| Field | Value |
|---|---|
| Classification | PUBLIC |
| Date | 2026-09-07 |
| Version | 3.0.0 |
| Status | Complete (10 documents) — v3.0.0 stable (GKE deployment verified; 3,925 tests collected / 3,446 passed, 0 failed, 96 skipped; 75.40% statement coverage) |
Framing note: CAGE is a domain-agnostic governance substrate, not a finance-specific product. Domain semantics are supplied by optional
cage.pluginspackages — finance (src/cage_finance/) and healthcare (src/cage_healthcare/) ship as equal-standing example domains, both optional, and adopters author their own for manufacturing, logistics, energy, or any other vertical. Jurisdictional compliance (US_FED,EU_ECB,APAC_MAS,LOCAL, or custom) is a configurable posture layered over the universal ISO 42001 baseline. Where the sentence below and the documents in this series use finance-domain nouns — "financial advising",execute_trade,governed-financial-advisor— they illustrate the substrate with one case study rather than describing a core requirement.
The Cybernetic Governance Engine (CAGE) is a production-grade, multi-agent AI governance framework designed for regulated financial advising, deployed on Google Kubernetes Engine (GKE). CAGE v3.0.0 implements evidentiary independence — the system cannot manufacture the conditions necessary to satisfy its own governance checks — via Cloud KMS HSM-backed signing, strictly human-gated NeMo refinement, heterogeneous multi-model consensus, Lua-atomic Control Barrier Functions (atomic_verify_and_commit()), synchronous replica WAIT verification with fail-closed automatic rollback, canonical 1.1 evidence stream hashing with mandatory blocking durability (validate_evidence_stream_preconditions()), and externally reconciled Control Barrier Function balances (POAM-023 / POAM-2026-038 closed; GCS WORM ledger + Cloud KMS signing with 300s TTL in Redis). This technical report series documents the full system across ten specialized documents, covering its architecture, technology stack, agent pipeline design, neuro-symbolic governance engine, regulatory compliance posture, security controls, deployment infrastructure, an operational runbook capturing verified recovery procedures and integration test results, and a formal verification proof. Together, the documents provide a complete engineering and compliance record for security assessors, architects, compliance officers, operations teams, and AI/ML engineers evaluating or operating the system.
| # | Document | File | Description |
|---|---|---|---|
| 01 | System Overview | 01-SYSTEM-OVERVIEW.md |
High-level introduction to CAGE — purpose, stakeholders, regulatory constraints, primary capabilities, current compliance posture, and authorization boundary. v3.0.0: 6 governance primitives, No-Direct-Bind BFS model, Distributed CBF multi-agent proof, and external attestation layers. |
| 02 | Architecture | 02-ARCHITECTURE.md |
Structural design of all major subsystems — LangGraph StateGraph (12 nodes including mandatory NeMo input/output rails and FTRA/DEFER nodes), Hybrid Gateway (MCP + Inference + Governance + KMS Signer + ConsensusModelRegistry), Compliance Bridge, AgentSight UI, eBPF DaemonSet, and Vendor Integrations (src/integrations/ — Provider 01–06) — including component interaction diagrams, HITL workflow, gRPC interfaces, observability, the human-gated NeMo refinement flow, and Linkerd mTLS mesh policies. |
| 03 | Technology Stack | 03-TECHNOLOGY-STACK.md |
Exhaustive inventory of all languages (Python, TypeScript, Rego, Colang 2.x, HCL, proto3), frameworks (LangGraph 12-node pipeline, FastAPI, NeMo, OPA), LLM infrastructure (vLLM, DeepSeek-R1, Llama-3.1, Qwen), Python libraries, vendor integrations (provider_01–provider_06), frontend stack, Kubernetes/GCP platform components, protocols, and data stores. |
| 04 | Agent System | 04-AGENT-SYSTEM.md |
Complete multi-agent pipeline design — all 9 agents (thinker, doer, data analyst, execution analyst, evaluator, explainer, governed trader, risk analyst, financial advisor), full AgentState TypedDict (33 fields including ftra_status, ftra_result, ftra_defer_id, narrow_status, narrowed_params, pause_resume_token, confidence), graph routing logic, subgraph designs, HITL approval workflow, checkpointing, EvaluatorAuditor scoring, and red team adversarial harness (290+ payloads). |
| 05 | AI Governance & Policy Engine | 05-AI-GOVERNANCE-POLICY-ENGINE.md |
The neuro-symbolic governance core — full SymbolicGovernor pipeline (STPA/UCA validation, SR 26-2 §IV.B agentic confidence, Control Barrier Function with externally reconciled balances, OPA Rego, heterogeneous multi-model consensus, DoWhy causal gatekeeper, adaptive FRIA gate, DEFER / NARROW / PAUSE state machines, NeMo Guardrails Colang flows and actions, OPA role-based policy rules, Cloud KMS HSM-backed governance signing, threshold management, ISO 42001 control stamping, Policy Transpiler, and STPA-to-Policy Compiler CLI |
| 06 | Compliance & Standards | 06-COMPLIANCE-STANDARDS.md |
Full regulatory framework coverage — NIST SP 800-53 Rev 5, NIST RMF 7-step posture and ATO roadmap, ISO/IEC 42001:2023 (Clauses 6/8/9/10 + Annex A), OSCAL artifacts, 31 active Lula validation manifests (plus draft validations), ISCM 2-tier strategy, Privacy Impact Assessment, SAR-CAGE-2026Q1, and threshold traceability |
