trellisd 0.1.0__py3-none-any.whl

trellisd/__init__.py

@@ -0,0 +1,37 @@
+"""Trellis: delegated access control and a tamper-evident audit ledger for AI agents.
+
+The package, import and CLI name is ``trellisd``.
+"""
+
+from trellisd.app import Trellis
+from trellisd.catalog import Catalog, ConfigCatalog, TableInfo
+from trellisd.config import ConfigError, TrellisConfig, load_config
+from trellisd.db import Database
+from trellisd.engine import CheckResult, Decision, Engine
+from trellisd.grants import Grant, GrantError, GrantStore, IssuedGrant
+from trellisd.ledger import Ledger, LedgerEvent, LedgerUnavailable, VerifyResult
+
+__version__ = "0.1.0"
+
+__all__ = [
+    "Catalog",
+    "CheckResult",
+    "ConfigCatalog",
+    "ConfigError",
+    "Database",
+    "Decision",
+    "Engine",
+    "Grant",
+    "GrantError",
+    "GrantStore",
+    "IssuedGrant",
+    "Ledger",
+    "LedgerEvent",
+    "LedgerUnavailable",
+    "TableInfo",
+    "Trellis",
+    "TrellisConfig",
+    "VerifyResult",
+    "__version__",
+    "load_config",
+]

trellisd/_examples/lakehouse/agents.yaml

@@ -0,0 +1,9 @@
+agents:
+  report-bot:
+    owner: dana@example.com
+    description: Drafts finance reports.
+    ceiling:
+      actions: [read, query]
+      # confidential covers the levels under it (public, internal) too.
+      tags: [finance, pii, confidential]
+      never: [export_controlled]

trellisd/_examples/lakehouse/catalogs.yaml

@@ -0,0 +1,12 @@
+# Catalogs Trellis reads tags from. Read-only: Trellis never writes to them.
+# `trellisd demo catalog-says-pii` points this at a local catalog it starts itself.
+catalogs:
+  lakehouse:
+    type: iceberg-rest
+    uri: http://localhost:8181
+    namespaces: [finance]
+    ttl_seconds: 300            # a pushed change evicts sooner (Trellis.tags_changed)
+    stale_after_seconds: 900    # past this with the catalog down, every call is denied
+
+# The ranked scale, lowest first. A resource keeps the highest level any source gives it.
+levels: [public, internal, confidential, restricted]

trellisd/_examples/lakehouse/contracts/cash_positions.odcs.yaml

@@ -0,0 +1,37 @@
+# An ODCS v3 contract, read through Trellis's ODCS adapter (no rewrite needed).
+apiVersion: v3.0.2
+kind: DataContract
+id: treasury-cash-positions
+name: Cash positions
+version: 1.2.0
+status: active
+domain: treasury
+team:
+  - username: treasury-owner@example.com
+    role: owner
+servers:
+  - server: lakehouse
+    type: iceberg
+    schema: finance.treasury
+tags: [finance]
+schema:
+  - name: cash_positions
+    physicalName: cash_positions
+    logicalType: object
+    classification: confidential
+    properties:
+      - name: account
+        logicalType: string
+        tags: [pii]
+      - name: balance
+        logicalType: number
+roles:
+  - role: treasury
+    access: read
+customProperties:
+  - property: trellis.mask
+    value: [pii]
+quality:
+  - type: library
+    rule: rowCount
+    mustBeGreaterThan: 0

trellisd/_examples/lakehouse/contracts/finance.gl.yaml

@@ -0,0 +1,25 @@
+# The general ledger's contract, written by its owner. The source of truth for what the
+# table is and who may read it; a catalog can add tags to it, never take them away.
+contract: urn:contract:finance.gl
+version: 3
+kind: table
+description: Posted journal entries, one row per line.
+bindings:
+  - finance.gl.journal_entries
+  - mcp://ledger/journal_entries
+owner: finance-owner@example.com
+steward: finance-steward@example.com
+tags: [finance, internal]
+elements:
+  entry_id: []
+  amount: []
+  region: []
+  approver_email: []
+purposes: [financial_close]
+access:
+  analysts:
+    who: [group:finance-analysts]
+    actions: [read, query]
+    mask: [pii]
+rows:
+  - "region = {person.region}"

