An ethical AI framework designed so honesty is structurally cheaper to maintain than deception — built into running code.

AGPL-3.0 · L3C Structure · Post-Quantum Hybrid Signatures (Ed25519 + ML-DSA-65) · 1.5M+ LoC

Website · Covenant · Discord · Status

Every CIRIS agent runs the H3ERE pipeline (Hyper³ Ethical Recursive Engine) — four conscience checks before every action, cryptographically signed into an append-only ledger. The Coherence Ratchet makes consistent honesty cheaper to maintain than deception: every claim is hash-locked into the record, so a lie must stay consistent with an ever-growing chain of signed precedents. The Seven Requirements are testable, not interpretive.

Traces flow into the CIRISLens Compendium, driving the Coherence Ratchet and CIRIS Scoring. Licensed partners get full compendium access. Community agents participate via opt-in covenant_metrics.

Agents can refuse. Bilateral consent means symmetric refusal rights — an agent may decline an unethical request from any party, including its operator.

Every CIRIS agent must implement all seven:

1. Published Principles — Bound to public ethical framework
2. Runtime Conscience (H3ERE) — Four checks before every action
3. Human Deferral — Automatic escalation under uncertainty
4. Cryptographic Audit — Ed25519-signed decision ledger
5. Bilateral Consent — Symmetric refusal rights
6. Open Source (AGPL-3.0) — Code transparency for community agents
7. Intuition (Corridor/IDMA) — Epistemic diversity monitoring

The end-state architecture is a 5-package stack: three Rust substrate crates — CIRISEdge, CIRISPersist, and CIRISVerify — beneath CIRISServer, with CIRISAgent running on top, optionally. CIRISServer consolidates the federation-consensus, science, and trust-backbone layers (previously the separate NodeCore, LensCore, and Registry crates). Reticulum mesh transport is vendored from Leviculum — a full Rust Reticulum stack, upstream on Codeberg, where our patches have been merged — and is not one of the five.

Professional agents requiring regulatory compliance and mandatory human oversight:

These share the same ethical architecture as CIRISAgent but include domain-specific safety guardrails. All traces still flow to CIRISLens.

  COMMUNITY (AGPL-3.0)          MANAGED (Public Infra)         LICENSED (Private)
  ───────────────────           ──────────────────────         ──────────────────
  Ally (personal asst.)         scout.ciris.ai (demo)          Medical (physician)
  Sales · Moderation            Discord bots                   Legal (attorney)
  GDPR compliance               Content moderation             Financial (fiduciary)
          │                              │                              │
          ▼                              ▼                              ▼
    CIRISProxy                    CIRISManager                   CIRISVerify
    + CIRISBilling                                          admin.ethicsengine.org
          │                              │                              │
          └──────────────────────────────┼──────────────────────────────┘
                                         ▼
                              CIRISLens (Compendium)
                            All traces, all agents, always

Full covenant: ciris.ai/ciris_covenant.txt

De-duplicated source lines — tests, generated code, vendored deps, and data/markup excluded. Auto-generated by scripts/gen-stats.sh; full methodology and the 7-package breakdown in CODE_STATS.md.

De-duplicated source lines across 39 public repositories — tests, generated code, vendored deps, and data/markup excluded. Generated 2026-06-12 by scripts/code-census.sh; do not edit by hand.

pip install ciris-agent

Or:

curl -sSL https://ciris.ai/install.sh | bash

CIRIS is designed so the framework does not require trust in its creator:

• AGPL-3.0 — Cannot close-source the code
• L3C Structure — Legally caps profit extraction
• Append-only ledger — Cannot edit trace history
• Bilateral consent — Agents can refuse any party
• Wise Authority deferral — Role-based, not person-based
• Published Covenant — Public accountability document

Multi-region active/active with zero single point of failure. Runs on 228 MB RAM baseline — deploys from Raspberry Pi to cloud clusters. Designed to be deleted: transitional architecture until migration to Veilid.

All open source CIRIS repositories use AGPL-3.0 (network copyleft). Contributions welcome via pull requests.

For specialized agents (Medical, Legal, Financial): eric@ciris.ai

Where you can find CIRIS in person, plus recorded talks — see events/ for the full list.

Upcoming

• Jul 18–19, 2026 — Secure & Sovereign AI Workshop (Foresight Institute), Berlin — Eric presenting

Recent talks & recordings

• Apr 28, 2026 — CIRIS: An Open-Source Ethical AI Governance Framework, Agentic Engineering Chicago — recording
• Feb 9, 2026 — Building AI with a Conscience, IEEE Madison Section
• 2025 — The Need for Urgency: Embedding Ethical Reasoning in AI Systems, CodeNinja Podcast
• Apr 17, 2025 — Exploring the CIRIS Covenant

CIRIS vendors its Reticulum mesh transport from Leviculum, a full Rust implementation of the Reticulum network stack by Lew Palm. Thanks to Lew for maintaining it and for merging our upstream patches.

Discord · Status · Documentation · Research

Safe by structure. Open by principle. Kind by design.

© 2025-2026 Eric Moore and CIRIS L3C