Documentation
Prove your engineering. Here's how.
The complete reference for the zegit ecosystem — the toolchain that turns the work your developers and agents do into signed, audit-grade evidence bound to the exact commit. meerkat knows · zegit proves · watchsong discloses.
The toolchain
Three tools cover the release lifecycle. meerkat grounds the work, zegit turns it into signed, CRA-mapped proof, and watchsong handles the vulnerabilities that surface after release.
A single binary that loads your knowledge base at runtime and serves it over MCP, CLI, and HTTP — so agents start from what's true at your org.
The governance layer. Signs evidence into an Attestation of Validation, gates releases with quorum, and bundles CRA-grade proof.
Vulnerability disclosure as a service, early-stage. A disclosure timeline and CRA reporting guidance for what you ship; CVE assignment once its CNA scope is granted.
Start here
Install & first run
Install zg and meerkat, then go from zero to a governed push in 90 minutes.
ReadCore concepts
Evidence records, envelopes, AoVs, DSSE, and the ALLOW / REQUIRE_REVIEW / BLOCK policy engine.
Readzg CLI reference
Every zg subcommand — validate, auth, tr, policy, evidence, aov, init, push, update, git-shim — with flags and exit codes.
ReadCRA Evidence Bundle
Turn a release tag into an Annex I–mapped, offline-verifiable evidence bundle.
ReadReference by component
zegit
The prover: validation, AoVs, Tag Requests, the gateway, and evidence bundles.
Openmeerkat
The knowledge base: install, the mk CLI, content sources, ingestion, and MCP/HTTP integrations.
Openwatchsong
Vulnerability disclosure: CVE records, CSAF advisories, and CRA reporting deadlines.
OpenEditor plugins
Emit zegit evidence from Claude Code and OpenCode sessions, deterministically.
OpenA note on honesty
These docs follow the platform's own voice rule: be honest about what the evidence proves. Where a feature is planned rather than shipped, or where a v1 attestation has a known limit, the page says so plainly.