Security
Spine is built around governance and audit — we hold our own security to the same bar.
Reporting a vulnerability
What Spine does not do
Admitting boundaries is part of being trustworthy:
- No external write under
--safe— the default evaluation posture writes nothing. - No push, merge or tracker write without an explicit human approval.
- No LLM in comprehension — deterministic by construction.
- No OCR, images or video — text-only document ingestion.
- No published benchmarks yet — so none are claimed.
Append-only audit
Every action Spine takes is recorded in an append-only log and is replayable via durable execution. See Governance & gates.