# Trusty

Tamper-evident data provenance chain library. Pure Rust. Proprietary.
MM Advisory LLC / Eric Gottlieb.

## Crates

- **`trusty-core`** — pure library. Dual hash (SipHash-2-4 + SHA-256),
  canonical payload (v1 + v2), Ed25519 signing trait, `compute_record` /
  `compute_record_signed` / `verify_links`, chain-break-as-event primitive,
  pluggable `Condition` trait. No storage dependency.
- **`trusty-store`** — backend-agnostic `Store` trait. Data types,
  `KvCrossCheckReport`, transactional scope. Implemented by
  `trusty-memory` and `trusty-sqlite`.
- **`trusty-memory`** — in-memory `Store` impl. Reference implementation
  for tests / fuzzing / conformance. Not intended for persistence.
- **`trusty-sqlite`** — rusqlite adapter. Three-table schema
  (`provenance_envelope`, `hash_index`, `chain_tips`) with KV cross-check.
  `Trusty::{open, append, append_signed, append_with_method,
  append_with_method_signed, verify, anchor, history, integrity}`.
- **`trusty-sqlite-ext`** — loadable SQLite extension (`cdylib`).
  `sqlite3_trusty_init()` exposes SQL functions (`trusty_append`,
  `trusty_verify`, `trusty_anchor`). Load from any sqlite3 binding in any
  language.

## Docs

- [`docs/payload-v2.md`](docs/payload-v2.md) — canonical payload byte
  format, v1 + v2, signing-view algorithm, verifier logic, locked
  invariants.
- [`docs/threat-model.md`](docs/threat-model.md) — detection surfaces,
  Ed25519 trust boundary, key-compromise scenarios, out-of-scope threats.
- [`docs/device-signer-provisioning.md`](docs/device-signer-provisioning.md)
  — enroll / rotate / revoke pattern for devices signing into a chain,
  with a runnable demo at `crates/trusty-sqlite/examples/device_signer.rs`.

## Layout

```
trusty/
  Cargo.toml                         workspace
  crates/
    core/
      trusty-core/                   locked primitives (hash, chain, payload, bundle)
      trusty-store/                  backend-agnostic Store trait
    adapters/
      trusty-memory/                 in-memory backend (tests / ref impl)
      trusty-sqlite/                 rusqlite production backend
    extensions/
      trusty-sqlite-ext/             SQLite loadable extension (cdylib, standalone)
  docs/                              format + threat-model specs
```

## Build

Workspace-wide `cargo` commands are broken by a rusqlite feature conflict
(`loadable_extension` in `trusty-sqlite-ext` vs `bundled` in
`trusty-sqlite`). Use per-package form:

```
cargo build -p trusty-core -p trusty-store -p trusty-memory -p trusty-sqlite
cargo build -p trusty-sqlite-ext

cargo test  -p trusty-core -p trusty-store -p trusty-memory -p trusty-sqlite
cargo test  -p trusty-sqlite-ext
```

The extension ships as `trusty_sqlite_ext.{dll,so,dylib}`. Load from
sqlite3:

```
sqlite> .load ./trusty_sqlite_ext
sqlite> SELECT trusty_append('company_acme', '{"status":"active"}', 'https://source');
```