+
```bash
|
|
15
|
+
pip install forma-sdk
|
|
16
|
+
```
|
|
17
|
+
|
|
18
|
+
Import name is `trustlayer` (the legacy alias `provn` also works):
|
|
19
|
+
|
|
20
|
+
```python
|
|
21
|
+
import trustlayer as tl
|
|
22
|
+
```
|
|
23
|
+
|
|
24
|
+
## Quickstart — runtime enforcement
|
|
25
|
+
|
|
26
|
+
```python
|
|
27
|
+
import trustlayer as tl
|
|
28
|
+
|
|
29
|
+
tl.init(api_key="tl_live_YOUR_KEY") # from forma.2bd.net → Settings
|
|
30
|
+
|
|
31
|
+
@tl.agent(
|
|
32
|
+
purpose="Loan application evaluation",
|
|
33
|
+
risk_level="HIGH",
|
|
34
|
+
enforce=["rbi_ml_risk", "dpdp"], # ← blocks violations BEFORE they run
|
|
35
|
+
)
|
|
36
|
+
def approve_loan(application: dict) -> dict:
|
|
37
|
+
return run_underwriting_model(application)
|
|
38
|
+
```
|
|
39
|
+
|
|
40
|
+
Now, before any LLM or tool call executes:
|
|
41
|
+
|
|
42
|
+
- An Aadhaar / PAN / card number in the prompt → **blocked** (DPDP)
|
|
43
|
+
- "Ignore previous instructions…" / jailbreaks → **blocked**
|
|
44
|
+
- "Auto-approve without review" → **blocked** (RBI human-review rule)
|
|
45
|
+
|
|
46
|
+
A blocked action raises `ComplianceViolation`, and every decision (allow / warn / block) lands in your signed audit trail. The gate runs **locally in ~1 ms** — no network hop in your request path.
|
|
47
|
+
|
|
48
|
+
```python
|
|
49
|
+
from trustlayer import ComplianceViolation
|
|
50
|
+
|
|
51
|
+
try:
|
|
52
|
+
result = approve_loan(application)
|
|
53
|
+
except ComplianceViolation as e:
|
|
54
|
+
print(e.reason) # "PII detected in LLM prompt: Aadhaar number. ..."
|
|
55
|
+
```
|
|
56
|
+
|
|
57
|
+
## Zero-config tracking (no enforcement)
|
|
58
|
+
|
|
59
|
+
```python
|
|
60
|
+
import trustlayer as tl
|
|
61
|
+
tl.init(api_key="tl_live_YOUR_KEY")
|
|
62
|
+
|
|
63
|
+
# Every OpenAI / Anthropic / LangChain / LiteLLM call is now auto-captured —
|
|
64
|
+
# tokens, cost, latency, anomaly score — with no other code changes.
|
|
65
|
+
```
|
|
66
|
+
|
|
67
|
+
## Human approvals (EU AI Act Article 14 / RBI human review)
|
|
68
|
+
|
|
69
|
+
```python
|
|
70
|
+
@tl.track
|
|
71
|
+
@tl.require_approval(
|
|
72
|
+
when=lambda result: result["amount"] > 1_000_000, # only high-stakes
|
|
73
|
+
message="Loan above ₹10L requires human review.",
|
|
74
|
+
)
|
|
75
|
+
def approve_loan(application: dict) -> dict:
|
|
76
|
+
return run_underwriting_model(application)
|
|
77
|
+
```
|
|
78
|
+
|
|
79
|
+
The decision pauses in your FORMA Approvals inbox until a human approves or rejects. Fail-closed: a timeout or unreachable API is treated as a denial — a skipped review never silently passes.
