MentaviewEarly access

01 / Platform

A cognitive runtime that knows when to step in — and when to step aside

Explore Mentaview's minimal-path architecture, provider-neutral execution, evidence contracts, policy boundaries and headless APIs.

Core principle: orchestration is valuable only when it improves quality, latency, cost, continuity, privacy, provenance or resilience.

System architecture

The cognitive core coordinates capabilities. It does not absorb them.

Mentaview is headless by default. Direct Rust and authenticated network surfaces converge on the same application semantics.

Confidential inference

Public and private models see typed relationships — not every original identifier.

The mandatory text boundary selects its policy from the declared endpoint class, keeps reversible mappings inside the active scope and restores only validated output. It fails closed where text protection cannot honestly cover the payload.

Honest boundary. This is reversible pseudonymization, not anonymization or encryption. Unlabelled names can be missed, exact-term dictionaries remain deployment-specific, and protected remote media or untrusted external embeddings are rejected.

A single turn

From user intent to supported answer in six bounded moves.

  1. 01

    Interpret

    Compile intent and answer obligations without touching a provider.

  2. 02

    Authorize

    Intersect requested work with policy, data scope, egress and capability permissions.

  3. 03

    Plan

    Choose the lowest-cost route that can satisfy the observable contract.

  4. 04

    Execute

    Call only configured memory, evidence, research, tools or inference capabilities.

  5. 05

    Assure

    Bind claims to admissible evidence, measure coverage and expose unresolved gaps.

  6. 06

    Record

    Return a safe route trace, usage receipt and explicit failure or abstention behavior.

Technology

Rust-first boundaries, portable execution and explicit operational controls.

CORE

Provider-neutral Rust runtime

Typed domain contracts, an in-process performance path and versioned module identifiers create a stable boundary above models and stores.

API

Rust SDK, HTTP and client transports

Rust hosts use an unpublished bounded v1 facade in-process or inject a host-owned synchronous transport contract; remote clients use authenticated versioned HTTP today. The SDK contract has no qualified real network execution, and language bindings, registry distribution and streaming remain staged.

STATE

Local or PostgreSQL persistence

Tenant-aware server state, forced row-level security, Argon2 API-key hashes, per-conversation serialization and shared PostgreSQL admission support controlled pilots.

POLICY

Deny by default

No endpoint discovery, model download, provider call or egress occurs merely because software is installed or configured nearby.

EVIDENCE

Canonical provenance

Retrieval and research return bounded evidence packets. Assurance decides what those packets can support.

OPERATIONS

Observable and reversible

Health probes, request identifiers, metrics, versioned quality profiles, bounded retries and rollback options expose the active behavior.

Non-negotiables

What the architecture refuses to do.

01

Treat an OpenAI-compatible protocol as proof that an endpoint is private.

02

Cross a privacy or egress class during automatic fallback.

03

Download, discover or activate model weights without an explicit host action.

04

Turn retrieval into the default path when direct context is sufficient.

05

Let a UI demonstrator become the source of cognitive policy.

06

Use laptop evidence to qualify mobile, OEM or physical air-gap claims.

A deliberate next step

Evaluate the architecture against a real boundary.

Bring your data topology, provider constraints and target hardware. We will make the assumptions and open gates visible.

Start a conversationSee the evidence