Annona¶
The sovereign execution kernel for AI agents
Every agent you deploy sends your material somewhere. Annona decides where each step may run — your GPU, your cluster, or a frontier API — enforces the decision, and writes it into a record you can verify.
Get the desktop app¶
Ready to run, local by default: it registers nothing outside your machine until you declare it yourself.
-
Windows
Per-user installer (
.exe). No admin rights. -
macOS
Apple Silicon and Intel (
.dmg). Unsigned during beta — right-click → Open. -
Linux
Portable AppImage (
chmod +xand run), or.deb.
Prefer a server? docker compose up -d brings up the kernel and a local model,
arm64 or amd64 — see
deploying.
Prefer a terminal? pip install annona, then
turn the perimeter on in five minutes.
How it works¶
Four steps. Three never leave your machine, and the fourth happens only when the policy says it may.
-
1 · Classify
Every path, every payload, every tool result gets a class — from where it lives, what it contains, and what a prompt names. A run's class only ever goes up.
-
2 · Place
From that class and the health of each substrate, the kernel picks where the step may run. Nothing permitted available → the step is held, not rerouted.
-
3 · Execute
Tools run behind a default-deny gate: one the policy does not name does not run, deny beats allow, and symlinks are resolved to their targets.
-
4 · Record
Every decision — including every refusal — lands in a hash-chained ledger you verify offline, with a command that contacts nobody.
$ annona why step_7f3a
step_7f3a inference HELD
class restricted (working set touched /mnt/pratiche/2026/BG-114.pdf)
rule R-clienti restricted → [local-gpu], on_unavailable: hold
candidates local-gpu (unhealthy: connection refused since 14:02:11)
not chosen frontier — max_class public < restricted
outcome held at 14:03:07
ledger #418 sha256:9c1f…a7 (chain verified)
That refusal is the product. A gateway in the same situation fails over to the frontier API and returns a good answer.
Why it exists¶
You have been told to pick one of three architectures: models on-prem (private, capped by your hardware), frontier APIs (excellent, and your material leaves), or your own weights in your own cloud (an honest compromise that costs an MLOps team).
The industry argues about which column wins. That argument is the mistake.
The right column is a property of the request, not of the company.
Summarising a public tender is not the same problem as reasoning over a client's medical file, and the second does not become safe because procurement signed a DPA. One organisation needs all three columns, chosen per step, ten thousand times a day, by something that can prove afterwards what it chose.
What you can do with it¶
-
Keep privileged work inside
A client matter, a clinical record, a personnel file: read it, reason over it, and watch the frontier model that would have answered better simply not be called.
-
Use the best model for everything else
Sovereignty is not a tax on all your traffic. A question with no client data goes to the best model you registered, at the price you chose.
-
Answer with a frontier model anyway
A local PII model replaces the identifiers, the redacted question crosses, and the answer is re-identified here from a mapping that never left.
-
Prove it afterwards
annona verify,annona audit --held,annona why <step>— an auditor's three questions, answered offline.
Six use cases, each with the test that proves it Skills, with a jurisdiction
Honest about what it is not¶
- Pseudonymous is not anonymous. Redaction reduces exposure; the mapping exists, so it does not remove the need for a lawful basis.
- No confidential computing on a GB10. Encrypted memory and GPU attestation are real on HGX B200-class hardware, not on a DGX Spark. A privileged host administrator can read memory — on-prem that administrator is the customer, which is the point, but it belongs in the meeting rather than in an audit.
- The ledger has no external anchor yet. Tamper-evident against edits, deletions and reordering; a chain rebuilt wholesale by someone with write access is not detectable, and a test says so.
- Small models still get tool arguments wrong. Grammar-constrained decoding is the next piece, and the project's research claim.
Every guarantee here has a test with its name on it, and every gap has a row in a table. That is the only way a vendor can ask to be believed about something a customer cannot watch happening.
Built by Akaion AI Lab on datapizza-ai · interoperates with rizzo-pii · Apache-2.0