The latest articles on DEV Community by Scott (@rubricprotocol). https://dev.to/rubricprotocol https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F3874116%2F0ea883e9-d201-438f-90f7-41c1278f5bbb.jpeg https://dev.to/rubricprotocol en Scott Sat, 11 Apr 2026 21:39:45 +0000 https://dev.to/rubricprotocol/one-line-to-add-post-quantum-audit-trails-to-any-python-ai-agent-11am https://dev.to/rubricprotocol/one-line-to-add-post-quantum-audit-trails-to-any-python-ai-agent-11am <p>I'm a solo founder building compliance infrastructure for AI agents. <br> This is the core problem I'm solving.</p> <p>If you're building AI agents, you have a logging problem <br> you probably haven't thought about yet.</p> <p>Not application logs. Compliance logs — cryptographically <br> signed, tamper-proof records of what your agent decided, <br> when, and why. The kind that hold up in a regulatory audit.</p> <p>The EU AI Act (Article 12) mandates exactly this for <br> high-risk AI systems. And most agent frameworks produce <br> nothing close to it.</p> <p>I built Rubric Protocol to fix that.</p> <h2> What it does </h2> <p>Every agent action gets:</p> <ul> <li>A post-quantum signature (ML-DSA-65)</li> <li>A Merkle-aggregated attestation bundle</li> <li>An anchor written to Hedera Consensus Service mainnet</li> <li>A W3C Verifiable Credential you can export</li> </ul> <p>That's a tamper-proof, court-admissible audit trail for <br> every decision your agent makes.</p> <h2> Install </h2> <p>pip install autogen-rubric</p> <h2> Instrument your agent in one line </h2> <p>import rubric<br> rubric.instrument()</p> <p>That's it. Works with:</p> <ul> <li>LangChain</li> <li>LangGraph </li> <li>CrewAI</li> <li>AutoGen</li> <li>OpenAI Agents SDK</li> <li>Google ADK</li> <li>Haystack</li> <li>Semantic Kernel</li> <li>Pydantic AI</li> <li>DSPy</li> <li>LlamaIndex</li> <li>Strands / Bedrock AgentCore</li> <li>and more</li> </ul> <h2> Why post-quantum? </h2> <p>Current ECDSA signatures will be breakable by quantum <br> computers within the decade. If your audit trail gets <br> subpoenaed in 2031, you want signatures that still hold.</p> <p>ML-DSA-65 (CRYSTALS-Dilithium) is NIST-standardized. <br> We implemented it natively via a C++ N-API addon — 52x <br> faster than pure JS equivalents.</p> <h2> Architecture in 30 seconds </h2> <ol> <li>Agent action fires</li> <li>Rubric signs it with ML-DSA-65</li> <li>Actions batch into a Merkle tree (1,000,000:1 compression)</li> <li>Root hash anchors to Hedera mainnet via HCS</li> <li>W3C VC issued against that anchor</li> </ol> <p>Load tested at 3,247 RPS, 0.13% error rate.<br> First mainnet VC issued April 3, 2026.</p> <h2> Try it </h2> <p>pip install autogen-rubric</p> <p>Docs + free developer key: rubric-protocol.com</p> <p>Happy to answer questions on the ZK layer, the Merkle <br> architecture, or the EU AI Act compliance angle.</p> ai python security opensource