EVE — Product Architecture (16C)

Product hierarchy (one name per capability)

Product	Scope
EVE CoreGuard	Deterministic pre-execution governance and enforcement (ALLOW / BLOCK / MODIFY).
EVE Proof	Signed evidence, decision certificates, offline & replay verification, verifier tooling, JCS-1.
EVE Agent Governance	Behavioral monitoring, sequence controls, budgets, approvals, framework adapters, agent runtime governance.
EVE MCP Governance	Authenticated MCP gateway, capability binding, approved-vs-executed request binding, replay protection, signed execution evidence.
EVE Artifact Governance	File ingestion, bounded parsing, deterministic scanning, quarantine/approval, substitution protection, signed scan evidence.
EVE Shadow	Candidate-policy simulation, historical replay, divergence analysis, signed reports, dry-run promotion readiness.
EVE Red Team	Customer-runnable adversarial regression testing, multi-step chains, zero-side-effect assertions, signed reports.
EVE Trusted Services	External witnessing, evidence custody, verifier services, assurance infrastructure where available.

Architecture diagram (planes)

                         SDK & ADAPTER ENTRY POINTS
   Python: from eve_coreguard import EVE      TypeScript: import { EVE } from "@eve/coreguard"
   Adapters (generic supported; framework adapters experimental) ─┐
                                                                   │  normalized governed op
                                                                   ▼
 ┌───────────────────────────── CONTROL PLANE ──────────────────────────────┐
 │  EVE CoreGuard  ──►  DETERMINISTIC DECISION BOUNDARY (no LLM in verdict)   │
 │     policy packs · risk · charter/veto           ALLOW / BLOCK / MODIFY    │
 │  EVE Agent Governance:  behavioral monitoring · sequence controls · budget │
 │  EVE MCP Governance:    authenticated identity · capability binding        │
 │  EVE Artifact Governance: media detection · safe parsing · scan policy     │
 └───────────────────────────────────┬───────────────────────────────────────┘
              decision (ALLOW) + single-use authorization │ (BLOCK/QUARANTINE ⇒ stop)
                                                          ▼
 ┌───────────────────────────── EXECUTION PLANE ─────────────────────────────┐
 │  MCP boundary: reconstruct executed request ⇒ approved==executed digests   │
 │                atomic single-use consume ⇒ THEN the side effect (once)     │
 │  Artifact boundary: scan before ingestion/use; substitution rejected       │
 │  Tool/agent boundary: guarded call executes only on ALLOW                  │
 └───────────────────────────────────┬───────────────────────────────────────┘
                                      │ every decision & execution
                                      ▼
 ┌───────────────────────────── EVIDENCE PLANE (EVE Proof) ──────────────────┐
 │  signed, JCS-1-canonicalized evidence (Ed25519 prod / HMAC fallback)       │
 │  decision certificate · monitoring envelope · MCP execution evidence ·     │
 │  shadow report · artifact scan evidence · red-team report                  │
 └───────────────────────────────────┬───────────────────────────────────────┘
                                      ▼
              INDEPENDENT VERIFICATION  (does NOT trust the EVE server)
        Python · Node · Browser verifiers  →  {valid, reason, signature}

Boundaries, plainly

CoreGuard decision boundary — a deterministic verdict is computed before execution.
MCP boundary — the approved request is bound to the executed request; mutation ⇒ block.
Artifact boundary — files are scanned before ingestion/use; substitution is rejected.
Evidence plane — every decision/execution emits signed evidence.
Independent verification — anyone can verify evidence offline, without trusting EVE.

Readiness

Pilot-validated architecture; SDK core is a RELEASE CANDIDATE WITH EXCLUSIONS. See readiness.md.

Limitations

MCP binding provides at-most-once authorization consumption, not remote exactly-once execution. jcs-1 is a constrained profile. Framework adapters (except generic) are experimental. The pip client governs via hosted mode.