AI that may act.Without the authority to act.

The model proposes. Policy decides. A sandbox executes. A ledger records, including what was refused.

Example of a refused call, as it is written to the audit ledger
14:22:07.318	proposal	workspace.write	src/policy/limits.mjs
14:22:07.318	token	absent	none presented
14:22:07.319	decision	REFUSED	no declared authority
14:22:07.319	ledger	9f2c…a71	prev 4d10…c8b

An example of the refusal path. Real entries live in the audit ledger of your own installation.

The Home screen of a running NOESAR Evolution installation. — `home`
A running installation, not a mockup. Beside Start here it reads 2 of 6 can act on this build: the product says which paths cannot act yet rather than hiding them.

01What you do not need

Four things you do not need.

Most self-hosted AI asks for an account, a key, a network and something proprietary before it will say a word. None of the four is asked here, and each absence has a measurement behind it.

Not required: An account: Access is a first-owner setup on your own machine, with two-factor authentication. There is no licence key to activate and nobody to register with.FEATURES.md: Owner registration, no license key
Not required: An API key: The core builds, starts, runs and passes its own suite with no key present. External providers are opt-in and stay off until you turn one on.README.md: Offline by default
Not required: A network: The image is built with no network reachable at all and the container still starts and serves. Nothing has to leave the machine for the product to work.docs/ATOM_ABSENT_ACCEPTANCE.md: --network=none
Not required: A proprietary part: The core runs with no reserved component present at all. That is recorded as a run that happened, not as a claim that was made.FOSS_CORE_DEPENDS_ON_ATOM=false
Required: A host that runs a container: One image, one container, on infrastructure you control. That is the whole requirement.

02Seen

Six screens of the installation this page was written from.

Not renders and not a design file. These come from the build running on the machine described here. The bar at the foot of every screen carries the same two things: what may leave the installation, and how many decisions are waiting.

Captured 2026-09-07 · Midnight theme · English · no view retouched

The Models screen, showing the model in use and the hardware detected. — `models`
The model that answers, with its licence, its context window and who signed it. The card beside it is this machine: an RTX 3060 with 12 GB, and 46 of 65 layers put on it because that is what fits.

The Approvals queue, showing nothing waiting for a decision. — `approvals`
One queue for every subsystem. It is empty here, and that is the reading: nothing was waiting for a human at the moment this was taken.

The CodeN Evolution coding agent attached to the live session. — `coden`
The coding agent attached to the live session, marked local-only, with a shadow run beneath the prompt. What it plans is measured against a copy before a real file moves.

The Projects screen with a new project typed but not created. — `projects`
A project being written, not a finished one: the form is filled and Create has not been pressed. The instruction field carries the rule this whole page is written under.

The Providers screen, showing local endpoints as the default. — `privacy`
No vendor lock-in, default deny. Local endpoints are the default and external ones stay disabled until an explicit data scope is granted.

03The boundary

The boundary is a table in the code, not a promise in a document.

The tool registry is derived from the effect table rather than kept by hand beside it. Three effects, three different answers.

Effect	Methods	Registered as tools
read	21	Yes Retrieval, inspection, search. No approval, no side effects.
write	9	Yes, every call waits for a human A mutating call stops mid-turn and waits for an explicit approval. The queue and its trail are first-class, not a log line.
destroy	2	No. They do not ship as tools at all Classified, schema'd, reachable by a person in the terminal behind a typed confirmation word, and deliberately never handed to a model. A model emitting JSON has no equivalent of typing a word on purpose.

04Ask, create, act

Ask. Create. Act.

Ask: Research and source-grounded answers with citations, over controlled retrieval, not an unattributed model guess.
Create: Editable documents, code, tables, charts and canvases, living inside a project rather than as detached uploads.
Act: Agents, tools, approvals, scheduled work and execution that leaves an auditable record behind it.

05Evolution

Every machine got faster. Only the last one got an opinion.

Four centuries of computing, and the same arrangement throughout: the machine executes, a person decides. It runs on its own. Take hold of it to see where that arrangement finally breaks, and what has to be rebuilt when it does.

1642

Mechanical

Pascal's gears carry the tens. The machine computes; a person decides everything else, and nobody thinks to write that down as a rule.

