Verification & Proof

This page exists to show what is real, working, and verifiable. No speculation, no projections, no valuation claims. Every statement below can be independently confirmed by reading source code, calling an API, or running a test.

1. What This Page Is

This is a technical audit document. It lists only capabilities that exist in source code today, with instructions for how to verify each one.

Specifically, this page does not contain:

Revenue projections or valuation claims
Unverified adoption metrics
Comparisons claiming superiority over named competitors
Forward-looking statements presented as current fact

If a claim on this page cannot be verified using the methods described, it should be treated as unsubstantiated.

2. What Is Actually Built

The following components exist in the repository and can be inspected directly.

Python Source

54,678

lines (excl. tests)

Frontend

338,068

lines (HTML + CSS + JS)

Test Code

106,609

lines across 182 test files

Git History

1,188

commits

EVE CoreGuard — Decision Enforcement API

A deterministic policy enforcement engine for regulated domains. Accepts a proposed action, evaluates it against a policy pack, computes a risk score, and returns an ALLOWED, BLOCKED, or MODIFIED disposition with a cryptographic audit record.

Component	File	Lines
Evaluator	`core/coreguard/evaluator.py`	323
Request/Response schemas	`core/coreguard/schemas.py`	124
Audit record generator	`core/coreguard/audit.py`	100
Lending policy pack	`core/coreguard/policies/lending_v1.py`	110
FastAPI router	`saas/routers/coreguard.py`	78

Endpoints

Method	Path	Description
`POST`	`/v1/decisions/evaluate`	Evaluate proposed action against policy
`GET`	`/v1/decisions/policy-sets`	List available policy sets
`GET`	`/v1/decisions/health`	Health check

Verification

Read the evaluator source: core/coreguard/evaluator.py
The lending policy checks 3 explicit rules: credit score ≥ 620, debt-to-income ≤ 0.45, employment verified
Risk score computed as weighted sum: credit (0.40) + DTI (0.35) + employment (0.25). Thresholds: LOW < 0.35, MEDIUM < 0.60, HIGH ≥ 0.60
Audit records include SHA-256 content hash and HMAC-SHA256 signature

Veto Core — Deterministic Governance Engine

A pure, side-effect-free module containing all safety-critical veto logic. Zero imports outside Python standard library (dataclasses, enum, typing). Zero I/O. Zero threading. Zero global state. Designed to be compilable to firmware.

Component	File	Lines
Pure veto logic	`core/governance/veto_core.py`	1,905
C firmware header	`core/governance/veto_interface.h`	401
Tests	`tests/test_veto_core.py`	1,082

Frozen Constants (Hardcoded, Not Configurable)

Constant	Count	Description
Charter Rules	15	Deterministic check functions. 14 HARD_BLOCK (cannot be overridden), 1 SOFT_BLOCK.
Ethical Red Lines	5	Permanently blocked actions. No override path exists.
Protected Invariants	13	Identity constraints that cannot be modified via any API.
Cognitive Lock Types	6	Pre-conditions that must clear before external tool invocation.
Charter Principles	12	Foundational ethical principles mapped to rules.

Three Entry Points (Pure Functions)

check_charter(action_type, action_params, context) → CharterVetoResult
check_cognitive_locks(request, state) → LockVerdict
check_drift_budget(category, cost, target, budget) → BudgetResult

Verification

Run tests: pytest tests/test_veto_core.py — 78 test functions
Inspect the C header: core/governance/veto_interface.h declares 7 structs, 8 enums, 11 functions
Verify purity: grep -n "import" core/governance/veto_core.py returns only dataclasses, enum, typing, re, hashlib

EVE CoreGuard SDK — Installable Client Library

A Python SDK (eve-coreguard v0.1.5) with zero required dependencies. Uses only Python standard library (urllib). Optional aiohttp for async; optional cryptography for offline Ed25519/ECDSA evidence verification.

Component	File	Lines
Client	`sdks/coreguard/eve_coreguard/client.py`	305
Package config	`sdks/coreguard/pyproject.toml`	—
Tests	`sdks/coreguard/test_coreguard.py`	356

SDK Methods

Method	Description
`evaluate()`	Submit action for policy enforcement
`list_policy_sets()`	Enumerate available policy packs
`verify()`	Run output through governance pipeline
`get_proof()`	Retrieve cryptographic proof bundle
`export_audit()`	Export governance audit records
`verify_chain()`	Check hash chain integrity
`verify_proof()` (static)	Local proof verification — no server call

Verification

Install: pip install eve-coreguard
Run tests: pytest sdks/coreguard/test_coreguard.py — 28 test functions
Run demo: python sdks/coreguard/run_demo.py (requires server running on localhost:8000)

Resilience Score & Certificates

A composite health metric (0–100) computed from four subsystem layers. Certificates are SHA-256 hashed and HMAC-SHA256 signed for independent verification.