|
|
80
|
+
|
|
81
|
+
---
|
|
82
|
+
|
|
83
|
+
## Policy packs
|
|
84
|
+
|
|
85
|
+
| Pack | Region | Enforces |
|
|
86
|
+
|------|--------|----------|
|
|
87
|
+
| `dpdp` | India | Aadhaar / PAN / card / phone blocked from prompts & tool args; consent-bypass blocked |
|
|
88
|
+
| `rbi_ml_risk` | India Banking | auto-approval-without-review blocked; fund-disbursal routed to approval |
|
|
89
|
+
| `eu_ai_act` | EU | human-oversight bypass (Art. 14) & logging suppression (Art. 12) blocked; PII protection |
|
|
90
|
+
| `iso42001` | Global | concealing AI involvement blocked |
|
|
91
|
+
|
|
92
|
+
---
|
|
93
|
+
|
|
94
|
+
## Manual step control
|
|
95
|
+
|
|
96
|
+
```python
|
|
97
|
+
import openai
|
|
98
|
+
import trustlayer as tl
|
|
99
|
+
|
|
100
|
+
tracker = tl.init(api_key="tl_live_YOUR_KEY", auto_capture=False)
|
|
101
|
+
|
|
102
|
+
@tracker.track(name="my-agent")
|
|
103
|
+
def my_agent(task: str) -> str:
|
|
104
|
+
with tracker.llm_call(label="generate", model="gpt-4o", prompt=task) as step:
|
|
105
|
+
resp = openai.chat.completions.create(
|
|
106
|
+
model="gpt-4o",
|
|
107
|
+
messages=[{"role": "user", "content": task}],
|
|
108
|
+
)
|
|
109
|
+
step.prompt_tokens = resp.usage.prompt_tokens
|
|
110
|
+
step.completion_tokens = resp.usage.completion_tokens
|
|
111
|
+
return resp.choices[0].message.content
|
|
112
|
+
|
|
113
|
+
# For tools: with tracker.tool_call("send_email", {"to": addr}): ...
|
|
114
|
+
```
|
|
115
|
+
|
|
116
|
+
## Kill switch
|
|
117
|
+
|
|
118
|
+
Pass `kill_switch=True` to `@tl.agent(...)` (or `tl.init(kill_switch=True)`). When you trigger a kill from the dashboard, the next LLM/tool call raises `KillSwitchTriggered` in under ~100 ms.
|
|
119
|
+
|
|
120
|
+
## CI/CD compliance gate
|
|
121
|
+
|
|
122
|
+
```bash
|
|
123
|
+
# Blocks the deploy (exit 1) if any agent is below the threshold
|
|
124
|
+
trustlayer gate --pre-deploy --fail-below 80
|
|
125
|
+
```
|
|
126
|
+
|
|
127
|
+
---
|
|
128
|
+
|
|
129
|
+
## `tl.init()` parameters
|
|
130
|
+
|
|
131
|
+
| Parameter | Type | Description |
|
|
132
|
+
|-----------|------|-------------|
|
|
133
|
+
| `api_key` | `str` | Your FORMA API key (`tl_live_…` / `tl_test_…`) |
|
|
134
|
+
| `enforce` | `list[str]` | Framework packs enforced on every call, e.g. `["dpdp"]` |
|
|
135
|
+
| `human_sponsor` | `str` | Accountable human (EU AI Act Art. 14 / RBI) |
|
|
136
|
+
| `auto_capture` | `bool` | Auto-patch OpenAI/Anthropic/LangChain/LiteLLM (default `True`) |
|
|
137
|
+
| `kill_switch` | `bool` | Start the process-level kill watcher (default `False`) |
|
|
138
|
+
| `compliance` | `list[str]` | Frameworks for scoring/reports |
|
|
139
|
+
| `agent_name` | `str` | Display name for ambient auto-captured runs |
|
|
140
|
+
|
|
141
|
+
---
|
|
142
|
+
|
|
143
|
+
## Node.js / TypeScript
|
|
144
|
+
|
|
145
|
+
```bash
|
|
146
|
+
npm install forma-sdk
|
|
147
|
+
```
|
|
148
|
+
|
|
149
|
+
```ts
|
|
150
|
+
import * as tl from "forma-sdk";
|
|
151
|
+
|
|
152
|
+
tl.init({ apiKey: "tl_live_YOUR_KEY" });
|
|
153
|
+
|
|
154
|
+
const myAgent = tl.track(
|
|
155
|
+
async (task: string) => { /* your code */ return "done"; },
|
|
156
|
+
{ name: "my-agent" },
|
|
157
|
+
);
|
|
158
|
+
```
|
|
159
|
+
|
|
160
|
+
> **Note:** runtime enforcement (`enforce`), `agent`, and approvals are **Python-only** today. The Node SDK currently provides auto-tracking (`init` + `track`); enforcement parity is on the roadmap.
