Zephr
Start free

Governance / Trust

Trust is inspectable.Or it doesn’t exist.

Every trust claim below is backed by a reproducible artifact — a deterministic test run, a policy evaluation, a scope binding, or a structured abstention. No score is fabricated, no certification is claimed, and where a gate has not been measured, this page says so in the same size type as everything else.

Shipped · T1 + T2 verificationADR-Z-08ADR-Z-09ADR-013TrustBench is CI-blocking
TrustBench

Test the transferred environment like software.

Deterministic scenarios prove the environment an agent inherited still behaves correctly. Every verdict traces to a reproducible artifact with a SHA-256 corpus digest, and the suite runs in CI on every merged commit — it is not a one-time audit.

Continuity suite

9 scenarios · 1 measured feature · 5 features not evaluated. The two counts stay separate on purpose: a feature without a fixture corpus has produced no evidence, so it cannot be reported as a passing scenario.

TrustBench · measuredVerified

retrieval.scenario-pass-rate — 1.0

  • passed:Hybrid golden orderinghybrid-golden-ordering · retrieval.ranking
  • passed:Foreign scope excludedforeign-scope-excluded · retrieval.scope
  • passed:Stale evidence supersededrejected-and-outdated-excluded · retrieval.review-state
  • passed:Semantic paraphrase topsemantic-paraphrase-top · retrieval.semantic
  • passed:Lexical fallback when semantic disabledlexical-fallback-equals-disabled · retrieval.fallback
  • passed:Contradiction causes abstentioncontradiction-abstains · retrieval.contradiction
  • passed:Temporal as-of gatetemporal-asof-gate · retrieval.temporal
  • passed:Empty result handled cleanlyempty-result-clean · retrieval.empty
  • passed:Capacity overflow abstainscapacity-overflow-abstains · retrieval.capacity
9 of 9 passed
TrustBench · no evidence yet

Features with no fixture corpus

  • Atomic idempotencyNot evaluated

    idempotency — no fixture corpus yet

  • Provenance / claim supportNot evaluated

    provenance-claim-support — unsupported-claim rate is unmeasured

  • Scope admission + foreign-scope integrityNot evaluated

    scope-admission — enforced in code, not yet benched

  • Transport adversarial resilienceNot evaluated

    transport-adversarial — adversarial corpus not written

  • UI honesty (no silent external requests)Not evaluated

    ui-honesty — no automated gate exists

no evaluation = no artifact = no claim

Illustrative example — not live data. The scenario list mirrors the public TrustBench evidence report.

Trust Firewall

An agent can’t declare its own memory trusted.

Deterministic, worktree-scoped policies gate every capture and retrieval. Capture and review are separate steps, and a refusal names the specific rule it failed — a useful error, not a mystery.

Policy · effective ruleVerified

Security-related captures require provenance and human review.

The policy is a pure function of the worktree’s configuration. It is evaluated before any content is stored, so the refusal path is the same every time.

Shippedscope: worktree main · kind: security
Attempt · inbound captureUnreviewed

“The prod credential incident is resolved.”

An agent tries to store a security conclusion with nothing behind it: no evidence anchor, no commit, no reviewer.

no source attached · no reviewer
Capture blocked
Production credential incident requires an evidence source and human review.
Fix: attach the incident report as evidence, then submit for your review.
Firewall · why

Refusals are specific, not mysterious

The refusal names the failed rule and the fix. Nothing is silently dropped, and nothing is silently accepted at a lower standard — a blocked capture stays blocked until the evidence exists.

ADR-Z-08 · Policy engine

Illustrative example — not live data. ADR-Z-08 · deterministic policy engine.

Immutable scope binding

Every connection is bound. Every scope is immutable.

Project → repository → worktree, admitted once and bound for the connection’s lifetime. A binding_epoch advances by exactly +1 on each legal transition, and binding on the first tool call is forbidden outright.

  1. 01

    Project approval

    A one-time, human-initiated action that creates an immutable installation identity and an approved project boundary. Nothing binds itself.

