Governance / Security
This page separates four things that usually get blurred together: what is implemented and merged, what an audit actually found at a specific commit, what is planned, and what is simply not held. No compliance badge appears here unless the underlying control is real — and none of them are, because Zephr holds no certifications.
Every control below maps to a merged implementation, a CI gate, or an inspectable artifact. Work that is only designed appears further down the page under its own honest label — never here.
Deterministic retrieval scenarios run in CI and block merges. The continuity suite passes nine measured scenarios and reports structured abstention for the five features that have no fixture corpus yet.
docs/trust/TRUSTBENCH-EVIDENCE.md
A pure, deterministic policy engine gating capture and retrieval: capture limits, provenance requirements, review-state filtering, and structured refusal codes. A refusal names the rule it failed.
ADR-Z-08
Project → repository → worktree, admitted once per connection. binding_epoch advances by exactly +1 on each legal transition, and binding on the first tool call is forbidden.
ADR-Z-09
Every durable write runs inside BEGIN IMMEDIATE with lease finalize revalidation. Admin purge and migrate are rejected over admitted connections.
SB-4348 · PR #54
Ed25519 source signature, destination-bound HMAC-SHA-256, manifest-root recomputation from canonical bytes, and one-time consumption enforced by an atomic ledger. Authentication happens before parse — not parse-then-check.
ADR-Z-14 · ZEP-377
Cursor, Codex, and Claude Code adapters share one connection-scoped authority model, with client and connection revocation and cross-client adversarial proof against copied or replayed authority.
ZEP-375 · ADR-Z-09
Promise species/constructor traps, POST bootstrap exchange, exact Host and Origin revalidation, and relative-import guards protect the loopback gateway foundation.
ADR-Z-11 · PR #78 · PR #89
Path-traversal prevention, worktree identity revalidation on every operation, and KEY_B64 handoff for trusted CLI launch keep the local surface bounded and default-deny.
SB-4348 · SB-4349
All references are public documents or merged pull requests. No control is claimed without one.
The ultra-security review audited the full codebase at baseline e23d4d5a and reported a PASS verdict: no blocker, high, or medium vulnerabilities, with all approved controls preserved. The GO is conditional on green CI and security at one SHA, including the 35 Docker-gated store tests in PR #188.
The verdict as recorded, including the condition attached to it. The audit constrains how this state may be described in release copy, and those constraints are honoured verbatim below.
Full-codebase review — no blocker, high, or medium vulnerabilities.
pnpm audit --audit-level=high — zero high or critical advisories.
GitHub security workflow gitleaks job.
next@16.2.11 pinned in both applications and the lockfile.
The GO is conditioned on green CI and security at one SHA. Until the 35 Docker-gated store tests in PR #188 pass, “V1 code complete” is the honest description of where the codebase stands.
The audit explicitly constrains release wording. Two phrases it disallows — “production-ready” and “unconditional GO” — are therefore absent from this page, and their absence is the point.
Illustrative example — not live data. The verdict and SHA are transcribed from docs/security/SECURITY-AUDIT.md; this card is not a live CI readout.
Shipped and planned are not the same word. Each entry states where the work actually stands, and its evidence reference is the document that would have to be satisfied before the label can change.
PrivacyOperationReceiptV1 with a multi-phase destruction state machine, receipt-before-commit durability, idempotent crash recovery, and WAL/SHM sidecar cleanup. The spec is written; the implementation is not built.
ADR-Z-12 · local-privacy-operations.md
Per-tenant envelope encryption with KMS-wrapped DEKs and crypto-shred erasure. Managed cloud is in planning and evidence-gathering; no public signup exists.
ADR-011 · ADR-Z-10
On-demand 127.0.0.1 gateway for live Memory and Runtime reads. The architecture is accepted (ADR-Z-11) and the foundation is in review.
ADR-Z-11
Per-request proof-of-possession over loopback for privileged local actions — revocation, rebind, privacy export and delete. Spec written; implementation pending.
ADR-Z-12
KEY_B64 file handoff and default-deny admission keep CLI authority scoped to the admitted installation. Shipped, and listed here because it is the foundation the two pending items build on.
ZEP-375 · ADR-Z-09
A label changes only when the corresponding CI gate, security review, and documentation are merged.
Zephr displays no compliance badges, because it has earned none. Every security claim on this page is backed by an inspectable artifact — a merged control, an audit verdict at a commit, or an explicit statement of absence like this one.
No third-party audit has been performed. No trust service criteria are claimed, and no report exists to request.
No ISMS certification and no conformity assessment. There is no accredited body attesting to anything on this site.
Zephr is a developer tool, not a healthcare platform. No business associate agreement exists and none is offered.
If a certification is ever obtained, this page will link to the report and the auditor — not to a generic badge.
Zephr is built around explicit capture, local capability, and stated limits. The limitations below are not a footnote — they sit at the same weight as the facts, because a privacy claim without its exceptions is not a privacy claim.
The local-first posture is documented in full on the privacy mode page, including what never leaves the machine and what Zephr does with model providers.
The documentation covers the architecture, the tool contract, the TrustBench methodology, and the trust model in detail. Every claim there links to its source.