A decision was made in the session
The agent proposed a fourth retry; the engineer rejected it and recorded why. Zephr captures only what is handed to it — nothing is inferred from the transcript.
explicit capture — never ambient
AI continuity infrastructure
Agents forget.Your project shouldn't.
Zephr is the governed layer above Claude Code, Cursor, Codex, and any MCP client: it records what your project decided, keeps the evidence behind it, signs the handoff between tools, and refuses to present an unreviewed guess as settled fact.
npx zephr-mcp installThe one-liner is the designed path — it does not resolve today. Working path: git clone https://github.com/DigitalSoftDistribution/zephr.git then pnpm install.
Works with
Claude Code · Cursor · Codex · opencode · any MCP client
Claude Code, Cursor, Codex have first-party adapters. Everything else connects through the same MCP tool surface.
Project-bound. Provenance-backed. Cloud or local.
The continuity ledger
One decision, followed across four tools.
Every card below is real markup — select it, copy the hashes, read it with styles off. This is the record Zephr keeps, not a picture of one.
A decision is captured explicitly and recorded with its citations.
Payment webhook retries are capped at 3 attempts with exponential backoff.
Stripe redelivers on its own schedule, so a fourth in-process retry double-charges the idempotency window instead of recovering from it.
- Scope
- apps/billing
- Agent
- Claude Code · sonnet
- Captured
- 2026-02-14T09:41:07Z
- Confidence
- Provisional — single source, unreviewed
- Cited files
- apps/billing/src/webhooks/stripe.ts L112–L148resolved
- apps/billing/src/queue/retry-policy.ts L20–L37resolved
- docs/adr/ADR-031-webhook-retries.md §3resolved
- apps/billing/src/queue/backoff.ts L8–L15resolved
Sealed for transport
The evidence card, its four citations, and its scope are serialized into one signed envelope. The signature covers the citations — not just the claim — so a receiving agent can tell whether the supporting files were swapped in transit.
- Payload
- 1 claim · 4 citations · 1 commit
- Scope
- apps/billing
- Digest
- sha256:9f2a7c41d8e6b035
SignedEd25519
Signature verified — one citation challenged
The envelope opens and the signature checks out. Three cited files still match their recorded digests; backoff.ts changed after capture, so the agent flags it rather than reasoning from it.
- apps/billing/src/webhooks/stripe.ts L112–L148resolved
- apps/billing/src/queue/retry-policy.ts L20–L37resolved
- docs/adr/ADR-031-webhook-retries.md §3resolved
- apps/billing/src/queue/backoff.ts L8–L15stale
The claim is still usable — it is simply carried forward with an open challenge instead of being presented as settled.
Signature validEd25519
One challenge waiting on a human
The reviewer sees exactly what changed: the recorded digest for backoff.ts, the current one, and the diff between them. Nothing is auto-resolved.
- Claim
- Payment webhook retries are capped at 3 attempts with exponential backoff.
- Challenge
- apps/billing/src/queue/backoff.ts — base delay changed 200ms → 500ms
- Verdict
- Cap unchanged; the challenge affects timing, not the cap.
provisional · 1 open challenge
Provisional → reviewed
The reviewer re-pins the stale citation to its current lines and signs the result. The claim keeps its full history — the earlier provisional record is superseded, never overwritten.
- State
- Reviewed
- Reviewed
- 2026-02-14T16:02:55Z
- Citations
- 4 of 4 resolved · 1 re-pinned
- Supersedes
- sha256:9f2a7c41d8e6b035
The same ledger, with the network removed
Local mode is one file on disk and a loopback API. The evidence card, the envelope, and the signature are byte-identical to the managed path — the only thing that changes is where the file lives.
- Store
- ~/.zephr/ledger.sqlite
- API
- 127.0.0.1 only
- Sync
- Off
SignedEd25519no account · no egress
What you give up offline
- Capture, signing, verification, and review all work unchanged.
- No cross-machine sync — the ledger is only on this machine.
- No shared team memory, and no fleet-wide contradiction detection.
stated up front, not discovered later
Illustrative example — not live data
- TrustBench scenarios passing
- 9/9
- Deterministic, CI-blocking, reproducible from a versioned corpus digest.
- First-party client adapters
- 3
- Claude Code, Cursor, Codex — plus any client that speaks MCP.
- Recall latency, p50
- 15ms
- Measured at 10,000 stored beliefs on 2026-07-23.
Every figure above is measured and committed to the repository. Read the methodology.
The problem
Context fragments by tool, by session, by person.
Each agent keeps a private, machine-local scratchpad that dies with the window. The reasoning behind a decision — the files it read, the option it rejected, the person who approved it — is the first thing thrown away, and the only thing worth keeping.
The cost is not lost text. It is a second agent confidently redoing work the first one already ruled out.
Claude Code · Tuesday
Knows the retry cap and why it was set.
