Context
The right information, with a boundary.
Minimal, approved, attributable sources in the exact namespace. Context versions make the inputs inspectable.
ARCHITECTURE / DESIGN REQUIREMENTS
A boundary around every run.
Eventus defines how work is scoped, reviewed, and connected to evidence. Its intended governance layer sits around your orchestrator, agents, models, tools, and downstream applications.
Architecture describes required behavior. Current local implementation covers a subset. See the implementation status.
THE SIX PILLARS
One connected governance model.
Process
A versioned path through the work.
Explicit inputs, outputs, capabilities, resource limits, retries, and recovery behavior.
Knowledge
Evidence before reuse.
Provenance, applicability, and reuse permissions travel with a proposal. Promotion requires review.
Quality Control
A decision before an effect.
Validation and human judgment tied to the run, action, scope, and exact artifact under review.
Triggers
A controlled way to begin.
Authenticated, allowlisted, validated, deduplicated events invoke named workflows.
Feedback Loops
Outcomes that remain attributable.
Measurements link back to the run, versions, artifacts, and approvals that produced them.
THE FULL OPERATING LOOP
Learning returns through review.
Every proposed context or knowledge update returns to a review boundary before it can influence an approved version.
Approval is specific.
Human authorization must match the run, action, scope, and reviewed artifact. A general permission to help is insufficient for a consequential external effect. Changed content requires a new decision.
SYSTEM BOUNDARIES
Governance and execution have different owners.
Eventus Engine
Owns the governance contracts: namespace policy, workflow identity, context and knowledge records, review requirements, artifact references, and outcome linkage. Local reference code implements part of this boundary.
Orchestrator
Coordinates steps, scheduling, checkpoints, retries, and runtime status. An adapter must translate Eventus contracts into runtime operations without weakening the controls.
Agents
Perform bounded tasks and propose artifacts. Agent output does not grant authority or change approved rules.
Models and tools
Provide inference and capabilities through constrained adapters. A workflow names a task alias rather than a vendor model. Tool access must remain within the declared scope.
Downstream applications
Own domain logic, user interfaces, and application data. Their readiness, permissions, or operating knowledge do not establish readiness for the core platform.
HERMES / REFERENCE ORCHESTRATOR
A reference choice, with an explicit integration gap.
Hermes is the reference orchestrator in the Eventus architecture. The inspected core checkout contains a local Python reference orchestrator. A general Eventus-to-Hermes adapter and end-to-end Hermes integration are not verified in this checkout.
A future adapter must preserve namespace, approval, model-routing, and execution limits. Existing downstream or hosted runtime notes do not close that gap.
STATE OWNERSHIP
Shared contracts. Separate state.
Governance state
Versioned workflow definitions, context records, approval decisions, artifacts, and feedback belong to the governed Eventus namespace. The local reference adapter uses SQLite for development and tests.
Runtime state
Scheduling state and checkpoints belong to the chosen orchestrator. They must reference the Eventus run and workflow version. They cannot serve as independent approval authority.
Application state
Domain records remain in the downstream application. Eventus context should use approved references with provenance rather than importing unrestricted raw data.
Provider state
Credentials belong in protected runtime configuration. Model-provider retention, logging, and fallback restrictions must be reviewed independently.
demodemo.reviewA grant for a parent namespace does not grant access to a child. Namespace equality is exact. Cross-namespace knowledge reuse requires explicit permission and review.
EXECUTION INVARIANTS
Carry the controls to the effect.
External effects need bounds.
Idempotency, bounded retries, timeouts, and audit records are required. Define rollback or compensation where practical. Local reference components do not establish a production effect executor.
Fallback keeps the same restrictions.
Provider-neutral task aliases separate workflow intent from vendor choice. Any fallback must preserve data restrictions and authorization requirements. Live provider routing and fallback are not validated here.