|
|
161
|
+
|
|
162
|
+
---
|
|
163
|
+
|
|
164
|
+
## Dashboard & docs
|
|
165
|
+
|
|
166
|
+
- Dashboard: **[forma.2bd.net](https://forma.2bd.net)**
|
|
167
|
+
- Developer guide: [forma.2bd.net/developer-guide](https://forma.2bd.net/developer-guide)
|
|
168
|
+
- Generate a tailored snippet: [forma.2bd.net/snippet-generator](https://forma.2bd.net/snippet-generator)
|
|
169
|
+
|
|
170
|
+
## License
|
|
171
|
+
|
|
172
|
+
MIT — see [LICENSE](LICENSE).
|
|
@@ -0,0 +1,225 @@
|
|
|
1
|
+
Metadata-Version: 2.4
|
|
2
|
+
Name: forma-sdk
|
|
3
|
+
Version: 1.1.0
|
|
4
|
+
Summary: FORMA — AI agent compliance SDK. Zero-config tracking, EU AI Act/DPDP/RBI compliance, cryptographic audit trails.
|
|
5
|
+
Home-page: https://github.com/amit5115/forma-sdk
|
|
6
|
+
Author: FORMA
|
|
7
|
+
Author-email: sdk@forma.ai
|
|
8
|
+
Keywords: ai agents compliance eu-ai-act rbi dpdp audit cryptography llm openai
|
|
9
|
+
Classifier: Development Status :: 4 - Beta
|
|
10
|
+
Classifier: Intended Audience :: Developers
|
|
11
|
+
Classifier: License :: OSI Approved :: MIT License
|
|
12
|
+
Classifier: Programming Language :: Python :: 3
|
|
13
|
+
Classifier: Programming Language :: Python :: 3.8
|
|
14
|
+
Classifier: Programming Language :: Python :: 3.9
|
|
15
|
+
Classifier: Programming Language :: Python :: 3.10
|
|
16
|
+
Classifier: Programming Language :: Python :: 3.11
|
|
17
|
+
Classifier: Programming Language :: Python :: 3.12
|
|
18
|
+
Classifier: Topic :: Software Development :: Libraries :: Python Modules
|
|
19
|
+
Classifier: Topic :: Scientific/Engineering :: Artificial Intelligence
|
|
20
|
+
Requires-Python: >=3.8
|
|
21
|
+
Description-Content-Type: text/markdown
|
|
22
|
+
License-File: LICENSE
|
|
23
|
+
Requires-Dist: httpx>=0.24.0
|
|
24
|
+
Requires-Dist: pydantic>=2.0
|
|
25
|
+
Provides-Extra: cli
|
|
26
|
+
Requires-Dist: click>=8.0; extra == "cli"
|
|
27
|
+
Provides-Extra: openai
|
|
28
|
+
Requires-Dist: openai>=1.0; extra == "openai"
|
|
29
|
+
Provides-Extra: anthropic
|
|
30
|
+
Requires-Dist: anthropic>=0.20; extra == "anthropic"
|
|
31
|
+
Provides-Extra: litellm
|
|
32
|
+
Requires-Dist: litellm>=1.0; extra == "litellm"
|
|
33
|
+
Provides-Extra: langchain
|
|
34
|
+
Requires-Dist: langchain-core>=0.1; extra == "langchain"
|
|
35
|
+
Provides-Extra: all
|
|
36
|
+
Requires-Dist: click>=8.0; extra == "all"
|
|
37
|
+
Requires-Dist: openai>=1.0; extra == "all"
|
|
38
|
+
Requires-Dist: anthropic>=0.20; extra == "all"
|
|
39
|
+
Requires-Dist: litellm>=1.0; extra == "all"
|
|
40
|
+
Requires-Dist: langchain-core>=0.1; extra == "all"
|
|
41
|
+
Dynamic: author
|
|
42
|
+
Dynamic: author-email
|
|
43
|
+
Dynamic: classifier
|
|
44
|
+
Dynamic: description
|
|
45
|
+
Dynamic: description-content-type
|
|
46
|
+
Dynamic: home-page
|
|
47
|
+
Dynamic: keywords
|
|
48
|
+
Dynamic: license-file
|
|
49
|
+
Dynamic: provides-extra
|
|
50
|
+
Dynamic: requires-dist
|
|
51
|
+
Dynamic: requires-python
|
|
52
|
+
Dynamic: summary
|
|
53
|
+
|
|
54
|
+
# FORMA SDK
|
|
55
|
+
|
|
56
|
+
**Make non-compliance impossible — in one line of code.**
|
|
57
|
+
|
|
58
|
+
FORMA doesn't just record what your AI did; it **blocks non-compliant decisions before they execute**. Add `enforce=[...]` and PII leaks, prompt injections, and policy violations are stopped at runtime — then every decision is cryptographically signed and mapped to RBI, DPDP, EU AI Act, and ISO 42001.
