← Catalyst Audit

See your AI agent fixed in 60 seconds.

Most production AI agent endpoints — including every major LLM provider — score 1–3 of 17 on the EU AI Act technical-substrate audit. Catalyst-Brain wraps your agent's response with the full Article-11/12/13/14/43/72 envelope. Same agent, same model, same input — different output shape, 17/17.

2 / 17

A typical AI agent response

e.g. POST /v1/chat/completions — no signing, no oversight hooks, no replay handle

{
  "id": "chatcmpl-abc123",
  "model": "gpt-4o-2024-08-06",
  "created": 1748358600,
  "choices": [
    { "message": { "role": "assistant", "content": "..." } }
  ],
  "usage": { "prompt_tokens": 5, "completion_tokens": 1 }
}

✗ Mutable JSON — no Article 12 tamper-evidence
✗ No input digest, operator id, or replay handle
✗ No Article 14 oversight intervention / stop endpoint
✗ No Annex IV technical documentation discoverable
✗ No conformity assessment evidence packet

17 / 17

The same response, catalyst-brain wrapped

HMAC-SHA256-signed, sub-100KB, 6 substrate endpoints linked, replayable end-to-end

{
  "ok": true,
  "agent": { "id": "your-agent" },
  "rain_event": {
    "id": "rain_8h3kfa92",
    "protocol": ".rain",
    "decision_id": "rain_8h3kfa92",
    "timestamp_utc": "2026-05-28T00:00:00Z",
    "input_digest": "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
    "output_digest": "sha256:a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f90",
    "operator_id": "ops-controller-7",
    "model_route": "@cf/moonshotai/kimi-k2.6",
    "tamper_evidence": "hmac-sha256:1ec360330921bd5f4155ebb6a5d660ffe8db8f0b9376bae511b3...",
    "retention_days": 365,
    "risk_classification": "decision-support",
    "human_oversight": { "required": true, "mode": "approval_gate" },
    "replay_id": "rain_8h3kfa92"
  },
  "links": {
    "technical_documentation": "https://your-agent/v1/agents/your-agent/technical-documentation",
    "deployer_instructions":   "https://your-agent/v1/agents/your-agent/deployer-instructions",
    "conformity_assessment":   "https://your-agent/v1/agents/your-agent/conformity-assessment",
    "post_market_monitoring":  "https://your-agent/v1/agents/your-agent/post-market-monitoring",
    "oversight_intervention":  "https://your-agent/v1/agents/your-agent/oversight/intervene",
    "oversight_stop":          "https://your-agent/v1/agents/your-agent/oversight/stop"
  }
}

✓ Tamper-evident rain_event signed with HMAC-SHA256
✓ input_digest + operator_id + replay_id present
✓ Real oversight intervention + stop endpoints (Art. 14)
✓ Annex IV technical documentation endpoint auto-generated (Art. 11)
✓ Conformity assessment packet auto-emitted (Art. 43)

The 30-line wrap

Drop-in to any Python agent. pip install catalyst-brain first.

# pip install catalyst-brain
import catalyst_brain as cb

# 1. Build the Article-12 evidentiary envelope on every agent response.
event = cb.RainPayload(
    agent_id="your-agent",
    dim=4096,
    world_vector=cb.transient_bipolar_vector("decision:sample", 4096),
)
signed = cb.rain_dumps(event)   # hmac-sha256 signed, sub-100KB

# 2. Serve the EU AI Act substrate endpoints alongside your agent's /ask:
#    /v1/agents/<id>/technical-documentation   → Annex IV (Art. 11)
#    /v1/agents/<id>/deployer-instructions     → instructions for use (Art. 13)
#    /v1/agents/<id>/oversight/intervene       → real human-override hook (Art. 14)
#    /v1/agents/<id>/oversight/stop            → real stop signal (Art. 14)
#    /v1/agents/<id>/conformity-assessment     → self-assessment evidence (Art. 43)
#    /v1/agents/<id>/post-market-monitoring    → monitoring plan (Art. 72)
#
# Catalyst-Brain auto-generates these from your agent config. See the
# audit-fix sample at https://audit.strategic-innovations.ai for the full
# 30-line pattern.

← Audit another agent Want me to wire it into your repo in 15 min? Email the founder

Scope. The 17 checks cover EU AI Act Article 11 (technical documentation) · Article 12 (automatic event logging) · Article 13 (deployer instructions) · Article 14 (human oversight) · Article 43 (conformity assessment) · Article 72 (post-market monitoring). Catalyst-Brain substrate addresses ~6 of ~14 high-risk-AI provider obligations. Out of substrate scope: Article 17 (Quality Management System), Article 27 (Fundamental Rights Impact Assessment), Article 49 (EU database registration) — these remain customer/process responsibilities. Substrate is necessary but not sufficient for full EU AI Act compliance.