The platform

This page is the machine.

Copilot memories are written by the agent and cannot leave GitHub; Zephr memories are signed by a human and work everywhere.

The home page told you what it feels like. Here, one zephr_remember call crosses every real component — each named with the place it lives in the repository. Copy the entrypoint:

zephr_remember

Follow it down.

mcp-server

The 32-tool contract. Admission scope is intersected before any handler runs.

packages/mcp-server

The beam is a zephr_remember call. Each scene below zooms one stop.

Stop 1 · mcp-server

Scope is checked before the handler exists.

The admission a connection was granted is intersected with every request’s worktree — at the transport, before any tool code runs. Flip the caller to a foreign project and watch the same call take a different exit.

tools/call · zephr_rememberattempt from a project this connection was never admitted to

{
  "claim": "Payment webhook retries are capped at 3 attempts.",
  "worktreeId": "wt_04c7 · project A"
}

Before any handler runs

scope = intersect(admission, request.worktreeId)

✓ in scope · handler runs

The write proceeds to the store carrying the scope it was admitted under. Every one of the 29 tools passes this same gate — it runs at the transport, so a tool cannot opt out of it.

Illustrative example — not live data

Stop 2 · the store

One claim becomes five columns.

Admitted, the claim decomposes into the evidence chain — the real columns it is stored in. This is why a recall answer can name the file range and the reviewer it rests on, instead of returning a similarity score and asking for trust.

Claim
belief.claim · text
"Payment webhook retries are capped at 3 attempts."
Source
provenance.source · uuid
claude-code · session 04c7 · zephr_remember
Anchor
anchor.path, lines, digest
webhooks/stripe.ts · L41–58 · sha256:9f2a…
Review
belief.review_state · enum
unreviewed → (a person decides)
Contradiction
contradiction_cluster.state · enum
none open — watched from now on

Confidence is computed, not asserted

packages/core/src/memory/confidence-decomposition.ts

Seven dimensions are combined in log-odds and calibrated through a sigmoid, so one weak signal cannot carry a claim by itself — and the model never gets to self-report a score.

Illustrative example — not live data

Stop 3 · your machine

A Rust daemon holds the local line.

On your machine the request meets zephr-daemon-core — the plane that answers in milliseconds, enforces hook budgets, and opens the store read-only where it can. Select a module; each one is a real file.

crates/zephr-daemon-core/src/ipc.rs

The JSON-RPC surface over a local socket — peer-credential checked, catalog-pinned.

Rust, on your machine, opening the store read-only where it can. These are actual files in the crate — the scaffolding (main, config, error handling, test support) ships alongside them in the repository.

Stop 4 · apps/worker — 19 of them

While you sleep, the machine keeps working the row.

Every worker below is a real process in the repository. They sort, merge, cross-check, and index what you saved. Routine repeats file themselves under rules you set; anything new waits for you.

Working your memory

belief-classifySorts what you save into kinds; routine matches file themselves under your rules.
consolidationStages repeated episodes into one suggested lesson, for your review.
contradiction-projectionFinds claims in overlapping scopes that disagree; both stay readable.
analysis-planeLLM analysis jobs under a per-tenant daily budget — fail-closed at the cap.
memory-job-enqueuerThe scheduler: puts the memory jobs on the queue so the others can claim them.

Indexing your code

lens-fetchFetches an indexed ref of your repository, read-only.
lens-lexical-buildBuilds the exact-text plane.
lens-structural-buildBuilds the symbol plane.
lens-semantic-buildBuilds the meaning plane.
lens-graph-buildBuilds the dependency-edge plane.
lens-plane-opsPublishes finished planes and retires stale ones.

Watching for change

drift-event-producerNotices when an indexed ref falls behind the repository.
automation-evaluatorEvaluates your alert rules against live signals, with cooldowns.
autonomous-agentsClaims governed agent runs — execution is gated, and in development.

Keeping the lights on

fleet-notifierTells you when a device is revoked or a consent is waiting.
billing-notificationsUsage and billing notices, from measured state only.
remindersDelivers scheduled reminders to the channels you bound.
projectorProjects confirmed writes into the vector index, exactly once.
reconcileSweeps the outbox for writes that never landed, and retries them.

The one rule all 19 obey

Routine work files itself — under parameters you set: an exact repeat of something already accepted, or a match your own rules cover, is dispositioned automatically with a recorded reason. Anything new, contested, or security-critical waits for an authenticated human — and that gate is enforced by the store below the workers, not by convention among them.

