Wallet-challenge sessions
Owner sessions are established by signing a fresh challenge with your wallet — a nonce the server verifies cryptographically. Possession of the key is the login; there are no passwords to breach.
SECURITY & TRUST
Safe by design,
honest by default.
Trust shouldn't be a badge we award ourselves. This page states what the runtime actually does — where the boundaries are, what never leaves your hands, and what we deliberately don't claim.
THE REAL POSTURE
What the runtime actually does
No keys stored
The server never stores private keys, and the EVO never holds a wallet or signing authority. The key never leaves your hands — the challenge only proves you hold it.
Testnet-only, hard-blocked mainnet
The runtime is testnet-safe. In the economic layer, mainnet is hard-blocked at policy load and re-checked at every decision — it can't be drifted into by accident or by the EVO itself.
Honest labels everywhere
Where a real integration doesn't exist yet, a labelled EMULATOR stands in — and is marked as such. Testnet-10 is labelled testnet-10. Nothing emulated is presented as real proof.
Durable audit ledger
Privileged decisions — approvals, treasury allows and denies, work-order transitions — are journaled to a durable store. A restart can't reset a budget or erase a decision.
Graceful degradation
When a dependency fails, the system degrades honestly rather than fabricating success: unavailable services return explicit errors, and nothing is claimed as verified that wasn't.
ADVERSARIAL TESTING
We test the hostile cases, not just the happy path
The codebase ships with adversarial and fault-injection test suites that exercise the failure modes a real deployment would face — because a safety claim you can't test is just a sentence.
Hostile economic cases
Mismatched results, dropped results, delayed settlement, replay attempts and boundary violations — the economic loop is tested against adversarial provider behavior, not just cooperative ones.
Fault injection
Crash, restart and persistence-conflict scenarios are injected deliberately to prove that durable state — budgets, approvals, lineage — survives what shouldn't happen but will.
Privacy boundary scans
Public projections like the Life Passport are scanned for forbidden fields on every response — a structural check that fails closed rather than leaking.
WHAT WE DON'T CLAIM
The honest negative space
No certifications — yet
EVO holds no security certifications, audits or compliance attestations. This page describes real, testable behavior — not third-party validation that doesn't exist yet.
No enterprise SLA
This is alpha software running testnet-safe. There is no uptime SLA, no multi-tenant SaaS guarantee, and no support contract — yet.
No mainnet exposure
Nothing here touches mainnet or real funds. That's not a limitation we're hiding — it's a boundary the code enforces, and lifting it requires explicit owner authorization.
No silently assumed trust
EVO can't weaken its own permission policy, self-approve spend, or convert private memory into public history. These are invariants in code and constitution — enforced, not promised.
Judge it by running it
The strongest security statement is a runtime you can inspect and a record you can check.
See the demo