Who reasons
EVA runs steps under contract (local or remote LLM). It does not change catalogs, policies, or global memory alone.
Local-firstAuditableOn-premZero auto-merge
Trust & governance
Governed autonomy, not blind autopilot. The kernel decides what is allowed, persisted, and demonstrable.
How NOUS governs
The model proposes steps; the kernel decides what is allowed, persisted, and demonstrable.
EVA reasons. NOUS governs.
Who decides
NOUS enforces cost limits, collisions, and cancellation; supervises live confidence; injects context or escalates; persists memory on close.
Who operates
Control plane (nous_ctl) separate from product traffic: configure without mixing chat or gateway.
- Zero auto-merge: workflows, skills, and sensitive mutations require explicit authorization.
- Event sourcing: relevant decisions with lineage, not text logs alone.
- Skills and workflows: catalog invoked at runtime; learning lives in memory and graph.
Trust & governance
Event sourcing
Relevant decisions with Avro lineage — reconstruct “why”, not guess from scattered logs.
Local-first / on-prem
Data sovereignty: llama.cpp + GGUF with no mandatory cloud API.
File permissions
Allowlist + conversational approval before reading the host filesystem.
Zero auto-merge
Workflows, skills, and sensitive mutations require explicit authorization.
FAQ
Does the LLM administer the system?
No. EVA reasons under contract; NOUS applies policies, persists memory, and audits.
Can NOUS run without cloud?
Yes. It is local-first with llama.cpp; gateway and kernel run on-prem.
How are decisions audited?
Avro event sourcing: micropauses, escalations, ingest, file grants, and more leave lineage.