Stop 5 · anywhere

The same trip, at three addresses.

Everything you just followed runs identically whether the store is a file on your disk, in-process next to your editor, or the managed service. Switch the address; try to find the difference.

operated byyou

Shipped

One SQLite file you can copy, back up, or delete. Nothing about the tool contract changes when this is the address.

What just did not change

The schema, the 32-tool contract, and the scope checks are the same object at all three addresses. What changes is who administers the store — an agent cannot tell which one answered it except by asking.

The full surface

32 tools, seven integrations, three primitives.

The evaluator’s section — the whole integration surface in one place, dense on purpose. Names are frozen; CI asserts this list against the product’s tier manifest.

always available

Every tool takes aworktreeId and is refused if it falls outside the scope the connection was admitted to. Names are frozen — CI asserts this list against the product’s tier manifest.

Where it connects

Supported client and provider integrations, with build status
Surface	Transport	State today	Status
Claude Code	MCP · JSON mcpServers	Adapter shipped, config generated by the CLI.	Shipped
Cursor	MCP · JSON mcpServers	Adapter shipped, config generated by the CLI.	Shipped
Codex	MCP · TOML mcp_servers	Adapter shipped, config generated by the CLI.	Shipped
opencode	MCP · JSON mcp	Adapter written; conformance run not finished.	Evolving
Any MCP client	stdio transport	The tool contract is versioned and CI-asserted, so an unlisted client works.	Shipped
GitHub	App · webhook	Consent gate and secret scan pass their drills; runtime soak not done.	Evolving
GitLab	App · webhook	Designed alongside GitHub. No code on main.	Planned

What an operator can answer

Scope binding
Admission + lattice shipped
A connection is admitted to one project, one repository, one worktree before its first tool call. Changing the scope takes a new admission, not a mutation — and the check runs at the transport, so a tool cannot opt out.
Audit receipts
Pipeline drill-tested · live adapters deferred
Admissions, refusals, verifications, and erasures are append-only events with deterministic identifiers — an operator replays what happened rather than reading a log that could have been edited.
Drift events
No producer · ADR in design
When a cited range changes, the citation is marked stale structurally. The table and read routes exist; nothing writes a row yet, so the feed is empty rather than wrong.

Built, and not

The ledger this page answers to.

Both lists read off the truth table on main. Where that file and the capability audit disagree, the more conservative reading is the one printed here.

Built and covered by tests

Shipped

The local evidence graph: capture, recall, provenance traversal, abstention.
The 32-tool MCP contract — core, search, and docs tiers — with the names asserted in CI.
Tenant isolation by schema and row-level security, forced on every table.
Per-tenant envelope encryption with key rotation and an erasure path.
Immutable scope admission, the eight-level scope lattice, and contradiction clustering.
Signed cross-tool handoff, v1, proven end to end.
TrustBench as a deterministic, pipeline-blocking gate, and the ADR drift check beside it.

Decided, not built

Planned

Bi-temporal valid time: the columns are in the schema and nothing writes them.
Sync and outbox runtime: schema only, no poller, no retry, no idempotency keys.
Hosted Lens runtime: no query planner and no hosted embedding pipeline.
Review Intelligence end-to-end: the engine and lenses are built, the hosted provider loop is in development.
Drift verdict depth: the producer ships events, richer verdict classes are in design.
The T3 judge: deferred by decision, behind an explicit gate.
Fleet device-flow enrollment: the schema contract exists, the RFC-8628 runtime does not.

The product clusters, one line each

MemoryShipped
Slipstreamv1.1 shipped · E2E-proven
LibraryEvolving · legal gate not built
SyncShipped · local reconcile
LensGate layer tested · hosted runtime in design
ReviewEngine + lenses built · in development
PulseCore shipped · expanding
GuardShipped · T3 judge deferred by decision
FleetInstallation ledger exists · complete profile integrity + revocation planned
ConnectCLI shipped · web wizard partial
AgentsBuilt, hardening · never self-confirm

Each name links to its own page — the detail lives there, not here.

Statuses read from openspec/CAPABILITIES.md anddocs/STATUS.md on main; the conservative reading wins.

The console is this page with real data.

Everything above is the designed shape. The running system is at the console, where an empty surface says it is empty and a disconnected one says so too.

Open the console

Read the use cases