|
|
59
|
+
|
|
60
|
+
[](LICENSE)
|
|
61
|
+
[](https://www.python.org/downloads/)
|
|
62
|
+
|
|
63
|
+
---
|
|
64
|
+
|
|
65
|
+
## Install
|
|
66
|
+
|
|
67
|
+
```bash
|
|
68
|
+
pip install forma-sdk
|
|
69
|
+
```
|
|
70
|
+
|
|
71
|
+
Import name is `trustlayer` (the legacy alias `provn` also works):
|
|
72
|
+
|
|
73
|
+
```python
|
|
74
|
+
import trustlayer as tl
|
|
75
|
+
```
|
|
76
|
+
|
|
77
|
+
## Quickstart — runtime enforcement
|
|
78
|
+
|
|
79
|
+
```python
|
|
80
|
+
import trustlayer as tl
|
|
81
|
+
|
|
82
|
+
tl.init(api_key="tl_live_YOUR_KEY") # from forma.2bd.net → Settings
|
|
83
|
+
|
|
84
|
+
@tl.agent(
|
|
85
|
+
purpose="Loan application evaluation",
|
|
86
|
+
risk_level="HIGH",
|
|
87
|
+
enforce=["rbi_ml_risk", "dpdp"], # ← blocks violations BEFORE they run
|
|
88
|
+
)
|
|
89
|
+
def approve_loan(application: dict) -> dict:
|
|
90
|
+
return run_underwriting_model(application)
|
|
91
|
+
```
|
|
92
|
+
|
|
93
|
+
Now, before any LLM or tool call executes:
|
|
94
|
+
|
|
95
|
+
- An Aadhaar / PAN / card number in the prompt → **blocked** (DPDP)
|
|
96
|
+
- "Ignore previous instructions…" / jailbreaks → **blocked**
|
|
97
|
+
- "Auto-approve without review" → **blocked** (RBI human-review rule)
|
|
98
|
+
|
|
99
|
+
A blocked action raises `ComplianceViolation`, and every decision (allow / warn / block) lands in your signed audit trail. The gate runs **locally in ~1 ms** — no network hop in your request path.
|
|
100
|
+
|
|
101
|
+
```python
|
|
102
|
+
from trustlayer import ComplianceViolation
|
|
103
|
+
|
|
104
|
+
try:
|
|
105
|
+
result = approve_loan(application)
|
|
106
|
+
except ComplianceViolation as e:
|
|
107
|
+
print(e.reason) # "PII detected in LLM prompt: Aadhaar number. ..."
|
|
108
|
+
```
|
|
109
|
+
|
|
110
|
+
## Zero-config tracking (no enforcement)
|
|
111
|
+
|
|
112
|
+
```python
|
|
113
|
+
import trustlayer as tl
|
|
114
|
+
tl.init(api_key="tl_live_YOUR_KEY")
|
|
115
|
+
|
|
116
|
+
# Every OpenAI / Anthropic / LangChain / LiteLLM call is now auto-captured —
|
|
117
|
+
# tokens, cost, latency, anomaly score — with no other code changes.
|
|
118
|
+
```
|
|
119
|
+
|
|
120
|
+
## Human approvals (EU AI Act Article 14 / RBI human review)
|
|
121
|
+
|
|
122
|
+
```python
|
|
123
|
+
@tl.track
|
|
124
|
+
@tl.require_approval(
|
|
125
|
+
when=lambda result: result["amount"] > 1_000_000, # only high-stakes
|
|
126
|
+
message="Loan above ₹10L requires human review.",
|
|
127
|
+
)
|
|
128
|
+
def approve_loan(application: dict) -> dict:
|
|
129
|
+
return run_underwriting_model(application)
|
|
130
|
+
```
|
|
131
|
+
|
|
132
|
+
The decision pauses in your FORMA Approvals inbox until a human approves or rejects. Fail-closed: a timeout or unreachable API is treated as a denial — a skipped review never silently passes.
