Skip to main content
A region is the whole of Naive running on hardware you control: the same primitives, the same API, the same governance — just pointed at local substrates instead of AWS. The shippable artifact is a Tower: a bootable golden image that comes up as a configured, self-governing region. The design goal is that the cloud codebase and the Tower codebase are the same codebase. The parts that differ are swapped behind driver interfaces (@usenaive/region-core), so no service imports a provider SDK directly and the cloud code paths port without behavior change.

​
The open / closed line

Naive is open-core. The line is drawn on a single question: does this component decide, or does it hold keys?

Open (Apache-2.0) — plumbing

The parts that carry data and calls but never make the trust decision:
  • the region API surface and its request handling
  • the driver substrate (secrets/queue/inference/storage/runtime) and every driver implementation
  • the SDK, CLI, and IaC clients
  • the panel (operator/owner UI)
  • the data model — schema and migrations
These are readable, forkable, and swappable.

Closed (proprietary) — decides or holds keys

The parts whose integrity is the product:
  • the governor — the enforcement engine. Every gated action is a wire call to it; it returns allow | deny | freeze and it owns replay + budget.
  • vaultd — the TPM-rooted secrets daemon. It holds the root key and derives per-tenant KEKs; plaintext never leaves it.
  • the egress-gateway — the single egress-capable process on a Tower. It asks the governor before any real call and injects credentials only where it terminates a provider connection.
Enforcement lives in the closed engine, never in the open plumbing. The region API is a thin client: on a gated action it calls the governor and does what the verdict says. Stop the governor and the region is inert — gated actions return 403 enforcement_unavailable. See Security model and Open core.

​
The cloud → Tower driver map

Each substrate is chosen by a NAIVE_*_DRIVER env var (documented in full on the Drivers page). Cloud defaults are the existing production config; NAIVE_BUILD=tower flips the defaults to the on-box set. The runtime pool is a selectable driver like any other: cloud uses the ECS warm pool, a Tower uses local. secrets also has a keyless file driver for compose/CI development (no TPM).

​
Where to go next

Drivers

Every NAIVE_*_DRIVER value, defaults, parity notes, the GovernorClient contract, and how to write your own driver.

Security model

The compose topology, the four load-bearing assertions, vaultd internals, and the egress gateway’s paths and limits.

Conformance

The capability-tagged suite, KEYS.md gating, the two legs, and the two-tier CI.

Quickstart (compose)

Run a full region on one Linux box in ~10 minutes.