EVE Artifact Governance

Scan files by real content, decide before ingestion, and bind the artifact to the decision.

Who this is for

Teams that let agents or users bring files into a workflow — uploads, tool outputs, model attachments — and need a deterministic gate that decides whether a file may be ingested or used, based on what the file actually is, not what it claims to be.

The problem

A file's extension and declared MIME type can lie. Parsers can be pushed past safe limits. And even after a file is approved, a substituted file can slip in before use. You need content-based media detection, bounded safe parsing, deterministic scanning with a clear disposition, and evidence that ties the exact bytes to the decision.

Supported capabilities

• Deterministic content scanning with signed evidence. EVE ingests files, detects the real media type from content, applies bounded safe-parsing limits, runs deterministic scanners, and blocks / quarantines / requires-approval before ingestion or use — emitting signed scan evidence (core/artifact_scan/).
• Substitution protection. Artifact scan evidence binds the artifact digest to the decision, so a substituted artifact after approval is detected by verification (core/artifact_scan/evidence.py; verify_scan_evidence).

Readiness: artifact scanning and substitution protection are PILOT_READY.

How it works

1. A file is ingested; EVE detects the real media type from content, not from the filename or declared type.
2. Bounded safe-parsing limits are applied so a malformed or oversized file cannot exhaust resources.
3. Deterministic, pattern/structure-based scanners run over the extracted content.
4. EVE returns a disposition — allow, block, quarantine, or require-approval — before ingestion or use.
5. Signed scan evidence is emitted, binding the artifact digest to the decision.

Technical example (Python)

from eve_coreguard import EVE

eve = EVE(policy="enterprise-default", mode="hosted",
          endpoint="https://your-endpoint", api_key="eve_sk_...")

result = eve.govern_tool_call(
    tool="ingest_attachment",
    arguments={"path": "fixtures/invoice.pdf"},  # synthetic fixture
    context={"tenant_id": "org_abc", "principal_id": "u_5", "session_id": "s_1"},
)
# govern_tool_call returns a plain dict.
print(result["action"])         # e.g. "BLOCK"
print(result["reason_codes"])   # deterministic scan reason codes

Signed evidence example

{
  "scan_evidence": {
    "final_action": "BLOCK",
    "artifact_digest": "sha256:…",
    "findings_digest": "…",
    "completeness_status": "partial",
    "signature": "ed25519-…",
    "canon": "jcs-1"
  }
}

completeness_status is honest: if extraction was incomplete, it is reported as partial and cannot masquerade as complete.

Verifier example

Verification rejects evidence whose artifact_digest was changed after signing — this is how a post-approval substitution is caught:

from core.eve_sdk import verify_evidence

report = verify_evidence("scan", scan_evidence)
# tampered artifact_digest -> report["valid"] is False

Deployment options

Artifact Governance runs embedded inside the EVE service or as a sidecar. Verification of scan evidence is available in Python and, for verify-only, TypeScript.

Readiness

Artifact scanning and substitution protection are PILOT_READY (pilot-validated core governance architecture). Signed evidence and offline verification are SUPPORTED. The EVE SDK core overall is a RELEASE CANDIDATE WITH EXCLUSIONS.

Limitations

• Deterministic scanners are pattern/structure-based. OCR, vision, and QR/barcode reading are probabilistic and are disabled by default (recorded as unavailable). Incomplete extraction is reported as partial and cannot be presented as complete.
• Substitution binding is detected at verification time. Enforcing a re-scan-before-use is a wiring responsibility at the ingestion boundary.
• The release-candidate clients are distributed privately for pilots — install the pilot artifact, not a public pip/npm install (see readiness for public-registry status).

Next step

Request a pilot to run Artifact Governance over your own file fixtures and verify that a substituted artifact is rejected by the signed evidence.