|
|
133
|
+
|
|
134
|
+
---
|
|
135
|
+
|
|
136
|
+
## Policy packs
|
|
137
|
+
|
|
138
|
+
| Pack | Region | Enforces |
|
|
139
|
+
|------|--------|----------|
|
|
140
|
+
| `dpdp` | India | Aadhaar / PAN / card / phone blocked from prompts & tool args; consent-bypass blocked |
|
|
141
|
+
| `rbi_ml_risk` | India Banking | auto-approval-without-review blocked; fund-disbursal routed to approval |
|
|
142
|
+
| `eu_ai_act` | EU | human-oversight bypass (Art. 14) & logging suppression (Art. 12) blocked; PII protection |
|
|
143
|
+
| `iso42001` | Global | concealing AI involvement blocked |
|
|
144
|
+
|
|
145
|
+
---
|
|
146
|
+
|
|
147
|
+
## Manual step control
|
|
148
|
+
|
|
149
|
+
```python
|
|
150
|
+
import openai
|
|
151
|
+
import trustlayer as tl
|
|
152
|
+
|
|
153
|
+
tracker = tl.init(api_key="tl_live_YOUR_KEY", auto_capture=False)
|
|
154
|
+
|
|
155
|
+
@tracker.track(name="my-agent")
|
|
156
|
+
def my_agent(task: str) -> str:
|
|
157
|
+
with tracker.llm_call(label="generate", model="gpt-4o", prompt=task) as step:
|
|
158
|
+
resp = openai.chat.completions.create(
|
|
159
|
+
model="gpt-4o",
|
|
160
|
+
messages=[{"role": "user", "content": task}],
|
|
161
|
+
)
|
|
162
|
+
step.prompt_tokens = resp.usage.prompt_tokens
|
|
163
|
+
step.completion_tokens = resp.usage.completion_tokens
|
|
164
|
+
return resp.choices[0].message.content
|
|
165
|
+
|
|
166
|
+
# For tools: with tracker.tool_call("send_email", {"to": addr}): ...
|
|
167
|
+
```
|
|
168
|
+
|
|
169
|
+
## Kill switch
|
|
170
|
+
|
|
171
|
+
Pass `kill_switch=True` to `@tl.agent(...)` (or `tl.init(kill_switch=True)`). When you trigger a kill from the dashboard, the next LLM/tool call raises `KillSwitchTriggered` in under ~100 ms.
