TFEF — Token Forensics Exchange Format

TFEF is the open, vendor-neutral schema for forensic AI evidence. Owning the standard outlasts owning features — the way OpenTelemetry, MITRE ATT&CK, and OCSF own their categories. TFEF v0.1 is published in this repository under Apache-2.0.

What the spec defines

• Bundle layout — the on-disk structure of an evidence bundle: manifest, signature, anchor proof, the events, and any diffs.
• ForensicEvent hash-chain rules — how events chain, what each hash covers, and the integrity guarantees that follow.
• Event-type taxonomy — the canonical set of forensic event types (capture, replay, evidence export, policy change, and more).
• Payload schemas — the shape of each event type's payload.
• Tombstone-and-rehash erasure — how GDPR right-to-be-forgotten is honored without deleting rows, preserving chain integrity.
• Conformance levels — TFEF-C (capture), TFEF-R (replay), TFEF-E (evidence export): what a tool must implement to claim each.

Why it matters

Observability vendors can copy features; they cannot copy being the standard. A bundle in TFEF is portable evidence — readable by any conforming tool, defensible to an auditor, not locked to one vendor.

Last updated 14 May 2026