● zegit · proves
zegit
CRA-aligned governance for the Git you already have. zegit sits in front of your existing Git host and turns every release tag into an audit-grade evidence bundle — without migrating where code lives.
zegit (pronounced [ʒə ɡʲɪt]; the CLI is zg) is the governance layer of the ecosystem. It is built for two workflows that PR/CI-centric platforms underserve: trunk-based development (where main is always deployable) and agentic workflows (which need deterministic, local validation, not remote CI round-trips).
Core bets
| Principle | What it means |
|---|---|
| Execution at the edge | Checks run locally or on your runners. zg validate runs on the dev machine. |
| Verify, don't re-run | The gateway verifies cryptographic evidence rather than re-running CI. |
| Governance as code | Policy lives in Git — an org baseline plus a per-repo ZEGITFILE. "Policy cannot be weakened" is a cryptographic property. |
| Hardware-backed trust | Passkeys / WebAuthn; short-lived signing certs; a fresh passkey touch for release approvals. No passwords, no long-lived tokens. |
| CRA-grade evidence | Every release tag produces a downloadable, Annex I–mapped evidence bundle. |
The three components
zegit ships three deployable pieces:
zg — the CLI
The developer/agent surface. Runs validation, signs AoVs, drives Tag Requests.
CLI referenceThe Gateway
A standalone SSH git server (z-gateway-server). Verifies AoVs and enforces quorum on push, then forwards accepted refs to GitHub and Gitea.
Gateway docsControl Plane
IAM, policy resolution, Tag Request orchestration, the audit log, and bundle generation.
ComplianceHow it fits together
The model is edge-first and governance-centric. Identity is passkey-bound: a WebAuthn ceremony makes the Control Plane issue a short-lived X.509 signing certificate; zg validate signs AoVs with that cert; the gateway verifies the chain to the Root CA, checks revocation, and accepts or rejects the push.
developer / agent gateway (pre-receive) control plane
zg validate ──signs──▶ verify AoV → Root CA IAM · policy
git push ─────────▶ check revocation + quorum Tag Requests
ALLOW → accept audit log
BLOCK → reject ZG_ERR_* bundle genFail-closed by default
For protected refs, a gateway whose revocation list is staler than the max staleness (default 60s) must fail closed (ZG_ERR_REVOCATION_LIST_STALE), as must an unreachable Control Plane. Self-hosted deployments can set an offline grace period for unprotected refs only.
Self-hosting
The production deployment is z-gateway-server, a standalone SSH git server. GitHub SaaS is live via the zegit-gateway GitHub App. Gitea and GitLab self-managed are also supported. zegit governs its own repository — every commit to master carries a verified AoV.
Dig in
Authoritative reference, generated from the component repos. Spot something stale? Tell us.