Projects
One layer at a time.
Each project is independent, source-available, and useful on its own. Together they are the substrate an autonomous system needs before it can be trusted with anything real.
Undercroft →
Shipping · v1.6.1Hardened AI memory in Rust. Your agent's words kept verbatim in encrypted vaults — XChaCha20-Poly1305 at rest, an HMAC-SHA256 tag on every record, and a tamper-evident audit chain that catches an offline edit at unlock. Hybrid semantic and lexical retrieval, a temporal knowledge graph, screened writes and receipted deletion. Runs entirely on your machine with no model to download.
Keycroft →
Coming soonSecrets management for CI/CD pipelines, Kubernetes workloads, and developers — without a hardcoded credential anywhere. A self-hosted hub and connectors in Rust: CI jobs sign in with their platform's OIDC token, pods with their ServiceAccount, developers through the browser. Root keys under your own KMS or HSM, AES-256 at rest and post-quantum hybrid links, rotation with dry runs, and an audit chain an auditor checks offline.
Security posture ·
In developmentContinuous posture assessment for systems that have to answer for themselves — built on the same principle as the rest: findings you can reproduce, not a score you have to take on faith.
How we build
Verifiable beats trustworthy.
Trust is a claim about intent. Verification is a property of the artifact. We build for the second, because it is the only one that survives being wrong.
Nothing leaves by default
No telemetry, no phone-home, no API key required for core function. Outbound paths exist, but every one is an explicit opt-in — never a silent fallback.
Integrity you can check
Records carry their own tags. Deletions hand back receipts. Audit chains are replayable. If something was altered on disk, the software says so instead of serving it.
Honest about limits
Threat models state what they do not cover. Benchmarks are published as measured. A security feature that overstates itself is a vulnerability with good marketing.
hmac-sha256 · 9f3c1a…