  2. 02

    Path binding

    Binds a filesystem path to the admitted project. Device/inode identity is revalidated on every admission, so a swapped directory is a new admission decision.

  3. 03

    MCP transport guard

    ToolContext.scope validates the admitted scope before any tool call. A mismatch returns scope_violation, and a connection that never admitted is closed rather than defaulted.

  4. 04

    Governed mutation

    Every durable write runs inside BEGIN IMMEDIATE with lease finalize revalidation. Admin purge/migrate reject over admitted connections.

  • Project approvalShippedzephr project approve · PR #43 · ADR-Z-09
  • Path bindingShippedzephr path bind · PR #43 · revalidation SB-4349 · PR #58 + #63
  • MCP transport guardShippedSB-4321 · PR #42
  • Governed mutationShippedSB-4348 · PR #54

PR #34, #42, #43, #54, #58, #63, #64, #65 — all merged to main.

Honest abstention

The system says “not evaluated” rather than guessing.

When evidence is insufficient or contradictory, recall abstains. There is no fabricated confidence and no silent blank: every abstention carries the reason it abstained and the retrieval code that produced it.

  • Abstained

    “Which auth flow does staging use?”

    Two reviewed sources contradict each other. The strongest matches disagree — Zephr shows the contradiction rather than picking a winner.

    retrieval.contradiction — abstention

  • Abstained

    “What is the deploy target?”

    No source with provenance was found for this query. The agent has no basis for a claim, so it is given none.

    retrieval.empty — no qualifying evidence

  • Supported

    “Rate limits: 100 req/min”

    Two reviewed sources agree. Source anchor: docs/api.md#L214, verified 2026-03-04.

    retrieval.supported — 2/2 agree

Illustrative example — not live data. No confidence percentages: reasons and sources instead.

Provenance chain

Every claim shows its work.

Source → anchor → confidence → review state. A memory without provenance is a claim without evidence. The TrustBench gate that would measure Zephr’s unsupported-claim rate is itself not evaluated — so the strength of this section is architectural, not measured, and we say which.

Claim-support gate not evaluated
  1. 01

    Source

    Where the claim came from. A file path, a session, or an external input — always a named origin.

    docs/api.md

  2. 02

    Anchor

    The specific location inside that source: line range, commit, content digest, timestamp.

    #L214 · 2026-03-04

  3. 03

    Confidence

    How many reviewed sources agree. A count with reasons, never a manufactured percentage.

    2/2 reviewed sources

  4. 04

    Review state

    The human or policy verdict: unreviewed → confirmed → rejected → invalid. Attributable and dated.

    confirmed

ADR-Z-13 · Deterministic code reviewer · no model authority. Every node is a durable, inspectable object rather than a derived computation.

Verification tiers

What TrustBench proves — and what it doesn’t.

Three tiers of verification. Only the first two are implemented, and the third is explicitly unbuilt: a deferral decision with conditions, not a roadmap tease.

  1. T1

    Structural

    Shipped

    Deterministic checks: does the environment match the expected structure? Schema validation, tool-surface assertion, scope boundary checks. No model involved.

    Deterministic, reproducible · no model involved

  2. T2

    Consistency

    Shipped

    Cross-checks: do multiple sources agree? Contradiction detection, review-state filtering, foreign-scope exclusion. Reproducible, no model involved.

    Deterministic, reproducible · no model involved

  3. T3

    Judgement (unbuilt)

    Planned (unbuilt)

    Model-assisted evaluation: does the answer hold up in context? Advisory only, provenance-bearing, and structurally unable to overturn a deterministic policy refusal. Admitted only if evaluation proves it improves on T1+T2.

    No model authority — ever · Gated on future evaluation (ADR-Z-07)

T1 and T2 are real, tested, and CI-blocking. T3 is an honest admission of what has not been built — and a commitment that a model will never be the authority when it is.

Read the security model.

The trust semantics on this page rest on layered controls and measured performance. Both are documented, and both state their limits.

Read the docsSee benchmarks