Cryptographic Integrity & Zero Source Exfiltration

Local code, signed evidence, gated cloud access

Ozzy Dev is architected from the ground up for strict enterprise security. Your source code and semantic indexes never leave your Mac. Every consequential agent action produces a verifiable Ed25519 cryptographic receipt.

01 · Data Privacy

Mac-Local Trust Boundary

All repository indexing, AST parsing, symbol graphs, and search embeddings remain on your physical workstation on 127.0.0.1 loopback.

Zero source code cloud telemetry
Loopback origin security guards

127.0.0.1 Loopback · Local SQLite

02 · Audit Proof

Ed25519 Signed Receipts

Every code edit, search query, test ladder, and wave dispatch emits a tamper-evident Ed25519 receipt linked to a KnowYourModel agent card.

Offline verifiable in WebCrypto
JCS canonical payload hashing

Ed25519 Signatures · KnowYourModel

03 · Access Control

Sentinel Cloud Auth Gate

Cloud console deployments enforce Sentinel OAuth authorization, role-based access control (RBAC), and session cookie cryptographic validation.

Default-denied admin endpoints
Cloudflare D1 encrypted vaults

Sentinel OAuth · Admin RBAC

Interactive Security Lab

Verify Cryptographic Proof of Work in Real-Time

Test our offline verification protocol directly in your browser. Every receipt emitted by OzzyDev subagents can be independently verified without contacting our servers.

Client-Side Receipt Verifier

Offline Ed25519 WebCrypto

Every consequential action executed by OzzyDev subagents emits a cryptographically signed receipt. Verify offline without relying on the console as an authority:

Receipt JSON Bundle

{
  "common": {
    "receipt_id": "rc-06FZMVQX930FQVPS6HCEKZC228",
    "timestamp": "2026-08-15T16:38:00Z",
    "category": "product",
    "tenant_id": "nexartis-platform-01",
    "workspace_id": "01JNEXARTIS000000000000001"
  },
  "payload": {
    "kind": "trust",
    "event_type": "action",
    "action": {
      "tool": "ozzydev-write_apply",
      "category": "d",
      "target_repo": "nexartis-ozzydev",
      "files_touched": 3,
      "verify_ladder_result": "pass"
    },
    "assurance": "production"
  },
  "envelope": {
    "key_id": "kym-agent-nexartis-lead-01",
    "algorithm": "Ed25519",
    "signature": "3b8f19da4c01e... (valid)"
  }
}

Traditional Cloud AI vs. OzzyDev Enterprise Model

Security Dimension	Cloud Coding Assistants	OzzyDev + Jade Planner
Source Code Storage	Uploaded to third-party vector cloud databases	100% on-device local Mac filesystem (127.0.0.1)
Audit Provenance	Unstructured chat logs and ephemeral tokens	Cryptographically signed Ed25519 Trust Receipts
Agent Identity	Anonymous API key with global access	KnowYourModel (KYM) cards with explicit permissions
Execution Safety	Silent overwrite with unverified code diffs	Isolated git worktrees + 4-rung test verify ladder

Security and trust by design

Explore our open-source security models or sign in with Sentinel.