Security
Spine is built around governance and audit — we hold our own security to the same bar.
Reporting a vulnerability
What Spine does not do
Admitting boundaries is part of being trustworthy:
- No external write under
--safe— the default evaluation posture writes nothing. - No push, merge or tracker write without an explicit human approval.
- No LLM in the deterministic build — comprehension is deterministic by construction; image OCR and audio/video ASR are opt-in extras, off by default.
- No deployment — the pipeline ends at the reviewed PR; shipping stays yours.
- No unmeasured claims — graph accuracy is precision/recall against a published corpus, not asserted.
Append-only audit
Every action Spine takes is recorded in an append-only log and is replayable via durable execution. See Governance & gates.