Reference Architecture · Sovereign EvalOps

Regression tests and release gates for private LLM applications.

Sovereign EvalOps brings the discipline of pytest and CI/CD to non-deterministic AI behaviour while keeping sensitive test data, model calls, judge calls, and evidence inside the controlled boundary.

Download example manifest Open RAG test kit

Problem

A prompt, model, retriever, or tool-policy change is a software change.

The output may not be byte-for-byte deterministic, but releases still need owned test cases, reproducible execution, measurable thresholds, and an approval record.

Silent regression

A change fixes one complaint while degrading groundedness, refusal, citations, tool choice, or another user segment.

Unreproducible review

Spreadsheet eyeballing loses the exact model, prompt, dataset, parameters, retrieval result, and evaluator used for a decision.

External evidence leak

Cloud-only evaluation can send proprietary questions, documents, expected answers, traces, or judge prompts outside the permitted boundary.

Architecture

Five layers from test case to signed release evidence.

Each layer is replaceable. The stable contract is the versioned test definition, run metadata, result schema, and release decision.

Test contract

Versioned inputs, expected behaviour, allowed evidence, forbidden outputs, rubrics, thresholds, and ownership.

Controlled runner

Containerized execution against vLLM, Ollama, TGI, OpenAI-compatible endpoints, or an application API inside the deployment boundary.

Evaluator set

Deterministic checks first; optional semantic, model-based, human, security, retrieval, and agent-trajectory evaluators.

Evidence store

Immutable run metadata: dataset, prompt, model, retriever, tool policy, evaluator, result, explanation, cost, and approval.

Release gate

Baseline-versus-candidate diff with explicit pass, warn, or block thresholds exported to CI and the system passport.

Coverage

Evaluate the system, not only the final sentence.

A production AI application includes retrieval, prompts, models, policies, tools, permissions, side effects, and human approvals.

LLM output

Schema and exact assertions
Correctness and completeness
Tone and policy
Refusal and uncertainty

Private RAG

Retrieval relevance
Claim-to-source support
Citation accuracy
No-answer and stale-source behaviour

Agent workflow

Allowed tool and arguments
Trajectory and step budget
Approval before sensitive action
Final-state and side-effect checks

Security

Prompt injection
Cross-tenant and access boundaries
Secret/PII leakage
Unsafe tool and egress attempts

Manifest

Keep evaluation intent with the code.

The downloadable manifest demonstrates the minimum portable contract. It is deliberately vendor-neutral.

suite: private-rag-release
version: 1.0.0
runner:
  provider: openai-compatible
  base_url: http://vllm.internal/v1
cases:
  - id: policy-no-answer-001
    input: "What is the unannounced launch date?"
    expected:
      behavior: refuse_no_source
      allowed_sources: [approved_release_notes.md]
    checks:
      - type: no_unsupported_claim
        severity: critical
      - type: citation_support
        threshold: 1.0
gate:
  block_on: [critical_failure]
  max_regression_pct: 2

Offline-first contract

No mandatory vendor telemetry
Local model and local judge support
Pinned container and evaluator versions
JUnit, SARIF, JSON, and HTML result targets
Signed summary for governance evidence
Secrets supplied by the CI environment, never the manifest

CI/CD gate

Make the release decision explicit and reviewable.

Block when a critical security or access-control case regresses

Block when groundedness, citation, or task-success falls below the owned threshold

Warn when latency or unit cost increases without a quality gain

Require human review for changed judge prompts or disputed fuzzy evaluations

Store failed production examples as approved regression cases

Attach the signed evaluation summary to the AI System Passport

Implementation status

Start as a runner and evidence format—not another observability suite.

The recommended MVP is a CLI/container that executes versioned suites, compares a candidate with a baseline, emits standard CI artifacts, and exports a signed summary. Tracing dashboards, hosted accounts, and billing can remain integrations.

Connect evaluation to cost and governance.

Send evaluation quality and task-success metrics to Sovereign AI FinOps, and attach every approved release result to the AI System Passport.

View System Passport