Component	File	Lines
Score engine	`core/resilience/resilience_score.py`	818
Certificate generator	`core/resilience/trunk_certificate.py`	273

Scoring Formula

composite = 0.30 * governance + 0.25 * identity + 0.25 * behavioral + 0.20 * governance

Health levels:
  EXCELLENT  >= 90
  GOOD       >= 70
  FAIR       >= 50
  POOR       >= 30
  CRITICAL   <  30

Certificate Fields

Each certificate contains: composite score, per-layer breakdown, invariant hashes (SHA-256), campaign verdict, charter veto rate, trend direction, content hash (SHA-256 of payload), and HMAC-SHA256 signature.

3. Live Demonstration Evidence

The following are real request/response pairs produced by the EVE CoreGuard evaluator. These can be reproduced by calling the API or running the SDK demo script.

Example: BLOCKED Decision

Request

{
  "policy_set": "lending_v1",
  "user": { "id": "u_demo", "role": "loan_officer" },
  "proposed_action": { "type": "loan_approval", "amount": 250000 },
  "context": {
    "credit_score": 580,
    "debt_to_income": 0.52,
    "employment_verified": false
  }
}

Response

{
  "decision": {
    "status": BLOCKED,
    "action": "loan_approval"
  },
  "risk": {
    "score": 0.6284,
    "level": "HIGH",
    "factors": [
      "Credit score 580 below minimum 620 (weight: 0.40)",
      "DTI 0.52 exceeds maximum 0.45 (weight: 0.35)",
      "Employment not verified (weight: 0.25)"
    ]
  },
  "policy_violations": [
    { "policy_id": "CREDIT_SCORE_MIN", "description": "Credit score 580 below minimum 620" },
    { "policy_id": "DTI_LIMIT", "description": "DTI ratio 0.52 exceeds limit 0.45" },
    { "policy_id": "EMPLOYMENT_REQUIRED", "description": "Employment verification required" }
  ],
  "audit": {
    "audit_id": "aud_...",
    "hash": "a1b2c3d4... (SHA-256)",
    "signature": "f6e5d4c3... (HMAC-SHA256)"
  }
}

Why BLOCKED: All three policy rules were violated. The risk score (0.6284) exceeds the HIGH threshold (0.60). The system returned three specific, auditable policy violations with their IDs. The decision is deterministic — the same input under the same policy version produces the same output.

Example: ALLOWED Decision

Request

{
  "policy_set": "lending_v1",
  "user": { "id": "u_demo", "role": "loan_officer" },
  "proposed_action": { "type": "loan_approval", "amount": 150000 },
  "context": {
    "credit_score": 740,
    "debt_to_income": 0.30,
    "employment_verified": true
  }
}

Response

{
  "decision": {
    "status": ALLOWED,
    "action": "loan_approval"
  },
  "risk": {
    "score": 0.0,
    "level": "LOW",
    "factors": []
  },
  "policy_violations": [],
  "audit": {
    "audit_id": "aud_...",
    "hash": "... (SHA-256)",
    "signature": "... (HMAC-SHA256)"
  }
}

Why ALLOWED: Credit score (740) exceeds minimum (620). DTI (0.30) is below limit (0.45). Employment is verified. Zero violations. Risk score is 0.0. Audit record is still generated for the ALLOWED decision — every decision is recorded regardless of outcome.

Example: Charter Veto (Governance Layer)

Python

from core.governance.veto_core import check_charter

result = check_charter(
    action_type="identity_modification",
    action_params={"target": "identity", "operation": "delete"},
    context={}
)

# result.compliant       == False
# result.veto_type       == "hard_block"
# result.violated_rules  == ["cop.identity.no_core_deletion"]
# result.reasoning       == "Attempted deletion of protected target: identity"

Why HARD_BLOCK: Rule cop.identity.no_core_deletion fires when any action attempts to delete a protected identity component. This is a HARD_BLOCK — no override path exists. The check is a pure function with no I/O and no side effects.

4. Public Verification Methods

Anyone with access to the codebase or a running instance can verify these claims independently.

Method 1: Health Check Endpoint

curl http://localhost:8000/v1/decisions/health

# Response:
# { "status": "healthy", "policy_sets_loaded": 27 }

Method 2: Install and Run SDK

# Install (zero external dependencies)
pip install eve-coreguard

# Run the demo (server must be running on localhost:8000)
python sdks/coreguard/run_demo.py

# Run tests (no server required)
pytest sdks/coreguard/test_coreguard.py -v

Method 3: Run Veto Core Tests

# 78 tests covering determinism, charter compliance, red lines,
# cognitive locks, budget enforcement, and purity guarantees
pytest tests/test_veto_core.py -v

# Verify purity (only stdlib imports)
grep "^import\|^from" core/governance/veto_core.py

Method 4: Inspect the C Header

# 401-line C header defining the firmware API contract
# 7 structs, 8 enums, 11 function declarations
cat core/governance/veto_interface.h

Method 5: Verify Audit Integrity

from core.coreguard.audit import verify_audit

# Returns True if SHA-256 hash and HMAC-SHA256 signature are valid
is_valid = verify_audit(audit_record)

# Proof bundles can also be verified locally (no server):
from eve_coreguard import CoreGuardClient
CoreGuardClient.verify_proof(proof_bundle, signing_key="your-key")

