Who reasons
EVA runs steps under contract (local or remote LLM). It never changes catalogs, policies, or Vault secrets on its own.
Local-firstAuditableOn-premZero auto-merge
Trust & governance
Governed autonomy, not blind autopilot. The kernel decides what is allowed, persisted, and demonstrable.
How NOUS governs
The model proposes steps; the kernel decides what is allowed, persisted, and demonstrable.
EVA reasons. NOUS governs.
Who decides
NOUS evaluates policies top to bottom, controls access to native databases, enforces approvals, and records lineage on close.
Who operates
Control plane (nous_ctl) separate from product traffic: configuration and Vault without mixing chat or gateway.
- Zero auto-merge: workflows, skills, and sensitive mutations require explicit authorization.
- Event sourcing: relevant decisions with lineage, not text logs alone.
- Secrets Vault & native databases: credentials never reach the prompt; read-only by default.
Trust & governance
Event sourcing
Relevant decisions with Avro lineage — reconstruct “why”, not guess from scattered logs.
Local-first / on-prem
Data sovereignty: llama.cpp + GGUF with no mandatory cloud API.
File permissions
The kernel never lets the model touch files or receive credentials: keys are encrypted or sent to the Vault, each person enables access, and only allowlisted paths and tools are permitted.
Zero auto-merge
Workflows, skills, and sensitive mutations require explicit authorization.
FAQ
Does the LLM administer the system?
No. EVA reasons under contract; NOUS applies policies, persists memory, and audits.
Can NOUS run without cloud?
Yes. It is local-first with llama.cpp; gateway and kernel run on-prem.
How are decisions audited?
Event viewer and Avro event sourcing: who asked, what data was used, which policy applied, escalations, and who approved leave full lineage.