tessera-litellm

Tessera certificates for every LLM call routed through LiteLLM. One callback. Every prompt, response, and latency reading becomes a signed, verifiable, anchorable certificate.

What this is

Tessera is a cryptographic substrate for AI computation provenance. A Tessera certificate is a JSON document that records what was computed, signs the result with Ed25519, and (optionally) anchors the signature to Bitcoin via OpenTimestamps so the cert's existence at a given time is provable independently of any server.

tessera-litellm is the LiteLLM integration: a CustomLogger callback that emits a Tessera compute-spec-v0.1 certificate for every LLM call, with zero changes to your application code beyond installing the package and registering the callback.

Why this matters

Most AI provenance tools sit at the orchestration or observability layer (LangSmith, Langfuse, Helicone). Those are useful for debugging but legally useless: the deployer has full read/write to their own dashboard, so logs are not evidentiary. Tessera certificates are different — they are signed by the deployer's own Ed25519 key and the public key fingerprint can be tied to a real legal entity via the Identity Oracle, turning every LLM call into a piece of evidence that an insurer or regulator can verify against the public anchor log.

Practically, this means:

• Insurance underwriters can require Tessera certs in policy claims and verify them without trusting the policyholder.
• Auditors and regulators can spot-check any production AI call after the fact.
• Customers can be given proof their data was processed by the model the vendor claims.

Install

pip install tessera-litellm
# Or, if you also want LiteLLM in the same env:
pip install tessera-litellm[litellm]

Quickstart

import litellm
from tessera_litellm import TesseraCallback, IssuerKey, FileSink

# Generate a signing key for this environment. In production, load from KMS,
# Vault, or an environment variable rather than generating each restart.
key = IssuerKey.generate()
print("Public key fingerprint:", key.fingerprint)

# Register the callback with LiteLLM.
litellm.callbacks = [
    TesseraCallback(
        key=key,
        sink=FileSink("./tessera-certs.jsonl"),
    )
]

# That's it. Use LiteLLM normally. Every call now emits a signed certificate.
resp = litellm.completion(
    model="gpt-4o",
    messages=[{"role": "user", "content": "Hello, world!"}],
)
print(resp.choices[0].message.content)

After the call, ./tessera-certs.jsonl contains one JSON line per request, each a fully-signed Tessera certificate.

What's in a certificate

Every cert is a compute-spec-v0.1 profile envelope:

{
  "profile": "compute-spec-v0.1",
  "id": "chatcmpl-9zXyzABC...",
  "issuedAt": 1747345200000,
  "body": {
    "computation": {
      "provider": "openai",
      "model": "gpt-4o-2024-08-06",
      "callMode": "chat-completion",
      "input": {
        "messagesHash": "sha-256:e3b0c44...",
        "messageCount": 2
      },
      "output": {
        "contentHash": "sha-256:9b71d22...",
        "contentLength": 482
      },
      "latencyMs": 1234.5,
      "usage": {
        "promptTokens": 23,
        "completionTokens": 117,
        "totalTokens": 140
      }
    }
  },
  "signature": {
    "algorithm": "ed25519",
    "publicKeyPem": "-----BEGIN PUBLIC KEY-----...",
    "keyFingerprint": "<sha-256 of public key PEM>",
    "value": "<base64 ed25519 signature>"
  }
}

By default, prompt and response content is hashed, not embedded. This makes certs safe to publish to third-party anchor logs without leaking customer prompts. Set include_payloads=True if you control the entire pipeline and want to retain the full text.

Verifying certificates

Three options, in increasing order of forensic strength:

1. Local self-test — tessera_litellm.verify_certificate(cert) checks the signature only.
2. Public Tessera VaaS — POST the cert to the Tessera Verification-as-a-Service endpoint. It checks signature, profile shape, OTS receipt status, and linkage. See the VaaS docs for the deployed URL.
3. Full Bitcoin anchor proof — once the issuer has run Tessera v0.10 OTS upgrader against the daily Merkle batch, the cert's existence is provable against any Bitcoin full node. This is the gold-standard evidence path.

Sink configuration

The package ships four sinks. Compose them with MultiSink.

from tessera_litellm import FileSink, HTTPSink, MemorySink, MultiSink

sink = MultiSink([
    FileSink("./tessera-certs.jsonl"),                   # local archive
    HTTPSink("https://your-anchor-log.example/ingest"),  # ship upstream
])

Sink	Use case
FileSink	Default. Append-only JSONL on local disk. Safe for any deployment.
HTTPSink	POST each cert to your private anchor log or Tessera VaaS verify route.
MemorySink	Tests and dry-runs.
MultiSink	Combine sinks. Failures in one are isolated; others still receive.

Sinks never break the LLM call. A failed write is logged and discarded.

Privacy & data flow

By default tessera-litellm records:

• The provider and model id (e.g., openai, gpt-4o-2024-08-06).
• A SHA-256 hash of the canonical JSON of the messages array.
• A SHA-256 hash of the response content.
• Latency in milliseconds.
• Token counts if the provider reports them.
• A request id (provider-supplied or UUID4).
• The deployer's Ed25519 public key (full PEM) and the deployer's signature over the above.

It does not record:

• Prompt content (only its hash, unless include_payloads=True).
• Response content (only its hash, unless include_payloads=True).
• IP addresses, user identifiers, or session cookies.
• Any third-party API keys or credentials.

Production deployment notes

1. Key management. IssuerKey.generate() is fine for development. In production, store the private PEM in a secret manager (AWS Secrets Manager, HashiCorp Vault, GCP Secret Manager) and load with IssuerKey.from_private_pem(pem). The public key PEM is embedded in every certificate; map its fingerprint to your legal entity via the Tessera Identity Oracle (DNS TXT + GLEIF) so verifiers can resolve who signed.
2. Anchor strategy. Certs are evidence-grade only when their hashes land in a tamper-evident log. The simplest pattern: run a daily job that builds a Merkle root over the day's certs and submits it to OpenTimestamps; this is the same pattern Tessera v0.10 uses for the public anchor log.
3. Performance. Cert construction is ~50 microseconds. Ed25519 signing is ~30 microseconds. The async sink dispatch happens off the request critical path. Real-world overhead is single-digit milliseconds, dominated by the sink (file write or HTTP POST).
4. Failure mode. All cert emission errors are caught and logged at WARNING. Your LLM call will never fail because of tessera-litellm.

Compatibility

LiteLLM version	tessera-litellm
1.40+	0.1.x (current)

Works with any LLM provider LiteLLM supports: OpenAI, Anthropic, Bedrock, Azure OpenAI, Vertex AI, Mistral, Cohere, Ollama, and ~100 others. The provider name on the cert is auto-detected from the LiteLLM model string.

Roadmap

• 0.2 — Helper for batched anchoring: build a daily Merkle root from a JSONL file and submit to OpenTimestamps.
• 0.2 — Native cross-language verification using Tessera's TS/Python/Go byte parity.
• 0.3 — Optional Kindl billing rail integration: charge per verified cert.
• 0.3 — pipeline-attestation-v0.1 profile for multi-step agent runs.

License

MIT. See LICENSE.

Related

• Tessera — the core protocol, CIDL profiles, verifier, and anchor log.
• Tessera VaaS — the public verification endpoint these certs can be checked against.
• LiteLLM — the LLM abstraction this package integrates with.