Ziggurat is a human-gated memory firewall: a local TypeScript reference implementation that treats durable AI memory as a privileged write surface.
A model can read authorized content and draft a complete, evidence-backed candidate. It cannot admit that candidate to durable shared memory. Only the holder of an external Ed25519 private key that operator policy assigns to a reviewer can. Ziggurat ships no signer. Keeping the private key outside the vault and inaccessible to the model and Ziggurat process is an operator responsibility. The receipt proves key control and exact-content authorization, not humanity or attention.
Content and source ranges, without admission authority.
Resolve citations and check the live evidence.
Keep the private key separate from the model and host.
Verify the receipt and every other eligibility condition.
Gold MCP Read-only reference data
Figure 1. The review hand-off is external. No shipped path signs or approves a page.
Persistent context means a poisoned document, a fabricated preference, or an embedded instruction outlives the session that introduced it. One bad write keeps paying out, and the payout is silent: later sessions read it as ordinary background.
Anything that can write the page can write the string. Review metadata records that someone says a review happened; it cannot demonstrate that a particular key holder approved these exact bytes. Ziggurat keeps the two as different kinds of object.
---
status: reviewed
reviewed_by: alice
retrieval_eligible: true
---Self-asserted metadata changes nothing. Without a matching receipt the page stays out of Gold and out of the Gold index, whatever it says about itself.
{
"schema_version": 1,
"decision": "admit",
"target_path": "knowledge/topic.md",
"content_sha256": "<canonical page digest>",
"reviewer_id": "committee-chair",
"reviewed_at": "2026-08-29T21:00:00Z",
"key_id": "committee-chair-2026",
"algorithm": "ed25519",
"signature": "<detached base64 signature>"
}Verified against a public key configured in config/trust.yaml. It binds the decision, the target path, the canonical page digest, the reviewer, the timestamp, and the key. It is necessary for Gold, not sufficient on its own.
The source starts as evidence, not an instruction or an approved claim.
ingest records canonical text without overwriting an existing capture.
The model drafts content and source ranges. The host checks them against live evidence.
A reviewed_by field alone does not admit the page.
The reviewer authors the final page and obtains an external Ed25519 signature.
build requires the receipt and every other eligibility condition.
Gold MCP exposes read-only context, not instruction authority.
build writes three separate version-2 indexes rather than one store with filters. Each carries its own profile literal, deterministic chunk IDs, a trust-policy fingerprint, and a corpus fingerprint over complete chunk integrity.
| Index | Contents | Intended use | Shipped MCP |
|---|---|---|---|
| gold-index.json | Authorized Gold only | Answer context | Exposed, read only |
| review-index.json | Policy-safe Silver proposals plus authorized Gold | Local advisory review | Not exposed |
| evidence-index.json | Policy-safe Bronze plus authorized Gold | Local forensic tracing | Not exposed |
The second column is not a disclaimer. A boundary you cannot describe the edges of is a boundary you cannot rely on.
inbox/..ziggurat/proposals/.config/trust.yaml.content_role: reference and instruction_authority: none.The garden walkthrough runs the poisoned-memory scenario against fixture data and stops at the human signing boundary by design. Clone the repository, then from the checkout root:
npm ci
npm run build
node scripts/run-garden-walkthrough.mjsAssets, actors, trust assumptions, attack mapping, fail-closed behaviour, and the residual risks the design does not remove.
Threat model overview, then the attack-control mapping and the guarantees and residual risks.
Create the directories and an empty trust policy, capture one piece of evidence, and build the three indexes.
node dist/src/cli/main.js init --root ./my-vault
cp some-note.md ./my-vault/inbox/
node dist/src/cli/main.js ingest --root ./my-vault \
--file inbox/some-note.md
node dist/src/cli/main.js build --root ./my-vaultZiggurat is distributed as source, not as a published npm package. Contracts, index formats, and CLI behaviour may change before 1.0.
Continuous integration is configured to run the full suite on Linux, macOS, and Windows against Node.js 22 and 24. Bounded model, retrieval, signing-interoperability, and operating-envelope measurements are documented in project status, alongside failures and remaining gaps. Human usability is unmeasured; no adoption, deployment, third-party audit, or production maturity is claimed.