Product · Open source
Everything you need to check us is public.
The code, the specification, the verifier and the test vectors are all in public repositories. You can read them, run them and compare them with what we say.
- 4 public repositories
- 32 specification documents
Four repositories, one chain of evidence.
- qodiqa holds the specification, 32 documents.
- qodiqa-gateway is the reference implementation. It writes each decision as evidence: an audit log, a transparency log and a signed receipt.
- qodiqa-anchors can hold signed checkpoints outside the gateway.
- qodiqa-verify checks the evidence offline and holds the test vectors. You run it yourself.
Check it yourself.
Four ways to test our claims without taking our word for it.
Run the published test vectors
In a clone of qodiqa-verify (Node.js 18 or later). The checks use the Node standard library, and a separately written Python implementation runs the same vectors where Python is installed.
ExpectedEvery check prints PASS and the run ends with all checks passed.
npm testVerify evidence offline
Two recorded sessions ship with the verifier, signed with throwaway keys. The second command checks a copy with one field changed. Prefer the browser? Open the verifier.
ExpectedThe first command exits 0 and prints "valid": true. The tampered copy exits 1.
node bin/verify.bundle.external.js \
--keys examples/front-half/keys.json \
--transparency-keys examples/front-half/transparency-keys.json \
examples/front-half/bundle-with-proof.json
node bin/verify.bundle.external.js \
--keys examples/front-half/keys.json \
--transparency-keys examples/front-half/transparency-keys.json \
examples/front-half/bundle-tampered.jsonStart the sandbox gateway
Needs Docker with Compose v2. The sandbox answers with a built-in stand-in for the AI model, so no provider account is needed. It is for evaluation, not for deployment. Then sign and send a request.
Expectedcurl http://127.0.0.1:3000/health answers with "status":"ok".
git clone https://github.com/qodiqa/qodiqa-gateway.git && cd qodiqa-gateway
docker compose -f docker-compose.quickstart.yml upCompare the specification with the code
In a clone of qodiqa-verify, search for the receipt domain tag in the written protocol and in the verifier. Read the protocol in PROTOCOL-V2.md, the code in receipt.js.
ExpectedMatching lines from both files: the rule is written down once and implemented once.
grep -n "QODIQA::RECEIPT::V1" docs/protocol/PROTOCOL-V2.md src/receipt.jsWhat is public.
Specification, on GitHub
32 documents, from the core standard to the reference architecture.
Test vectors, on GitHub
Published inputs and expected verdicts for receipts, actions and approvals.
Gateway source, on GitHub
The reference implementation of the enforcement gateway, with a local sandbox.
Verifier source, on GitHub
Offline verifiers that import nothing from the gateway code.
Anchors source, on GitHub
The reader that checks the anchors repository's own rules.
API contract, on GitHub
An OpenAPI description generated from the gateway code.
SDKs, on GitHub
JavaScript, Python, Go and Java, installed from the repository.
Documentation, on GitHub
Guides, architecture, operations and the scope and limits of the gateway.
Reproducible figures.
Every number on this site that comes from the repositories, and the command that gives it.
| Figure | Source | Command to reproduce | Result |
|---|---|---|---|
| 32 specification documents | docs/ in qodiqa | ls docs/*.html | wc -l | 32 |
| 53 receipt test vectors | docs/protocol/ in qodiqa-verify | node -e "console.log(require('./docs/protocol/vectors/receipt.json').cases.length)" | 53 |
| 2 languages for the artifact verifier | bin/ and python/ in qodiqa-verify | ls bin/verify.external.js python/verify_external.py | 2 files: JavaScript, Python |
| 4 SDK languages | sdk/ in qodiqa-gateway | ls sdk | go, java, javascript, python |
| Verifier checks all pass | qodiqa-verify | npm test | ends with all checks passed |
| Anchors structure check passes | qodiqa-anchors | npm test | prints structure check passed |