ZEPHYR 2.0: Local First Build Intelligence Engine

A zero dependency local first build intelligence engine that predicts, audits, caches, and replays computation with Ed25519 Build Capsules, byte-level reproducibility audits, and AI agent APIs.

Comment

posted an update —

Update: Final Submission, Enterprise Hardening, and Video Scope Clarification

We are excited to share the final submission updates for ZEPHYR 2.0. As we reach the final stage of EurekaDev 2026, we want to provide complete transparency on our engineering progress, the contents of our official submission package, and how our production architecture evolved beyond our early video walkthrough.

Video Scope and Post Recording Breakthroughs

Our demo video was recorded earlier in the competition window to showcase the foundational user experience of ZEPHYR. In that recording, viewers can observe our core execution engine:

  • Local first task graph execution modeled as a directed acyclic graph (DAG)
  • Intelligent cache miss explanations via the why diagnostic
  • Automatic project discovery using zephyr adopt across Go, Node.js, Rust, and Python
  • Pre flight workspace validation using zephyr doctor
  • Continuous reverse DAG rebuilds triggered by the file watching daemon

Following that recording, we subjected ZEPHYR 2.0 to rigorous enterprise architecture reviews. To transform ZEPHYR from a capable prototype into a hardened build intelligence system, we engineered six major subsystems that were built, tested, and integrated after the video was completed:

  1. Signed DSSE Envelopes and In-toto Provenance: We implemented full SLSA Provenance v1 predicates wrapped inside In-toto Statement v1 payloads. Manifests are canonicalized using a deterministic JSON encoder and signed using Dead Simple Signing Envelopes (DSSE) with Pre Authentication Encoding (PAE). Cryptographic authentication is handled by an Ed25519 key ring supporting key rotation and key revocation.

  2. Crash Safe Cache Pruning with Referential Integrity: In pkg/prune, we built a two phase mark and sweep cache garbage collector. It enforces strict referential integrity, ensuring no blob referenced by an active manifest is ever deleted. The engine preserves a 10 percent anti thrashing headroom and grants in flight builds a 15 minute grace period.

  3. Worker Admission Governor and Memory Limiting: In pkg/sched, we added an operating system level worker governor. It features a token bucket process spawn rate limiter (50 spawns per second, burst capacity of 200) to protect the kernel process table, a Linux cgroup v1, v2, and meminfo aware memory governor to prevent out of memory aborts, and a starvation free aging queue.

  4. Live Telemetry and Prometheus Metrics: We integrated an authenticated Prometheus /metrics HTTP endpoint and OTLP trace exporter into zephyr server, exposing live queue depths, memory pressure, and task execution latencies without external monitoring agents.

  5. Chaos Gauntlet and Security Path Jail Fuzzing: In pkg/stress, we introduced zephyr stress with 6 automated fault injection scenarios. This includes bit rot corruption quarantine, crash atomic fsync recovery, 1,000 node DAG cycle detection, and a 37 payload path jail fuzzing harness that neutralizes null bytes, percent encoded traversals, and Windows NTFS Alternate Data Streams (ADS). All 6 scenarios pass with zero failures.

  6. Task Purity Gating: We introduced a strict task purity separation: commands with external side effects (such as network deployments or unmanaged disk writes) are permanently barred from seeding the cache or feeding speculative early cutoffs, preventing cache poisoning across builds.

Verification and Deliverables

Every line of code and every hardening feature adheres strictly to our core design principle:

  • 100 percent Go standard library with zero third party Go module dependencies (require block in go.mod is completely empty).
  • 100 percent test pass rate across all 13 internal packages.
  • 17 out of 17 end to end checks passing in verify.ps1.
  • 6 out of 6 Chaos Gauntlet scenarios passing in zephyr stress.
  • Official submission package: ZEPHYR_2.0_Submission_Package.zip (3.7 MB), strictly containing source code, tests, documentation, and the compiled zephyr.exe binary. All redundant raw video recordings and image galleries have been excluded to keep the package lightweight and focused.
  • All code, documentation, and test suites are pushed and synchronized to our public GitHub repository.

Log in or sign up for Devpost to join the conversation.