The session ended. Nothing left the transcript.
Cursor · Wednesday
Re-derives the retry logic from scratch.
Never saw the decision, so it proposes a fourth retry.
Codex · a teammate
Reads a stale comment as current policy.
No provenance, so nothing marks the comment as superseded.
One project-bound ledger, above all of them
Same evidence, same review states, same scope rules — whichever tool you open next.
Illustrative example — not live data
How continuity works
Capture, verify, hand off, govern, reuse.
Five stages, each of which produces an artifact you can inspect. The rail is not a metaphor — it is the chain of custody that every claim carries with it.
Explicit, never ambient
A decision is handed to Zephr with its claim, its cited files, its commit, and the agent that authored it. Nothing is inferred from the transcript.
Citations are checked, not trusted
Every cited file is digested at capture time. When a file moves underneath a claim, the claim is marked stale rather than quietly reused.
Signed, one-time, scope-bound
The record is sealed into a Slipstream envelope. The signature covers the citations, so a receiving agent can tell whether the supporting files were swapped in transit.
An agent cannot approve itself
Policy decides what may be captured and recalled inside a scope. Contradictions surface as abstention, not as a confident average of two answers.
The decision comes back with its receipts
Weeks later the same claim reappears beside the relevant diff, chained to the commit and the review that settled it.
The platform
Nine clusters, three jobs.
Continuity keeps what the project knows. Intelligence reads the code and the change. Governance decides who may see what. Each cluster is a real surface with a real status — nothing here is a placeholder tile.
Continuity
What a project knows, and how that knowledge travels between tools without losing its provenance.
- MemoryShipped
Bi-temporal beliefs with provenance, confidence, and abstention.
- SlipstreamShipped
Signed, one-time, cross-tool and cross-device handoff.
- LibraryEvolving
Team docs catalog with freshness tracking and a legal gate.
Intelligence
Reading the codebase and the change: what exists, what it touches, and whether the evidence supports the verdict.
- LensEvolving
Lexical, structural, semantic, and graph code intelligence.
- ReviewEvolving
Evidence-native change assurance with deterministic receipts.
- PulsePlanned
Change radar, freshness tracking, and trust health.
Governance
The boundary: which agent may see which scope, on which machine, under whose policy.
- GuardShipped
Trust firewall, policy, scope admission, review, TrustBench.
- FleetEvolving
Client connection state, profiles, and secret references only.
- ConnectEvolving
The npx golden path, client detection, and adapters.
The switch
The moment you change tools mid-task.
This is the handoff nobody else ships: a signed, one-time envelope that carries the claim and the evidence under it, and a receiving agent that can prove neither was tampered with.
Session ends with one provisional decision
The engineer capped payment-webhook retries at three attempts and recorded why. The claim, its four cited files, its commit, and its scope are serialized together.
1 claim · 4 citations
Signature verified before a single token is spent
The envelope is consumed exactly once, checked against the destination, and re-anchored to the same project scope. The next agent starts oriented instead of starting over.
Signature validEd25519
Slipstream · shippedEnvelope round-trip measured at 0.5 ms · 2026-07-23
Illustrative example — not live data
Lens and Review
A verdict you can audit, not an opinion you have to trust.
Lens indexes the repository lexically, structurally, semantically, and as a graph. Review uses that graph to state what a change actually touches — and attaches the receipt for every line of the claim.
retry-policy.ts is reachable from four call sites
- apps/billing/src/webhooks/stripe.ts L112–L148
- apps/billing/src/queue/backoff.ts L8–L15
- apps/billing/src/jobs/reconcile.ts L61
- packages/protocol/src/retry.ts L24
The graph is the answer to “what breaks if I change this”, resolved from the code rather than guessed from a diff.
Lens · in beta
This change contradicts a reviewed decision
The PR raises the retry cap to four. Review does not argue about it — it surfaces the reviewed decision that says otherwise, with the commit and the reviewer attached, and lets a human decide.
- Touched
- 4 files · 1 package boundary
- Conflict
- ADR-031 §3 — cap is 3 attempts
- Verdict
- Deferred to human review
Review · in beta
Illustrative example — not live data
Trust semantics
Four states, and none of them mean “the model sounded sure”.
Confidence percentages are a way of not answering the question. Zephr publishes the state of the evidence instead: who reviewed it, whether its citations still resolve, and what contradicts it.
Verified
A human accepted it
The signature checked out, every citation resolved, and a person signed the result. Verified is a review outcome — never something an agent can award itself.
Unreviewed
Captured, not confirmed
The claim is usable and it is labelled provisional. Recall returns it with the label attached rather than presenting it as settled.
Stale
A cited file moved
Freshness is measured against the recorded digest of each cited file. When the file changes, the claim is flagged instead of silently continuing to look correct.