| 07 | Security Infrastructure | 07-SECURITY-INFRASTRUCTURE.md |
Defense-in-depth security — authorization boundary (9 NetworkPolicy objects), Cloud KMS HSM-backed governance signing with documented 90-day rotation and 30-day HMAC seal secret lifecycle (KEY_ROTATION.md), NIST SP 800-52 Rev. 2 TLS test enforcement (test_tls_enforcement.py), base image CVE hardening, OPA RBAC, two-layer PII protection (Presidio, 10 entity types), 7-year audit logging, AgentSight eBPF monitoring, externally reconciled CBF, and red team coverage |
| 08 | Deployment & Infrastructure | 08-DEPLOYMENT-INFRASTRUCTURE.md |
Full deployment architecture — 16-service Kubernetes topology, Kubernetes Inference Gateway, Docker image inventory with python:3.12-slim-bookworm base and pinned third-party tags, Cloud Build CI/CD pipelines, modular Terraform IaC (infra/targets/ + infra/modules/), vLLM GPU configuration, Langfuse self-hosted deployment, storage backends, network policies, latency strategy, and Redis db=1 noeviction |
| 09 | Operational Runbook | 09-OPERATIONAL-RUNBOOK.md |
Verified operational procedures — vLLM model update verification, governed-financial-advisor recovery, full integration test results (3,446 passing, 0 failed, 96 skipped across all three regional postures), uv run pytest execution with --dist loadscope, emergency key revocation runbooks (KEY_ROTATION.md), Saga engine ghost-state recovery, and GKE deployment lifecycle |
| 10 | Formal Verification | 10-FORMAL-VERIFICATION.md |
Composite Verification Framework (CVF) proof — STPA hazard completeness (UCA-5/FIN-1 TOCTOU eliminated), VSM structural completeness, hybrid automata reachability, AARM 11-vector neutralization, FiscalLimitGuard race-condition proof, Cloud KMS HSM non-repudiation proof, discrete-time Control Barrier Function proof, Routing Seal v3 Integrity, No-Direct-Bind BFS model (57/66 states), and Distributed CBF Multi-Agent Formal Proof ( |
| Fact | Value |
|---|---|
| CAGE Version | 3.0.0 |
| NIST RMF Overall Readiness | 24% |
| System Risk Level | HIGH (no ATO) |
| Domain Coupling | None — kernel is domain-agnostic |
| Example Domain Plugins Shipped | 2, equal standing (cage_finance, cage_healthcare); both optional |
| Adding a Domain | New src/cage_<domain>/ plugin package; no kernel change |
| Compliance Frameworks | 19 (NIST, ISO, SEC, FINRA, GLBA, SR 26-2, EU AI Act, DORA, GDPR, EBA, MAS FEAT, MAS TRM, CSA AARM) — universal baseline plus posture-selected extensions |
| Jurisdictional Postures Shipped | 4 (US_FED, EU_ECB, APAC_MAS, LOCAL) — configurable, extensible |
| Adding a Jurisdiction | Config-only (config/thresholds/, config/compliance/); no Python change |
| Regional Compliance Profiles | 3 jurisdictional (config/compliance/) + universal baseline |
| Regional Threshold Profiles | 3 jurisdictional (config/thresholds/) + kernel defaults |
| OSCAL Framework Routing Tables | 4 (NIST, ISO 42001, EU AI Act, MAS FEAT) |
| Agent Nodes | 12 (LangGraph StateGraph) |
| AgentState Fields | 33 (including ftra_status, ftra_result, ftra_defer_id, narrow_status, narrowed_params, pause_resume_token, confidence) |
| Governance Tiers | Plugin-registered pipeline (Phase 1 domain tiers + Phase 2 mutating, with Kernel Gates 0.5 FTRA, 1 CBF, 2 OPA, 3b Consensus, 7 Causal, and FRIA) |
| Decision Primitives | 6 (ALLOW, DENY, REQUIRE_APPROVAL, DEFER, NARROW, PAUSE) |
| SLM Sidecar | Deprecated (v2.0.x) — slm_available=false sentinel; 0ms latency |
| Governance Thresholds | 22 (in governance_thresholds.json) |
| Governance Signing | Cloud KMS HSM (RSA-PKCS1-4096-SHA256) |
| Consensus Architecture | Heterogeneous (DeepSeek-R1 + Llama 3.1) |
| CBF Ground Truth | Reconciled WORM ledger (GCS + Cloud KMS signing with 300s TTL in Redis, POAM-2026-038 CLOSED) |
| NeMo Refinement Model | Human-gated propose → approve → apply |
| NeMo PII Entity Types | 10 (Presidio; input + output rails) |
| Vendor Integrations | 6 (provider_01 through provider_06) |
| Lula Validation Manifests | 31 active (plus drafts — see compliance/lula/README.md) |
| Open Critical Findings | 1 (FIND-007 FIPS 199 unsigned — POAM-009) |
| Open High Findings | 6 (POAM-001, 002, 008, 018, 019, 022; POAM-011, 012, 013, 037, 038 closed) |
| Resolved Critical Findings | 2 (FIND-010 HMAC bypass — resolved; FIND-011 mTLS — POAM-007 closed) |
| AARM Vectors Neutralized | 10/11 (V11 PARTIAL — POAM-022) |
| Red Team Payloads | 290+ |
| Automated Tests | 3,925 collected / 3,446 passing, 0 failed, 96 skipped (v3.0.0 stable, 2026-09-06) |
| Audit Log Retention | 7 years |
| Latency SLA | 200 ms US / 150 ms EU (real-time interbank rail infrastructure requirement — FedNow / SEPA Instant) |
| Primary LLM (Reasoning) | DeepSeek-R1-Distill-Llama-8B (AWQ) |
| Primary LLM (Fast) | Meta-Llama-3.1-8B-Instruct |
| Technical Report Documents | 10 (TR-01 through TR-10) |
The following key formulas appear across the technical report series. Each formula is implemented directly in source code and enforced at runtime; the table provides a cross-reference to the primary document where the derivation or proof appears.
