NaZelo Trust¶
Run critical software through the trust stack, get proof.
NaZelo Trust runs your command in an isolated sandbox, decides what it may send
out from a signed policy, and seals what happened into a signed evidence
chain — one command, correlated by one run_id.
Three engines, one guarantee: PimaTika decides egress from a signed manifest,
NaZelo enforces the decision, Litatoli seals the evidence. Each is separately
sellable; this package is the composition, and it ships the two narrower ones
beside it — nazelo-policy (decided and enforced, no sealed chain) and
nazelo-evidence (isolated and sealed, no policy engine).
Start here¶
- Installing — the four moving parts, in order, and
nazelo-trust doctor, which tells you what is still missing - Getting started — a sealed run, a BIM-governed run with an ALLOW and a DENY, and verifying the chain offline
- The conclusive test — the committed, reproducible three-brick end-to-end run
Before you rely on it¶
Read these two before trusting a result. They are where the guarantee stops.
- Operating limits — what each control proves and
where it stops:
enforcedis notattested, what TLS hides, and how data-class detection is evaded - Disclosure policy — what leaves the machine. Your choice, with a safe default; read it before enabling any export
Contracts¶
- Evidence contract — the canonical model of what NaZelo Trust proves
- Integration contract — what the three engines guarantee together, what they need, and what they do not do. Proven on every push by the composition job, against whatever revision each engine is at
Licence¶
Business Source License 1.1 — source-available, not open source. Read, build, run in production and audit it; you may not offer it to a third party as a hosted service.
For alternative arrangements: support@nazelo.dev