Annona

The sovereign execution kernel for AI agents

Where it runs is a decision — and the decision is yours, enforced and recorded.

📐 Read the high-level design — components, the placement algorithm, the DGX appliance, the threat model, and the numbers it is judged by

🌐 akaion-ai.github.io/annona — the site · 🐳 docker compose up -d · 🐍 pip install annona

🐳 Container · 🖥️ CLI · 🧩 any OpenAI-compatible runtime — an-NO-na, the office that kept Rome fed

---

Rome imported its grain. Sicily, Africa, Egypt — the city could not feed itself, and everyone knew what that meant: whoever controlled the ships controlled Rome. So the Republic, and then the Empire, refused to leave it to the market. The cura annonae was a permanent office with a prefect at its head, and its job was to decide where the grain came from, which route it took, which granary held it, and who received it — and to keep the record of all four.

It was not built out of paranoia. It was built out of arithmetic: a republic cannot outsource what it cannot live without.

Your organisation is now in that position with compute. Every agent you deploy sends your material somewhere, and "somewhere" is currently decided by whichever provider a developer typed into a config file eighteen months ago.

Annona is the office. It is a daemon you install where your data already lives, and for every single step of every agent run it decides where that step is allowed to execute, enforces the decision, and writes it down.

$ annona why step_7f3a
step_7f3a  inference  HELD
  class        restricted  (working set touched /mnt/pratiche/2026/BG-114.pdf)
  rule         rules[0]  restricted → [local-gpu], on_unavailable: hold
  candidates   local-gpu (unhealthy: connection refused since 14:02:11)
  not chosen   frontier — max_class public  **The right column is a property of the request, not of the company.**

Summarising a public tender is not the same problem as reasoning over a client's
medical file, and the second does not become safe because procurement signed a
DPA. One organisation needs all three columns, chosen per s