Visible disclosure
User-facing text label that marks AI-generated content. Covered — disclosure_text + disclosure_html_widget.
Apohara TrustLayer · v3.0 + W7/W8/W9 · 2026
Forensic receipts your AI evidence stands up in court — and in audit.
TrustLayer produces COSE_Sign1 receipts with Ed25519 + ML-DSA-65 hybrid signatures, RFC 3161 qualified timestamps from Actalis Italia, and SCITT anchors — so your AI evidence stands up in court and in audit. EU AI Act Art. 50 + DORA + PLD 2024/2853 + ISO 42001.
tl-mcp-server · stdio JSON-RPC · Claude Code / Cursor / Codexcoset 0.4.2 pinnedEvery disclosure reports 4 independent layers per EU AI Act Art. 50 + Code of Practice §3.2. The rollup is most-restrictive-wins — a NonCompliant in any layer forces the global rollup. We surface NotApplicable and Partial honestly; we never false-positive green.
User-facing text label that marks AI-generated content. Covered — disclosure_text + disclosure_html_widget.
COSE_Sign1 envelope (RFC 9052) + RFC 3161 qualified timestamp from Actalis Italia (eIDAS). Full CMS signature verification per RFC 5652 §5.6.
● CompliantPure-Python Kirchenbauer z-test detector (z > 4.0) for text. Covered for text; Partial for image / audio / video (planned v1.1.1).
INSERT-only tables: disclosure_records + tool_execution_receipts + policy_decisions + key_rotation_events. 3y EU AI Act · 5y DORA.
Three regulations you are already subject to. The deadlines are not negotiable; the evidence you keep is.
Fines for AI-generated content without machine-readable provenance or visible disclosure. Applies to deployers and providers in the EU market.
Deadline · 2 August 2026Shifts the burden of proof to the plaintiff when a seller holds a verifiable evidence pack. Without it, defect is presumed — under PLD Art. 10.
Deadline · 9 December 2026Tamper-evident ICT incident logs required for credit institutions, insurers, and investment firms. Operational-resilience fines are layered on top.
In force since · 17 January 2025Three tabs mirror the production endpoints. Client-side only — no backend, no network, no secrets.
Client-side simulation · no backend · no network. Production uses real Actalis Italia RFC 3161 + real SCITT + real WASM SDK (tl-wasm).
| Layer | Evidence | Status |
|---|---|---|
| Visible disclosure | disclosure_text + html_widget present | PASS |
| Machine-readable | COSE_Sign1 + RFC 3161 verified (Actalis Italia) | PASS |
| Watermark | Kirchenbauer z-test (z > 4.0) — text only | WARN |
| Retention | Append-only chain · 3y EU / 5y DORA | PASS |
# pip install apohara-trustlayer from apohara_trustlayer import Notary notary = Notary(api_key="…") cert = notary.notarize( content="Report generated by GPT-4o on 2026-06-27", ai_system_id="gpt-4o@openai", tenant="acme", ) print(cert.cert_id, cert.content_hash)
// npm i @apohara/trustlayer import { Notary } from "@apohara/trustlayer"; const notary = new Notary({ apiKey: process.env.TL_KEY! }); const cert = await notary.notarize({ content: "Report generated by GPT-4o on 2026-06-27", aiSystemId: "gpt-4o@openai", tenant: "acme", }); console.log(cert.certId, cert.contentHash);
// go get github.com/SuarezPM/apohara-trustlayer/sdk/go package main import ( "context" "log" "github.com/SuarezPM/apohara-trustlayer/sdk/go" ) func main() { n := trustlayer.New("…") cert, err := n.Notarize(context.Background(), trustlayer.NotarizeRequest{ Content: "Report generated by GPT-4o on 2026-06-27", AISystemID: "gpt-4o@openai", Tenant: "acme", }) if err != nil { log.Fatal(err) } log.Println(cert.CertID, cert.ContentHash) }
Five endpoints, eight standards, one frozen smoke-test artifact you can verify offline.
# Frozen smoke-test artifact — openssl ts -verify + cargo test output # Audit-trail drift detection: sha256 of v1.1.x_output.txt must match. # Regression asserted by tests/test_smoke_test_artifact.py artifact: audit_artifacts/smoke_test/v1.1.x_output.txt sha256: c693f2f95fddf3c7aceb9ff42a489a17d4a34311e9350f3eee86dd0e26a35b88 openssl: Verification: OK # RFC 3161 + RFC 5652 §5.6 chain re-walked cargo: test result: ok. 1287 passed; 0 failed # 1,137 Rust + 119 tl-evidence + 21 TS + 16 Go pytest: 202 passed in 28.4s # Python control plane # HONEST DISCLOSURES (per AC-22): the artifact names every synthetic # / demo-grade part. We never false-positive green.
Per README W5. Real numbers, not a sales deck.
MIT / Apache-2.0 dual-license. All 5 crates + 36 MCP tools + 4-layer compliance + SCITT client. Self-host the control plane; bring your own RFC 3161 QTSP.
Hosted control plane · multi-tenant · managed SCITT transparency log · Actalis Italia RFC 3161 QTSP included. Idempotent on (content_hash, submitted_by).
DORA Art. 19-20 evidence pack (7/7 checks all Compliant) · HSM + QES adapters · on-prem deployment · dedicated Slack channel. SSO + SCIM included.
Design partner program · 2026-07-10 application deadline
EU financial services subject to DORA Art. 9-13 · AI providers subject to EU AI Act Art. 50(2) · product makers subject to PLD 2024/2853 · ISO/IEC 42001:2023 AIMS aspirants. 6 months free, full production stack, direct Slack channel with Pablo.