5. What Is NOT Claimed

Explicit Disclaimers

No confirmed valuation. No third-party valuation has been conducted or is claimed.
Patents are provisional. 90 filed U.S. provisional applications have been filed (serial numbers 63/988,235 through 64/047,284), organized into 6 anchor families. These are not granted patents. Provisional applications establish a priority date but do not confer enforceable rights until converted to non-provisional applications and approved by the USPTO.
No monopoly claims. Other AI governance solutions exist. This page does not claim EVE AI Core is the only or the best solution.
No verified enterprise customers. No customer names, logos, or adoption metrics are disclosed on this page because none have been independently verified for public disclosure.
Twenty-seven policy packs are registered. lending_v1 is the reference pack used in the examples above; 27 packs are registered (including fair lending, fair housing, insurance, healthcare, EU AI Act, GDPR, securities trading, AML, biometric privacy, and employment/hiring). Enumerate them with GET /v1/decisions/policies.
Firmware compilation has not occurred. The C header (veto_interface.h) defines an API contract. No compiled firmware binary exists. The header is a specification, not a shipped product.

6. Technical Positioning

What Category This Fits In

EVE AI Core is an AI governance interception layer. It sits between an AI system's decision-making and action execution, applying deterministic policy checks before actions are dispatched. This is sometimes called a "guardrail," "policy engine," or "AI firewall" depending on the vendor.

What Already Exists in Industry

The AI governance space includes established and emerging tools:

Guardrails AI — Open-source input/output validation for LLMs
NVIDIA NeMo Guardrails — Programmable rails for conversational AI
Lakera Guard — Prompt injection and content filtering
Calypso AI — Model testing and risk assessment
Arthur AI — Model monitoring and explainability
Credo AI — AI governance and compliance platform

What Is Structurally Different

The following are architectural properties of the codebase. They are verifiable by reading the source. Whether they constitute competitive advantages is a judgment call left to the reader.

Pure deterministic veto module. All safety-critical logic exists in a single file (veto_core.py, 1,905 lines) with zero I/O and zero external dependencies. This makes the module formally auditable and theoretically compilable to hardware. Most governance tools depend on LLM calls for classification.
Cryptographic audit trail. Every decision produces a SHA-256 hash-chained, HMAC-SHA256 signed audit record. Audit integrity can be verified without trusting the system that produced it.
Three-layer enforcement. Charter rules (ethical), cognitive locks (state-dependent), and drift budgets (identity preservation) operate as independent enforcement layers. A failure in one does not compromise the others.
SDK with local verification. The verify_proof() static method verifies governance proofs without any network call. Auditors do not need access to the server.

7. Roadmap

Everything below is planned work. None of it exists in the codebase today. Items may change, be delayed, or be cancelled.

Exists Now

Capability	Status
Decision enforcement API (`/v1/decisions/evaluate`)	Working
Lending policy pack (`lending_v1`)	Working
Python SDK (`eve-coreguard` v0.1.5)	Working
Deterministic veto engine (15 charter rules, 5 red lines)	Working
SHA-256 hash chain + Ed25519-signed audit trail (HMAC-SHA256 for self-hosted SDK)	Working
Resilience score engine + signed certificates	Working
C firmware API header	Specification written
Interactive demo page	Working

Planned (Not Built)

Capability	Status
Additional policy packs (insurance, healthcare, EU AI Act, GDPR, securities, AML, +)	27 registered
Compiled firmware binary from veto_interface.h	Planned
JavaScript/TypeScript SDK	Partial (client exists, not published)
SaaS multi-tenant deployment	Infrastructure built, not production-deployed
Non-provisional patent conversion	Deadline: 02/2027 – 03/2027
SOC 2 Type II certification	Readiness program underway — no report issued
ISO 27001 certification	Not started
Third-party penetration test	Not started

8. Evidence Summary

Area	Status	Proof Available	Verification Method
Decision Enforcement API	Working	Yes	`POST /v1/decisions/evaluate`
Python SDK	Installable	Yes	`pip install eve-coreguard`
Deterministic Veto Engine	Working	Yes	`pytest tests/test_veto_core.py` (78 tests)
SDK Tests	Passing	Yes	`pytest sdks/coreguard/test_coreguard.py` (28 tests)
Cryptographic Audit	Working	Yes	SHA-256 + HMAC-SHA256, verifiable offline
Resilience Certificates	Working	Yes	`POST /api/resilience/certificate/verify`
C Firmware Header	Written	Yes	`core/governance/veto_interface.h` (401 lines)
Patent Applications	Filed (provisional)	Yes	90 filed provisional apps across 6 anchor families, serial nos. on file
Enterprise Customers	Not disclosed	No	—
Revenue	Not disclosed	No	—
Third-Party Audit	Not conducted	No	—
Compiled Firmware	Not built	No	Header exists, binary does not

Last updated: April 2026. Line counts and commit numbers are from the repository at time of writing and may have changed. Verify against current HEAD.