Nucleus

Nucleus

Don't trust the agent. Verify it.

*Signed identity, declared guarantees, receipts anyone can check.*

[](https://github.com/coproduct-opensource/nucleus/actions/workflows/ci.yml) [](https://github.com/coproduct-opensource/nucleus/actions/workflows/audit.yml) [](https://securityscorecards.dev/viewer/?uri=github.com/coproduct-opensource/nucleus)

**Nucleus is a vendor-agnostic secure runtime for AI agents: it enforces what an agent may do, proves the enforcement boundary is sound, attests how every result was produced, and federates identity and trust — without a single long-lived secret.**

**Assume the agent is compromised. Constrain what it can do anyway. Prove the constraints hold.**

At its core is a small, dependency-free information-flow algebra. Two primitives — `join` and `flows_to` — enforce information-flow control under four algebraic laws. Once untrusted web content enters a session **through a mediated ingest channel**, it cannot silently reach a privileged sink like `git push`. That property is [machine-checked](FORMAL_METHODS.md), not hoped.

The qualifier is load-bearing, so it is stated here rather than in a footnote: the guarantee covers content the runtime *observes*. Fetches through `web_fetch`/`web_search`, file reads, and memory recalls are observed. Bytes an agent obtains by running a command — `curl` inside `run` — are observed only when `NUCLEUS_PARANOID_TOOL_IO=1`, because the runtime cannot tell `curl` from `ls` in a command's output and tainting all of it makes a session "one privileged action then locked". That is an operator's policy call, and until it is made, command output is an unmediated ingest channel.

This is the