| Formula / Invariant | Expression | Source File | Primary TR Document |
|---|---|---|---|
| CBF safe set | S = {x ∈ ℝⁿ : h(x) ≥ 0} |
src/gateway/governance/safety/cbf_engine.py |
TR-10, TR-05 |
| CBF barrier function | h(x) = cash_balance − min_cash_balance |
src/gateway/governance/safety/cbf_engine.py |
TR-10 |
| Discrete-time CBF condition | h(S(t+1)) ≥ (1−γ)·h(S(t)), γ ∈ (0,1) |
src/gateway/governance/safety/cbf_engine.py |
TR-10 |
| Confabulation risk score | risk_score = 1.0 − confidence |
src/gateway/governance/confabulation_scorer.py |
TR-05 |
| FRIA zone — allow threshold | FRIA_ZONE_ALLOW = 0.95 |
src/gateway/governance/symbolic_governor.py |
TR-05 |
| FRIA zone — defer threshold | FRIA_ZONE_DEFER = 0.70 |
src/gateway/governance/symbolic_governor.py |
TR-05 |
| Causal marginal risk boundary | (0.5 + estimate.value × amount) > 0.95 |
src/gateway/governance/causal/gatekeeper.py |
TR-05, TR-10 |
| PlaceboTreatmentRefuter criteria | 50 sims, p < 0.05, |eff| > 0.2 | src/gateway/governance/causal/gatekeeper.py |
TR-05 |
| Routing seal v3 token format | Asymmetric JWT signed via Cloud KMS HSM (fallback <expire_hex>.<slug>.<hash>.<hmac> in dev/test) |
src/gateway/governance/routing_seal.py |
TR-10, TR-07 |
| Provenance hash chain | record_hash[n] = SHA-256(record_hash[n-1] ‖ content_json[n]) |
src/gateway/governance/provenance_chain.py |
TR-10 |
| Fiscal daily cap | $500,000 over 86,400 s rolling window | src/gateway/governance/safety/resource_guard.py |
TR-10, TR-05 |
| STPA UCA FIN-1 | trade_value > position_limit |
src/gateway/governance/ontology.py |
TR-05 |
| STPA UCA FIN-2 | portfolio_concentration > 0.25 |
src/gateway/governance/ontology.py |
TR-05 |
| STPA UCA-5 | drawdown > 4.5% → block |
src/gateway/governance/ontology.py |
TR-05 |
| STPA UCA-6 | order_size > fraction × daily_vol (1% US/0.5% EU/0.8% APAC) |
src/gateway/governance/ontology.py |
TR-05 |
For full derivations and proofs, see 10-FORMAL-VERIFICATION.md. For the governance pipeline design that applies these formulas at runtime, see 05-AI-GOVERNANCE-POLICY-ENGINE.md. For the causal and CBF mathematical background, see docs/governance/CAUSAL_AND_CBF_GOVERNANCE.md.
| Document | Description |
|---|---|
EXTENSIBILITY_ARCHITECTURE.md |
Domain-agnostic kernel design and multi-domain extensibility roadmap (includes Provider 01 and Provider 02 as implemented vendor integration examples) |
DUAL_PROJECT_ARCHITECTURE.md |
Dual-project Langfuse telemetry isolation architecture; evidentiary independence design; POAM-018/019 remediation guidance |
Recommended reading order by audience:
| Audience | Recommended Order |
|---|---|
| Security Assessors / AO | 01 Overview → 07 Security → 06 Compliance → 10 Formal Verification |
| Architects / Engineers | 02 Architecture → 04 Agents → 05 Governance → 10 Formal Verification |
| Operations / DevOps | 08 Deployment → 09 Runbook → 03 Stack |
| Compliance Officers | 06 Compliance → 07 Security → 01 Overview → 10 Formal Verification |
| AI/ML Engineers | 04 Agents → 05 Governance → 03 Stack |