Blocked
Policy withheld it
A refusal names the rule it enforced and what would satisfy it. Contradictions produce abstention, not a confident average of two incompatible answers.
How trust states are defined and enforced — including abstention rules and verification tiers.
Architecture
Managed cloud or one file on your disk.
The envelope format, the signatures, and the review semantics are identical on both paths. What differs is where the ledger lives and what you can therefore do with it — stated up front, not discovered after you have committed.
Managed cloud
Invitation-only beta- Shared team memory and fleet-wide contradiction detection.
- Cross-machine and cross-device continuity.
- Hosted Lens indexing over the repository graph.
- Encrypted at rest; secret references only, never plaintext secret sync.
The managed path is in an invitation-only beta. Local mode is the fully supported entry point today.
Local privacy mode
Shipped- One SQLite file at
~/.zephr/ledger.sqlite. - Loopback API on
127.0.0.1only. No account, no egress. - Byte-identical envelopes, signatures, capture, and review.
- No cross-machine sync, no shared team memory, no fleet-wide detection.
Local mode is not a trial tier. It is the same ledger with the network removed.
Benchmarks
Measured, committed, and reproducible.
Recall latency through the real tool handler at three corpus sizes, on a clean Linux x64 host. These are the numbers the repository ships, not a marketing round-up.
| Stored beliefs | recall@10 | p50 | p95 | p99 |
|---|---|---|---|---|
| 100 | 100% | 1.0 ms | 1.6 ms | 1.7 ms |
| 1,000 | 100% | 2.7 ms | 3.3 ms | 3.3 ms |
| 10,000 | 100% | 15 ms | 18 ms | 26 ms |
Methodology: measured by scripts/perf-benchmark.mjs against the real recall handler (lexical/BM25 hybrid, single-threaded) on a clean Linux x64 host. recall@10 is the measured hit rate of the target belief in the top ten results. Last run 2026-07-23. Semantic vector recall is a separate capacity contract and is reported separately.
Security and privacy
Boundaries you can name.
Scope binding is immutable and enforced all the way down to the MCP transport: an agent admitted to one worktree cannot read another. Secrets are stored as references, never synchronized as plaintext. We publish the controls we actually operate and say nothing about certifications we do not hold.
Immutable scope binding
ShippedAdmission and binding epoch are enforced with a compare-and-set, so a scope cannot be widened underneath a running agent.
Secret references only
ShippedConfiguration carries a reference to a secret, never its value. Nothing plaintext crosses a device boundary.
Enterprise controls
PlannedSSO, audit export, and org-level policy are on the roadmap and are labelled as such rather than implied.
Pricing
Local mode is free. Managed pricing is not committed yet.
We would rather publish nothing than publish a price we have to retract. Local mode needs no account and no card. The pricing page explains exactly which gates the managed tier has to clear before a number goes on it.
Quickstart
Three commands to a working ledger.
The designed CLI surface, shown with the working build-from-source path. npm publication is not shipped yet — today you clone and run the same commands from a checkout.
npm publication not shipped
Step 1
Install
Creates the local ledger and verifies the install. No account required.
npx zephr-mcp installStep 2
Connect your agent
Detects the installed clients and writes the MCP entry for the one you pick.
npx zephr-mcp project init --name my-projectStep 3
Prove it works
Runs the health checks and reports what is bound, what is admitted, and what is not.
npx zephr-mcp verify
Objections
The questions worth asking first.
Is this just another vector database for agent memory?
No. Retrieval is the easy half. Zephr is a review and provenance layer: every belief carries its cited files, its commit, its authoring agent, and its human review state — and recall abstains when the evidence contradicts itself. A vector store has no opinion about whether a claim is still true.
What happens when a cited file changes after the claim was recorded?
The claim is marked stale, not deleted and not silently reused. The reviewer sees the recorded digest, the current one, and the diff between them, then either re-pins the citation or supersedes the claim. History is append-only: superseded records stay readable.
Do I have to send my code to your cloud?
No. Local mode is a first-class path, not a downgrade: one SQLite file on disk and a loopback API, with byte-identical envelopes and signatures. You give up cross-machine sync, shared team memory, and fleet-wide contradiction detection — stated up front rather than discovered later.
Which agents actually work today?
Claude Code, Cursor, Codex have first-party adapters marked shipped in the TrustBench evidence report. Any other MCP client — opencode included — can connect through the same tool surface, but it is not covered by a first-party adapter test today.
How do I know the benchmark numbers are real?
Every number on this page is generated by scripts/perf-benchmark.mjs on a clean Linux x64 host and committed as JSON. The last run was 2026-07-23. TrustBench scenario verdicts are deterministic and reproduce from a versioned corpus digest — re-running the generator on the same commit produces identical cards.
What does it cost?
Local mode is free and does not require an account. Managed-cloud pricing is not committed yet, and we would rather say so than publish a number we would have to retract. The pricing page explains exactly what gates it.