QUICKSTART
One file. Any language.
kaitrace never parses your code. It hashes the source, runs the build you declare in
a pinned container, and signs the result, so the only thing that changes between
stacks is the build command in kaitrace.toml.
1 Declare the build
Drop a kaitrace.toml at your repo root.
# kaitrace.toml
[build]
image = "golang:1.23"
command = "go build -trimpath -o app ./... && go test ./..."
outputs = ["app"]
lockfiles = ["go.sum"]# kaitrace.toml
[build]
image = "rust:1.83"
command = "cargo build --release && cargo test"
outputs = ["target/release/app"]
lockfiles = ["Cargo.lock"]# kaitrace.toml
[build]
image = "node:22"
command = "npm ci && npm run build && npm test"
outputs = ["dist/bundle.js"]
lockfiles = ["package-lock.json"]# kaitrace.toml
[build]
image = "python:3.12"
command = "pip install -r requirements.txt && pytest"
outputs = []
lockfiles = ["requirements.txt"]2 Work with signed evidence
From here the workflow is identical, whatever the language.
# once: identity + policy
$ kai keygen
$ kai repo-init --require-approvals 1
# per change: sign, build, review, merge
$ kai propose --description "add rate limiter"
$ kai build
$ kai review <proposal> --approve
$ kai anchor <proposal>
branch main anchored — rulebook satisfied3 Let anyone check it
Evidence travels with the code. verify checks a claim offline;
confirm re-runs the build and compares output hashes.
$ kai verify <attestation>
signature OK · inputs match · outputs present
$ kai confirm <attestation>
RESULT: MATCH — build independently reproduced
Builds run in a network-off container (Docker or Podman). Private repos add
--private --encrypt at init: content is encrypted at rest and mirrors serve
only ciphertext. Full reference lives in the CLI guide, shipping with the tool.