01 / Install
Install the verified PyPI release.
Python 3.10+ is required. Tempus DDB is published to PyPI with Trusted Publishing and Sigstore attestation on every artifact — verify the provenance before you trust the binary, not just the package name.
python -m pip install tempus-ddb
For development, or to inspect the attested source before installing:
git clone https://github.com/elbuilder77/tempus-ddb.git
cd tempus-ddb
python -m pip install -e ".[dev]"
View verified package on PyPI · Platform-specific wheels & SBOM are available as GitHub Release assets.
02 / Basic flow
Request and execution flow
- The agent signs an exact
tempus.action-intent.v1 request.
- Tempus verifies identity and deterministic policy, then returns
ALLOWED or BLOCKED.
- An executor with the downstream credential consumes an allowed permit once.
- The executor signs an outcome; Tempus records a linked receipt and a reader can verify the trace.
The requesting agent must not hold the executor's environment, credential or signing key. That separation—not a human approval click—is the security boundary.
03 / Stable contracts
Stable schemas
| Evidence | Schema |
|---|
| Agent intent | tempus.action-intent.v1 |
| Signed permit | tempus.authorization-receipt.v1 |
| Executor outcome | tempus.action-outcome.v1 |
| Execution receipt | tempus.execution-receipt.v1 |
| Complete trace | tempus.action-trace.v1 |
| Verification result | tempus.trace-verification.v1 |
Read the compatibility policy and v0.4 migration notes before changing a deployed integration.
04 / Integration
Executor integration
The generic executor and packaged GitHub adapter both verify permit binding, tenant, expiry and single consumption. The GitHub adapter supports only exact, allowlisted issue and pull-request actions; it keeps its token outside the agent payload.
tempus init
tempus keygen --output agent.keys.json
tempus keygen --output executor.keys.json
tempus doctor --json
tempus conformance --signer
Run examples/commercial_demo.py to test direct bypass rejection, single-use consumption, replay protection, and trace verification locally:
python examples/commercial_demo.py
Explore framework recipes in cookbooks/ for LangChain, CrewAI, and Claude/Cursor MCP.
05 / Trace inspection
Inspect and verify records
tempus trace --action-id <action-id>
tempus verify-trace --action-id <action-id>
tempus list-agents
tempus list-policies
tempus identity-events
The interactive trace demo verifies a synthetic browser fixture. It is not connected to a Tempus database, and it does not replace tempus verify-trace for a real action.
06 / Security boundary
Current limits
v0.4.2 is local-first and single-instance. It detects alteration of the supported evidence, but does not yet provide distributed permit consumption or independent durable checkpoints for whole-database rollback or deletion detection.
Review the threat model before high-impact use, report issues through the security policy, and use the contribution guide to participate.
