ZEPHYR 2.0: Local First Build Intelligence Engine

A zero dependency local first build intelligence engine that predicts, audits, caches, and replays computation with Ed25519 Build Capsules, byte-level reproducibility audits, and AI agent APIs.

Comment

posted an update —

Major Engineering Update: P0 & P1 Production Resilience & Supply Chain Hardening

Since our initial submission, we pushed ZEPHYR 2.0 through a comprehensive systems hardening pass. We expanded the core engine from 11 to 13 internal packages with zero third party Go module dependencies (require () in go.mod remains completely empty), passed 17/17 end to end verification checks, and survived all 6/6 automated scenarios in our Chaos Gauntlet.

1. Storage & Path Jail Hardening (P0)

  • Path Traversal Defense: Lexical path boundary enforcement blocks null byte injections, percent encoded traversals (%2e%2e%2f), Windows Alternate Data Streams (:), and Windows reserved device names (CON, PRN, AUX, NUL, COM1 through COM9, LPT1 through LPT9).
  • Crash Atomic CAS Storage: Blobs now stage into same shard temporary files to eliminate cross device EXDEV errors on containerized runners, backed by POSIX directory fsync calls and exponential backoff retry for Windows file sharing locks.
  • Strict Capsule Replay Verification: .zcap unarchiving rejects symlinks, hardlinks, character or block devices, FIFOs, and case collision exploits.
  • Log Stream Redaction: Chunk boundary carryover windows ensure tokens and secrets split across read buffers are completely redacted.

2. Cache Correctness & Task Purity Gating (P0)

  • Side Effect Quarantine: Tasks with side effects (such as network deployments or writes outside their workspace) are marked impure. Impure tasks are strictly blocked from seeding the action cache or speculative early cutoff, eliminating cache poisoning.

3. Crash Safe LRU Eviction & Pruning Engine (pkg/prune) (P1)

  • Referential Integrity: Implemented a two phase mark and sweep engine that scans all active task manifests under read locks. Any blob referenced by an active manifest is never deleted.
  • Anti Thrashing Headroom: Maintains 10% disk headroom below quota limits to prevent continuous eviction loops.
  • In Flight Protection: Grants active builds a 15 minute grace period so artifacts cannot be evicted out from under a running pipeline.

4. Hardened Worker Pool & Production Telemetry (pkg/sched) (P1)

  • Resource Governors: Subprocess spawn rate token bucket (50 per second, burst 200) prevents kernel process table exhaustion. A weighted memory governor inspects Linux cgroup v2, cgroup v1, and /proc/meminfo before scheduling heavy workloads.
  • Aging Aware Scheduling: Dynamic priority elevation prevents low Critical Path Method tasks from starving during massive graph runs.
  • Native Telemetry: Added Prometheus text exposition (/metrics) and OTLP JSON telemetry without external dependencies.

5. Supply Chain Provenance & DSSE Envelopes (pkg/capsule/dsse.go) (P1)

  • SLSA Provenance v1: Native generation of signed statements serialized via deterministic Canonical JSON (RFC 8785 subset).
  • DSSE Signing Envelopes: Pre Authentication Encoding (PAE) wrapping with Ed25519 cryptographic signatures.
  • Key Ring Management: Added key rotation and revocation tracking so compromised signing keys can be invalidated cleanly.

Automated Verification Receipts

  • 13 Internal Packages: 100% unit and integration test pass rate (go test ./...).
  • Chaos Gauntlet (zephyr stress): 6 of 6 automated chaos scenarios passing (Bit rot quarantine, crash atomic fsync, 1,000 node DAG cycle stress, clock skew invariance, and Tar Slip traversal fuzzing).
  • End to End Audit (verify.ps1): 17 of 17 end to end assertions passing cleanly.

Log in or sign up for Devpost to join the conversation.