@ujexdev/compliance-callback

Drop-in tamper-evident audit callbacks for the major agent frameworks. Streams events into a Ujex hash-chained ledger that satisfies IETF draft-sharif-agent-audit-trail-00 (AAT) and ISO/IEC 42005:2025 evidence requirements.

Resolves the open LangChain RFC #35691 ("ComplianceCallbackHandler").

Why

• EU AI Act Article 12 (enforced 2 Aug 2026) requires automatic event logging that "cannot be retroactively altered." A plain SIEM forwarder doesn't satisfy this; the source log must be tamper-evident at write time.
• SOC 2 Type II + ISO 42001 questionnaires (2026) now include 15–20 agent-specific items: prompt logging retention, model versioning, decision lineage. A regular log file doesn't link the human approval to the agent's resulting action.
• HIPAA wants (agent identity, human authorizer, operation, PHI records, policy context, tamper-evident timestamp). The Ujex AAT row carries all six in a single chained record.

Install

npm i @ujexdev/compliance-callback
# or
pip install ujex-compliance-callback   # Python edition

LangChain / LangGraph

import {ChatOpenAI} from '@langchain/openai';
import {UjexLangChainCallback} from '@ujexdev/compliance-callback/langchain';

const handler = new UjexLangChainCallback({
  endpoint: 'https://us-central1-axy-ujex.cloudfunctions.net',
  deviceKey: process.env.UJEX_DEVICE_KEY!,
  agentId: 'my-agent',
  agentVersion: '1.4.2',
});

const llm = new ChatOpenAI({callbacks: [handler]});

CrewAI

import {UjexCrewAICallback} from '@ujexdev/compliance-callback/crewai';
import {crewAIEventsBus} from 'crewai/events';

const cb = new UjexCrewAICallback({/* same options */});
crewAIEventsBus.on('agent_execution_started', cb.onAgentExecutionStarted.bind(cb));
crewAIEventsBus.on('tool_usage_started',     cb.onToolUsageStarted.bind(cb));
crewAIEventsBus.on('tool_usage_finished',    cb.onToolUsageFinished.bind(cb));

Verify the chain offline

ujex audit verify ./bundle/        # extracted dir, or records.jsonl

or, language-agnostic:

pip install ujex-audit-chain
python -m ujex_audit_chain verify bundle.zip

Field mapping (AAT → Ujex)

| AAT field | Ujex source | |-------------------|--------------------------------------------| | record_id | audit.{seq}.aat.record_id (32 hex) | | agent_id | audit.{seq}.payload.agentId | | agent_version | audit.{seq}.aat.agent_version | | session_id | audit.{seq}.aat.session_id | | action_type | audit.{seq}.aat.action_type | | outcome | audit.{seq}.aat.outcome | | trust_level | audit.{seq}.aat.trust_level | | parent_record_id| audit.{seq}.aat.parent_record_id | | prev_hash | audit.{seq}.prevHash | | hash | audit.{seq}.hash | | payload_hash | audit.{seq}.payloadHash | | timestamp | audit.{seq}.timestamp (unix ms → ISO-8601 in export) |

License

Apache-2.0.