Start here

EVE — Product Architecture (16C)

Product hierarchy (one name per capability)

Product	Scope
EVE CoreGuard	Deterministic pre-execution governance and enforcement (ALLOW / BLOCK / MODIFY).
EVE Proof	Signed evidence, decision certificates, offline & replay verification, verifier tooling, JCS-1.
EVE Agent Governance	Behavioral monitoring, sequence controls, budgets, approvals, framework adapters, agent runtime governance.
EVE MCP Governance	Authenticated MCP gateway, capability binding, approved-vs-executed request binding, replay protection, signed execution evidence.
EVE Artifact Governance	File ingestion, bounded parsing, deterministic scanning, quarantine/approval, substitution protection, signed scan evidence.
EVE Shadow	Candidate-policy simulation, historical replay, divergence analysis, signed reports, dry-run promotion readiness.
EVE Red Team	Customer-runnable adversarial regression testing, multi-step chains, zero-side-effect assertions, signed reports.
EVE Trusted Services	External witnessing, evidence custody, verifier services, assurance infrastructure where available.

Architecture diagram (planes)

SDK & Adapter Entry Points

Python from eve_coreguard import CoreGuardClient · TypeScript import { verifyDecisionCertificate } from "eve-ai-governance" (offline verification; enforce via REST)
Adapters — generic supported; framework adapters experimental.

normalized governed op

Control Plane

EVE CoreGuard → deterministic decision boundary (no LLM in verdict): policy packs · risk · charter/veto → ALLOW BLOCK MODIFY
Agent Governance: behavioral monitoring · sequence controls · budget
MCP Governance: authenticated identity · capability binding
Artifact Governance: media detection · safe parsing · scan policy

decision (ALLOW) + single-use authorization · BLOCK / QUARANTINE ⇒ stop

Execution Plane

MCP boundary: reconstruct executed request ⇒ approved == executed digests; atomic single-use consume ⇒ then the side effect (once)
Artifact boundary: scan before ingestion / use; substitution rejected
Tool / agent boundary: guarded call executes only on ALLOW

every decision & execution

Evidence Plane — EVE Proof

Signed, JCS-1-canonicalized evidence (ECDSA P-384 prod / HMAC fallback): decision certificate · monitoring envelope · MCP execution evidence · shadow report · artifact scan evidence · red-team report

Independent Verification

Does not trust the EVE server. Python · Node · Browser verifiers → {valid, reason, signature}

Boundaries, plainly

CoreGuard decision boundary — a deterministic verdict is computed before execution.
MCP boundary — the approved request is bound to the executed request; mutation ⇒ block.
Artifact boundary — files are scanned before ingestion/use; substitution is rejected.
Evidence plane — every decision/execution emits signed evidence.
Independent verification — anyone can verify evidence offline, without trusting EVE.

Readiness

Pilot-validated architecture; SDK core is a RELEASE CANDIDATE WITH EXCLUSIONS. See readiness.md.

Limitations

MCP binding provides at-most-once authorization consumption, not remote exactly-once execution. jcs-1 is a constrained profile. Framework adapters (except generic) are experimental. The pip client governs via hosted mode.