trellisd/_examples/lakehouse/people.yaml

@@ -0,0 +1,8 @@
+# The directory. M4 replaces this with your IdP's groups and claims.
+people:
+  ana@example.com:
+    groups: [finance-analysts]
+    attributes: {region: emea}
+  tom@example.com:
+    groups: [treasury]
+    attributes: {region: amer}

trellisd/_examples/three-keys/access.yaml

@@ -0,0 +1,22 @@
+# What people may read. Contracts add to this in M3.
+access:
+  - id: finance-gl
+    description: Finance analysts read the general ledger for their own region, PII masked.
+    who: [group:finance-analysts]
+    resources: [finance.gl]
+    tags: [finance]
+    mask: [pii]
+    row_filter: "region = {person.region}"
+  - id: treasury
+    who: [group:treasury]
+    resources: [finance.treasury]
+    tags: [finance]
+  - id: ana-hr
+    description: Ana covers HR reporting this quarter.
+    who: [user:ana@example.com]
+    resources: [hr]
+    tags: [hr]
+  - id: quality
+    who: [group:quality]
+    resources: [quality]
+    tags: [quality]

trellisd/_examples/three-keys/agents.yaml

@@ -0,0 +1,17 @@
+# Each agent's owner sets its ceiling: the most it may ever touch, whoever it works for.
+agents:
+  report-bot:
+    owner: ana@example.com
+    description: Drafts finance reports.
+    identities: [local:report-bot]      # the client it signs in as (see identity.yaml)
+    ceiling:
+      actions: [read, query]
+      tags: [finance, pii, hr]
+      never: [export_controlled]
+  inspector-bot:
+    owner: quality-lead@example.com
+    description: Reviews one inspection record when it is filed.
+    identities: [local:inspector-bot]
+    ceiling:
+      actions: [read]
+      tags: [quality]

trellisd/_examples/three-keys/catalog.yaml

@@ -0,0 +1,30 @@
+# Tables and their tags. M3 reads these from contracts and the Iceberg REST catalog.
+catalog:
+  finance.gl.journal_entries:
+    tags: [finance]
+    columns:
+      entry_id: []
+      amount: []
+      region: []
+      approver_email: [pii]
+  finance.gl.export_ledger:
+    tags: [finance, export_controlled]
+    columns:
+      shipment_id: []
+      eccn: []
+  finance.treasury.cash_positions:
+    tags: [finance]
+    columns:
+      account: []
+      balance: []
+  hr.payroll:
+    tags: [hr, pii]
+    columns:
+      employee: []
+      salary: []
+  quality.inspections:
+    tags: [quality]
+    columns:
+      inspection_id: []
+      result: []
+      inspector_email: [pii]

trellisd/_examples/three-keys/identity.yaml

@@ -0,0 +1,13 @@
+# Sign-in: the IdPs whose tokens Trellis accepts. Trellis brokers sign-in; it never holds
+# passwords or creates users. A person is named by their email claim and must be under
+# people; an agent signs in as a client listed in its identities (agents.yaml).
+#
+# This one is the Keycloak realm in examples/idp/keycloak (see demo/M4.md). Any OIDC IdP
+# works the same way; for Entra, set exchange: entra-obo, and for Okta or Ping, rfc8693.
+idps:
+  local:
+    issuer: http://localhost:8183/realms/trellis
+    audience: trellis
+    exchange: rfc8693              # how Trellis gets a downstream token for the person
+    client_id: trellis             # Trellis's own client at the IdP
+    client_secret_env: TRELLIS_IDP_SECRET

trellisd/_examples/three-keys/people.yaml

@@ -0,0 +1,10 @@
+# The directory. In M4 an identity provider replaces this file.
+people:
+  ana@example.com:
+    groups: [finance-analysts]
+    attributes: {region: emea}
+  tom@example.com:
+    groups: [treasury]
+    attributes: {region: amer}
+  quality-lead@example.com:
+    groups: [quality]

trellisd/_examples/three-keys/purposes.yaml

@@ -0,0 +1,13 @@
+# Purpose grants: standing scope for process agents, each with a named human owner.
+purposes:
+  inspection-review:
+    owner: quality-lead@example.com
+    description: Review each inspection when it is filed.
+    agents: [inspector-bot]
+    actions: [read]
+    resources: [quality]
+    tags: [quality]
+    trigger:
+      type: inspection
+      tags: [quality]
+      row_filter: "inspection_id = {trigger.record}"