Runs on its own. Drag it, or use the arrow keys.

06What is inside

Twenty-seven screens, including the half nobody shows.

Product pages show the chat. Something you actually operate also needs an approval queue, a security page, logs, health, hardware, users, backups and updates. Here is all of it, grouped by the question it answers.

Where did this answer come from?

Retrieval with citations, a conversation you can fork and undo, and four separate kinds of memory.

chatA versioned conversation. Fork, edit, merge, undo.
researchAnswers from retrieved sources, with citations.
knowledgeThe files, notes and facts a project draws on.
memoryFour separate memory categories, not one store.
documentsRich text, spreadsheets, charts and canvases.
projectsWhere a piece of work is scoped and kept.

Who is doing the work?

Agents, and a coding agent that plans against a shadow copy before a real file moves.

codenA coding agent on this installation's own workspace.
coden-tuiThe same agent over SSH, on the same live session.
agentsMulti-step goals, each with its own tools and policy.
workflowsSteps chained together, runs visible as they go.
tasksRecurring and deferred work, on the same surface.
toolsMCP servers and HTTP tools, under the same consent.

What stopped it?

The approval queue, the boundary that mints the tokens, and the record of both.

approvalsEvery mutating step waits here for a person.
securityCapability tokens, sandbox, and egress rules.
logsStructured records of what actually ran.
access-deniedThe refusal has a screen of its own.

How do I keep it alive?

The operator half: what fits this hardware, who may log in, and how you go back.

homeRuns, tasks and the queue, on one surface.
modelsWhat fits this host, and what signed it.
providersExternal endpoints, off until you enable one.
hardwareRAM, cores and accelerators, detected not assumed.
healthLive service state, the way an incident needs it.
usersPeople, roles, and elevation that expires.
backupsChecksummed snapshots, taken with the service stopped.
updatesSigned packages, with the predecessor kept for rollback.
settingsModules, themes, keyboard and terminal.
aboutVersion, licence, and what this build is.

27 views ship in the interface, 13 of them in the sidebar. Twenty-six are listed here; the twenty-seventh is the page shown when an address does not exist.

07Run it

Four steps. The fourth one tells you if it worked.

One image, one container. The core builds, starts, runs and passes its own suite with no external network reachable and no API key.

Get the source
$ git clone https://github.com/komandante78/noesar-evolution-core.git
Build the image
$ bash deployment/docker/build.sh
Start the container
$ bash deployment/docker/run.sh
Ask whether it worked
$ ./INSTALLATION/verify-installation.sh
INSTALLATION_VERIFY=PASS

The fourth step answers for itself, or it fails. You do not have to take this page’s word for it.

Assets for Podman, Linux, macOS and Windows live under deployment/.

08Proof

A number you cannot reproduce is a defect.

Measured on the development host, from the repository, on the date shown. If one of these commands disagrees with the number, the number is wrong. Open an issue.

Measured 2026-09-06

3 145tests passingof 3 165 across 346 suites. 0 failing, 20 skippednpm test
473files, zero errorsESLint 9.39.5 · 0 warningsbash tools/run-eslint.sh
6 696files in the manifestthe repository, counted by the repositorynode tools/generate-manifest.mjs
0destroying tools shippedtwo exist · neither is reachable by a modelnode -e "import('./services/reference-control-plane/src/ai-workspace/builtin-tools.mjs').then(m => console.log(m.EFFECT))"

09What is not done

This page does not contradict the product's own state file.

The project's rules forbid presuming what has not been measured. Three things are open, and naming them here is cheaper than having a reviewer find them.

production_ready = false: The product's own state file says so, and the gate holding it there is an independent third-party security audit, by definition not something the author can perform on their own work.
The pentest has not run: Its scope is written and dated in docs/security/INDEPENDENT_PENTEST_SCOPE.md, whose own first line reads: Status: not run.
Installed on one host: It has been installed and exercised on one machine. Not presuming a second one is not the same as having proven it, and cross-platform installation evidence is open work.

10Open

Nothing here asks to be believed.

Every number on this page names the command that produced it. Run them on your own machine and see whether they hold.

Install it Read the source