Encrypt outside.
The client keeps plaintext and keys.
Verified technical architecture
Evidence before state.
Encrypted references move through custody. Plaintext and keys stay outside.
Enforce inside.
NeuNuc checks consent, identity, state, and quorum.
Prove before changing.
No state changes until evidence commits.
ImplementedDefined boundaryExisting surfaceExternal
User + operator
Hosted control plane
Bare-metal nucleus
Evidence + protected storage
Implemented nucleus
nuc-custody
Consent, controller matching, two-person authorization, fail-closed evidence ordering, release, revocation, expiration, quarantine, destruction, and deterministic replay.
Production boundary: identity, durable signing and storage remain external adapters.
Verified boundary
The nucleus is implemented. Three production adapters remain.
Built
NUC1 framing, consent and controller enforcement, two-person release, object checks, audit events, fail-closed ordering, and replay.
Still required
Production identity verification, a signed durable evidence ledger, and a ciphertext object-store adapter.
Read the frozen architecture rule
No custody state changes until the corresponding evidence event commits. In-memory state is expendable; verified evidence history is authoritative.