# Dokis

A lightweight RAG provenance middleware that checks, without calling an LLM, whether every claim in a generated answer is actually grounded in a retrieved source, and flags claims backed only by outdated sources.

Dokis sits inline between a retrieval-augmented generation pipeline's retrieval step and its response delivery, and returns a runtime trust report for the exact answer the system is about to ship. It runs three checks in one deterministic pass: pre-retrieval enforcement that strips any chunk whose source URL is not on an allowlist before it reaches the prompt, post-generation support auditing that extracts factual claims from the response with a deterministic extractor and matches each one to its best supporting chunk using BM25 lexical scoring by default, building a claim-to-chunk-to-URL provenance map and a compliance rate, and, when a freshness policy is configured, temporal trust evaluation that distinguishes claims supported by fresh sources from those supported only by outdated ones.

The default BM25 matching path needs no LLM call and no API key, and produces the same output for the same input and configuration every time. A command-line tool reads a JSON file of a query, its retrieved chunks and the generated response, and prints a trust report, using an optional TOML configuration file for the source allowlist, threshold, matcher and freshness policy.

Website: https://github.com/Vbj1808/Dokis