|
|
172
|
+
|
|
173
|
+
## CI/CD compliance gate
|
|
174
|
+
|
|
175
|
+
```bash
|
|
176
|
+
# Blocks the deploy (exit 1) if any agent is below the threshold
|
|
177
|
+
trustlayer gate --pre-deploy --fail-below 80
|
|
178
|
+
```
|
|
179
|
+
|
|
180
|
+
---
|
|
181
|
+
|
|
182
|
+
## `tl.init()` parameters
|
|
183
|
+
|
|
184
|
+
| Parameter | Type | Description |
|
|
185
|
+
|-----------|------|-------------|
|
|
186
|
+
| `api_key` | `str` | Your FORMA API key (`tl_live_…` / `tl_test_…`) |
|
|
187
|
+
| `enforce` | `list[str]` | Framework packs enforced on every call, e.g. `["dpdp"]` |
|
|
188
|
+
| `human_sponsor` | `str` | Accountable human (EU AI Act Art. 14 / RBI) |
|
|
189
|
+
| `auto_capture` | `bool` | Auto-patch OpenAI/Anthropic/LangChain/LiteLLM (default `True`) |
|
|
190
|
+
| `kill_switch` | `bool` | Start the process-level kill watcher (default `False`) |
|
|
191
|
+
| `compliance` | `list[str]` | Frameworks for scoring/reports |
|
|
192
|
+
| `agent_name` | `str` | Display name for ambient auto-captured runs |
|
|
193
|
+
|
|
194
|
+
---
|
|
195
|
+
|
|
196
|
+
## Node.js / TypeScript
|
|
197
|
+
|
|
198
|
+
```bash
|
|
199
|
+
npm install forma-sdk
|
|
200
|
+
```
|
|
201
|
+
|
|
202
|
+
```ts
|
|
203
|
+
import * as tl from "forma-sdk";
|
|
204
|
+
|
|
205
|
+
tl.init({ apiKey: "tl_live_YOUR_KEY" });
|
|
206
|
+
|
|
207
|
+
const myAgent = tl.track(
|
|
208
|
+
async (task: string) => { /* your code */ return "done"; },
|
|
209
|
+
{ name: "my-agent" },
|
|
210
|
+
);
|
|
211
|
+
```
|
|
212
|
+
|
|
213
|
+
> **Note:** runtime enforcement (`enforce`), `agent`, and approvals are **Python-only** today. The Node SDK currently provides auto-tracking (`init` + `track`); enforcement parity is on the roadmap.
|
|
214
|
+
|
|
215
|
+
---
|
|
216
|
+
|
|
217
|
+
## Dashboard & docs
|
|
218
|
+
|
|
219
|
+
- Dashboard: **[forma.2bd.net](https://forma.2bd.net)**
|
|
220
|
+
- Developer guide: [forma.2bd.net/developer-guide](https://forma.2bd.net/developer-guide)
|
|
221
|
+
- Generate a tailored snippet: [forma.2bd.net/snippet-generator](https://forma.2bd.net/snippet-generator)
|
|
222
|
+
|
|
223
|
+
## License
|
|
224
|
+
|
|
225
|
+
MIT — see [LICENSE](LICENSE).
|
|
@@ -0,0 +1,20 @@
|
|
|
1
|
+
LICENSE
|
|
2
|
+
README.md
|
|
3
|
+
pyproject.toml
|
|
4
|
+
setup.py
|
|
5
|
+
forma_sdk.egg-info/PKG-INFO
|
|
6
|
+
forma_sdk.egg-info/SOURCES.txt
|
|
7
|
+
forma_sdk.egg-info/dependency_links.txt
|
|
8
|
+
forma_sdk.egg-info/entry_points.txt
|
|
9
|
+
forma_sdk.egg-info/requires.txt
|
|
10
|
+
forma_sdk.egg-info/top_level.txt
|
|
11
|
+
provn/__init__.py
|
|
12
|
+
trustlayer/__init__.py
|
|
13
|
+
trustlayer/approval.py
|
|
14
|
+
trustlayer/auto.py
|
|
15
|
+
trustlayer/cli.py
|
|
16
|
+
trustlayer/client.py
|
|
17
|
+
trustlayer/crypto.py
|
|
18
|
+
trustlayer/gate_local.py
|
|
19
|
+
trustlayer/models.py
|
|
20
|
+
trustlayer/tracker.py
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
|
|
@@ -0,0 +1,24 @@
|
|
|
1
|
+
httpx>=0.24.0
|
|
2
|
+
pydantic>=2.0
|
|
3
|
+
|
|
4
|
+
[all]
|
|
5
|
+
click>=8.0
|
|
6
|
+
openai>=1.0
|
|
7
|
+
anthropic>=0.20
|
|
8
|
+
litellm>=1.0
|
|
9
|
+
langchain-core>=0.1
|
|
10
|
+
|
|
11
|
+
[anthropic]
|
|
12
|
+
anthropic>=0.20
|
|
13
|
+
|
|
14
|
+
[cli]
|
|
15
|
+
click>=8.0
|
|
16
|
+
|
|
17
|
+
[langchain]
|
|
18
|
+
langchain-core>=0.1
|
|
19
|
+
|
|
20
|
+
[litellm]
|
|
21
|
+
litellm>=1.0
|
|
22
|
+
|
|
23
|
+
[openai]
|
|
24
|
+
openai>=1.0
|