Zephr
Start free

The platform

One layer aboveevery agent.

Claude Code, Cursor, Codex, and opencode each keep a private, machine-local, unverified scrap of what your project knows. Zephr is the plane above all of them — one governed evidence graph that every tool reads from and writes to, and that can prove where each claim came from and who verified it.

Local shipped · managed cloud in progressnine clustersthree familiesone evidence graph
The nine clusters

Nine clusters. Three families. One system.

Nine equal cards would be a feature wall. These group into three questions: what the work knows, what the system can work out, and what it is allowed to do.

Intelligence

What the system can work out about the code, and how it shows its reasoning.

  • Lens

    Cloud-first code intelligence: lexical, structural, semantic, and repo graph.

    local tools + Qdrant substrate exist; hosted orchestration missing · ADR-028

    Evolvingpage coming soon
  • Review

    Evidence-native change assurance: deterministic verdicts with receipts.

    ADR + exact-change contracts shipped; three issues in progress · ADR-023

    Evolvingpage coming soon
  • Pulse

    Change radar, freshness, usage, and trust health — measured data only.

    radar page + freshness migration shipped; wiring partial · ADR-016

    Evolvingpage coming soon

Governance

What the system is allowed to do, on whose authority, and with what proof.

  • Guard

    Trust firewall, policy engine, scope admission, and the verification ladder.

    firewall + admission real; TrustBench CI-blocking; T3 unbuilt · ADR-009, 013

    Evolvingpage coming soon
  • Fleet

    Client connection state: profiles, device keys, secret references — never values.

    fleet-domain + client-adapters real; UI needs honest empty states · ADR-017

    Evolvingpage coming soon
  • Connect

    The golden path: first-run client detection, install docs, SDK entry points.

    adapters real; SDK integrations paused pending the real API · ADR-019

    Evolvingpage coming soon

Status labels follow docs/PRODUCT-DESIGN.md §3. “Shipped” means substantially implemented and covered by tests; “Evolving” means real foundations with material work remaining; “Planned” means decided but not built.

The unifying data model

Everything is a node in one evidence graph.

A memory is not a row in a memory table and a handoff is not a row in a handoff table. Every kind of record is a provenance-linked node in the same graph, which is why a review finding can cite the decision that forbids a pattern and a recall can explain itself.

Evidence graph · one store, one write path

  • Beliefclaim · confidence · review state · valid-from/until
  • Anchorpath · line range · commit · content digest
  • Sessionagent · tool · scope binding · epoch
  • Handoffenvelope id · signature · one-time capability
  • Review findingverdict · proof adequacy · cited evidence
  • Doc citationsource · fetched-at · freshness · deprecation
  • Action eventactor · operation · outcome · timestamp

Every node reaches every other node through provenance edges. That is the whole trick: there is no second store to reconcile, so “why did you tell me that?” is a graph traversal rather than a guess.

The record

One decision, followed across four tools.

The ledger below is the platform in one artifact: a claim captured, sealed, transported, challenged, and reviewed. Every card is real markup — select it, copy the hashes, read it with styles off.

The continuity ledger

One decision, followed across four tools.

Every card below is real markup — select it, copy the hashes, read it with styles off. This is the record Zephr keeps, not a picture of one.

A decision is captured explicitly and recorded with its citations.

Claude Code · captureUnreviewed

A decision was made in the session

The agent proposed a fourth retry; the engineer rejected it and recorded why. Zephr captures only what is handed to it — nothing is inferred from the transcript.

explicit capture — never ambient
Zephr · evidenceUnreviewed

Payment webhook retries are capped at 3 attempts with exponential backoff.

Stripe redelivers on its own schedule, so a fourth in-process retry double-charges the idempotency window instead of recovering from it.

Scope
apps/billing
Agent
Claude Code · sonnet
Captured
2026-02-14T09:41:07Z
Confidence
Provisional — single source, unreviewed
Cited files
  • apps/billing/src/webhooks/stripe.ts L112–L148resolved
  • apps/billing/src/queue/retry-policy.ts L20–L37resolved
  • docs/adr/ADR-031-webhook-retries.md §3resolved
  • apps/billing/src/queue/backoff.ts L8–L15resolved

Illustrative example — not live data

Architecture decisions

Eight decisions hold the system together.

These are the calls that collapse a pile of packages into one product. Each is stated with what it kills, the record that governs it, and how far along it actually is.

S1–S8, with their real status

Summarized from docs/PRODUCT-DESIGN.md §2. The status column is the honest one: three of the eight are only partly built, and saying so is cheaper than being found out.

  1. S1 · ADR-002, ADR-005

    Postgres is the sole source of truth; Qdrant is a rebuildable projection; SQLite is the edge cache and the free offline tier.

    Kills split-brain stores, the 4,096-vector cap, the local-first/cloud-first contradiction

    Local shipped · cloud in progress
  2. S2 · ADR-005, ADR-006

    One write path: store contract → transactional outbox → projector. Direct table writes are outlawed everywhere.

    Kills the producer-less projector, schema-violating webhooks, dual-write drift

    Enforced
  3. S3 · ADR-003, ADR-026

    One hosted, stateless, multi-tenant remote MCP endpoint is the primary interface; stdio survives for local-only mode and the search tier.

    Kills env-var pseudo-tenancy, session pinning, hardcoded protocol versions

    stdio shipped · remote in progress
  4. S4 · ADR-028

    Hosted Lens is the default code-intelligence plane; local Lens remains the privacy, offline, and overlay mode.

    Kills slow per-machine cold starts, no shared code intelligence

    Hosted ingestion not built
  5. S5 · ADR-029

    A ref-aware temporal substrate: beliefs bind to ref topology, commit, merge base, worktree, and index generation.

    Kills branch-poisoned memory, false whole-file staleness, overlay truth leakage

    Anchors shipped · full DAG in progress
  6. S6 · ADR-015, ADR-028

    One bounded local agent, zephrd: capture, cache, offline fallback, local privacy Lens — read-only against the evidence DB.

    Kills daemon-deferral fiction, second-writer risk

    Runs locally · npm distribution pending
  7. S7 · ADR-004, ADR-028

    One versioned, tiered tool contract — core, Lens, docs, review — with the serving plane explicit in every result.

    Kills "exactly eight" theater and ungoverned tool growth

    CI-asserted
  8. S8 · ADR-012

    One data model: the Evidence Graph. Memories, anchors, sessions, handoffs, review findings, doc citations, and action events are all provenance-linked.

    Kills disconnected feature islands

    The spine

Illustrative example — not live data. Statuses are summarized from the decision records, not measured at runtime.

Above all eight sits one law: honest or absent. No fabricated data, no invented confidence, no simulated connectivity. Every surface renders exactly one true state of connected, disconnected, stale, or empty — and abstention is a feature (ADR-016).

Read the architecture, not the adjectives.

Every decision on this page has a decision record behind it. Start with the docs, or look at how one claim survives the trip between four tools.

Read the docsHow it works