Governance / Security
Four controls, in the order a read crosses them. A request that fails the Trust Firewall never reaches the evidence graph — and the refusal names why. No badge on this page outruns the control behind it.
edge
transport terminated · request shape validated against the tool contract
trust firewallthe gate
policy evaluated · refusal returned with a reason code, never a blank result
evidence graph
reads are scoped to the admitted binding · writes carry provenance
agent boundary
scope binding is immutable for the session · no re-scoping from inside a tool call
a read travels top to bottom — failing layer two means never reaching three
Illustrative example — not live data
evidence lives at a commit, not in prose
git log -1 --format=%H docs/security/SECURITY-AUDIT.mdTwo scenarios, same stack. An in-scope read crosses all four layers; an out-of-scope read is refused at the Trust Firewall with its reason — and the layers below never light up. The page's thesis, operated by hand.
request shape validated
policy evaluated against the admitted scope
scoped read · provenance attached
results handed over · credentials never leave
✓ admitted — four layers crossed in order; the agent receives results, never credentials or scope
illustrative traversal — the refusal reason mirrors the real Trust Firewall contract
Every control below maps to a merged implementation, a CI gate, or an inspectable artifact. Work that is only designed appears further down the page under its own honest label — never here.
Deterministic retrieval scenarios run in CI and block merges. The continuity suite passes nine measured scenarios and reports structured abstention for the five features that have no fixture corpus yet.
docs/trust/TRUSTBENCH-EVIDENCE.md
A pure, deterministic policy engine gating capture and retrieval: capture limits, provenance requirements, review-state filtering, and structured refusal codes. A refusal names the rule it failed.
ADR-Z-08
Project → repository → worktree, admitted once per connection. binding_epoch advances by exactly +1 on each legal transition, and binding on the first tool call is forbidden.
ADR-Z-09
Every durable write runs inside BEGIN IMMEDIATE with lease finalize revalidation. Admin purge and migrate are rejected over admitted connections.
SB-4348 · PR #54
Ed25519 source signature, destination-bound HMAC-SHA-256, manifest-root recomputation from canonical bytes, and one-time consumption enforced by an atomic ledger. Authentication happens before parse — not parse-then-check.
ADR-Z-14 · ZEP-377
Cursor, Codex, and Claude Code adapters share one connection-scoped authority model, with client and connection revocation and cross-client adversarial proof against copied or replayed authority.
ZEP-375 · ADR-Z-09
Promise species/constructor traps, POST bootstrap exchange, exact Host and Origin revalidation, and relative-import guards protect the loopback gateway foundation.
ADR-Z-11 · PR #78 · PR #89
Path-traversal prevention, worktree identity revalidation on every operation, and KEY_B64 handoff for trusted CLI launch keep the local surface bounded and default-deny.
SB-4348 · SB-4349
All references are public documents or merged pull requests. No control is claimed without one.
The ultra-security review audited the full codebase at baseline e23d4d5a and reported a PASS verdict: no blocker, high, or medium vulnerabilities, with all approved controls preserved. The GO is conditional on green CI and security at one SHA, including the 35 Docker-gated store tests in PR #188.
The verdict as recorded, including the condition attached to it. The audit constrains how this state may be described in release copy, and those constraints are honoured verbatim below.
Full-codebase review — no blocker, high, or medium vulnerabilities.
pnpm audit --audit-level=high — zero high or critical advisories.
GitHub security workflow gitleaks job.
[email protected] pinned in both applications and the lockfile.
The GO is conditioned on green CI and security at one SHA. Until the 35 Docker-gated store tests in PR #188 pass, “V1 code complete” is the honest description of where the codebase stands.
The audit explicitly constrains release wording. Two phrases it disallows — “production-ready” and “unconditional GO” — are therefore absent from this page, and their absence is the point.
Illustrative example — not live data. The verdict and SHA are transcribed from docs/security/SECURITY-AUDIT.md; this card is not a live CI readout.
Shipped and planned are not the same word. Each entry states where the work actually stands, and its evidence reference is the document that would have to be satisfied before the label can change.
PrivacyOperationReceiptV1 with a multi-phase destruction state machine, receipt-before-commit durability, idempotent crash recovery, and WAL/SHM sidecar cleanup. The spec is written; the implementation is not built.
ADR-Z-12 · local-privacy-operations.md
Per-tenant envelope encryption with KMS-wrapped DEKs and crypto-shred erasure. Managed console signup is open at app.zephr.ai; managed charging tiers are in planning.
ADR-011 · ADR-Z-10
On-demand 127.0.0.1 gateway for live Memory and Runtime reads. The architecture is accepted (ADR-Z-11) and the foundation is in review.
ADR-Z-11
Per-request proof-of-possession over loopback for privileged local actions — revocation, rebind, privacy export and delete. Spec written; implementation pending.
ADR-Z-12
KEY_B64 file handoff and default-deny admission keep CLI authority scoped to the admitted installation. Shipped, and listed here because it is the foundation the two pending items build on.
ZEP-375 · ADR-Z-09
A label changes only when the corresponding CI gate, security review, and documentation are merged.
Zephr displays no compliance badges, because it has earned none. Every security claim on this page is backed by an inspectable artifact — a merged control, an audit verdict at a commit, or an explicit statement of absence like this one.
No third-party audit has been performed. No trust service criteria are claimed, and no report exists to request.
No ISMS certification and no conformity assessment. There is no accredited body attesting to anything on this site.
Zephr is a developer tool, not a healthcare platform. No business associate agreement exists and none is offered.
If a certification is ever obtained, this page will link to the report and the auditor — not to a generic badge.
Zephr is built around explicit capture, local capability, and stated limits. The limitations below are not a footnote — they sit at the same weight as the facts, because a privacy claim without its exceptions is not a privacy claim.
The local-first posture is documented in full on the privacy mode page, including what never leaves the machine and what Zephr does with model providers.
The documentation covers the architecture, the tool contract, the TrustBench methodology, and the trust model in detail. Every claim there links to its source.