Architecture

Ovara Runtime is a single-binary Go gateway plus a federated cloud control plane. The gateway intercepts agent actions, validates identity and leases, evaluates policy with trust-aware scoring, and produces signed receipts.

The decision pipeline

AI Agent / Workflow
  -> Runtime Interceptor (shell, git, github, ci, exec)
  -> Identity Verification (ed25519)
  -> Capability Lease Validation (scope, expiry, depth)
  -> Policy Engine (rules vs action, environment, trust)
  -> Risk + Trust Evaluation (drift, anomaly)
  -> Allow / Deny / Escalate
  -> Execution Sandbox or Target System
  -> Human Approval (on escalate)
  -> Observe Pipeline (OTLP/NATS -> ClickHouse)
  -> Execution Receipt + Audit Trail

Every decision runs identity verification, lease validation, policy evaluation, and optional trust scoring in microseconds (full path ~7.7μs on Apple M4).

Gateway layout

The core gateway (runtime/gateway/) is 29 packages and 153 Go files with 875+ test functions, exposing 30+ HTTP endpoints across 9 route groups:

• runtime checks and batch checks
• approval lifecycle (create, list, approve, resume)
• shield restriction endpoints
• identity and lease management
• receipt query and verification
• observability (Prometheus metrics, OpenTelemetry traces, health)

Beyond the gateway

Product	Role
Ovara Identity	ed25519 machine identity primitives, capability leases, delegation chains
Ovara Observe	Action lineage, traces, OTLP/NATS telemetry, ClickHouse analytics
Ovara Shield	Anomaly signals, trust degradation, containment hooks
Ovara Cloud	Hosted control plane, gateway enrollment, policy distribution, multi-tenant
Ovara Federation	Cross-organization trust graph with portable receipts
Ovara SDKs	TypeScript (@ovara/sdk) and Python (ovara-sdk) with portable verification
Ovara Admin	Next.js dashboard for gateway monitoring, policy editor, audit log

Enterprise layer

OIDC and SAML SSO providers, plus a compliance report generator (SOC2, GDPR, audit summaries). Receipt retention defaults to 365 days. Deployments span multiple regions with gateway autoscaling.