Open at the Edges, Sovereign at the Core

The hardest problem in AI governance isn't detecting a bad output — plenty of tools do that. The hard problem is authority: when an agent proposes to move money, call a tool, or approve a loan, who decides, on what basis, and can you prove it later?

EVE's answer has never changed: CoreGuard is the single deterministic authority. No model sits in the decision path. Every decision is signed and offline-verifiable. What changed this month is everything around that core — EVE now accepts signals from wherever your stack already produces them, binds them into a certificate two independent verifiers agree on, and shows up in the login flows and marketplaces enterprises use. Here's what's rolling out.

EVE Now Speaks Your Observability Stack's Language

Every AI platform emits telemetry in its own dialect. If your governance layer only understands its own format, integrating it means rewriting your instrumentation. The new semantic mapping registry flips that: EVE ingests spans from the frameworks you already run and normalizes them into a closed set of 10 canonical span types — llm, tool, agent, chain, embedding, retriever, reranker, guardrail, evaluator, and a generic span. Classification is deterministic and fail-safe: an unrecognized span becomes a generic span rather than guessing or raising.

Normalization is descriptive, not decisive: raw attributes are preserved, secrets and PII are redacted down to value-shape, and an inbound tenant identifier is advisory only. Beyond the built-in frameworks, tenant administrators can register their own mapping packs — backed by a durable, row-level-security-isolated table, verified against real Postgres, so one tenant's mappings are invisible to another.

Every Decision, Provable in Two Languages

A signature you can only verify with the vendor's own tool isn't really proof. This release introduces eve.decision.certificate.v3 — a signed successor certificate that binds the semantic-mapping digest and optional non-authoritative validator signals into the signed evidence itself. Two properties make it matter:

• Cross-language parity. The open-source eve-verify toolkit (now v1.2.0) verifies v3 in both Python and TypeScript against shared deterministic fixtures. If tampering breaks the Ed25519 signature, both verifiers reject it — independently.
• Authority separation is cryptographic. The signed decision is the sole authority. Every external signal is force-stamped authoritative=false inside the signed payload; a signal that claims authority is rejected by the shape of the certificate, not by a rule that could be misconfigured.
• Backward-compatible by construction. v3 is opt-in, the default emission stays v2, and the v2 contract is provably not mutated. You adopt richer evidence when you're ready.

For teams standardizing on Guardrails-AI, EVE now ingests its validator outputs as non-authoritative, allow-listed signals — lazily bound, fail-closed, with supply-chain controls. Guardrails' detections become evidence in the certificate; they never become the decision.

Governing Agent Actions, With a Durable Trail

As agents start taking consequential actions, "we blocked it" isn't enough — you need to retrieve what happened, after a restart, on any replica, scoped to the right tenant. Two closely related improvements land here:

• Certificates recorded where it counts. When the agent firewall issues a signed allow, or the payment gate mints a capability for a money-moving action, EVE durably records the certificate at the mint boundary — retrievable and offline-verifiable later. The tenant binding is server-enforced, so a client can't redirect a certificate to another tenant. It's fail-open and never raises into the authorization path.
• A real firewall-history read surface. Operators can now browse past firewall decisions through a durable, tenant-scoped API — newest-first, strictly isolated, where a cross-tenant lookup returns "not found," never a disclosure.

Both are gated behind explicit flags and default to today's behavior — nothing changes until you turn it on.

An Enterprise MCP Front Door — Authenticated and Proof-Bound

There's a new inbound enterprise MCP server that gives enterprise systems authenticated, tenant-bound operational access to EVE over standard JSON-RPC — and routes every consequential mutation through CoreGuard. The differentiator is the "and": evaluate and authorize calls run through the hardened evaluator and governed execution gate, a block never executes, idempotency keys guard against replay, and every call returns a signed decision-certificate reference. It's registered but dormant and off by default — built, tested, and ready for the enterprises that ask.

Meeting Enterprises Where They Buy

Great governance that's hard to procure doesn't get adopted. This cycle closed much of that gap:

• Cloud marketplaces. EVE CoreGuard is live and public on the Azure Marketplace, with the AWS Marketplace listing established under EVE Core LLC and a Google Cloud Marketplace fulfillment adapter built and staged.
• Enterprise SSO login. The full single-sign-on journey is complete — organization-slug entry, server-side enforcement, and an end-to-end tested callback flow.
• SOC 2, stated honestly. Our public status reads "SOC 2 Type II — In Progress," with our auditor named. No overclaiming; just where we actually are.

What's Live vs. What's in Preview

We hold ourselves to honest status vocabulary, so here's the plain version.