Enterprise

Enterprise

Enterprise v2 overlay: fail-closed security, SSRF allowlists, durable SQLite jobs, /api/v2, RBAC. Deep: enterprise-v2.md.

What it adds

Area	Change
Webhooks	Signatures required; X-GitHub-Delivery; replay rejection
Jobs	Durable SQLite workers; recursive secret redaction
URLs	Target policy / SSRF allowlists before execution
AI flow	Deterministic safety gateway on LLM/heuristic actions
Scheduler / findings	SQLite-backed replacements

Queue a durable job

curl -X POST https://qa.example.com/api/v2/jobs \
  -H 'Content-Type: application/json' \
  -H 'Idempotency-Key: deployment-7f0a1' \
  -d '{
    "kind": "vitals",
    "params": {"url": "https://app.example.com", "device": "Desktop Chrome"}
  }'

Secret references (raw tokens rejected when persisted):

{
  "kind": "realtime",
  "params": {
    "url": "https://app.example.com",
    "ws": "/ws/events",
    "token": {"$secret": "env:QA_REALTIME_TOKEN"}
  }
}

Service tokens

python tools/hash_api_token.py
# Store hashes only; set ZYVOR_API_TOKENS_FILE=…

See enterprise-v2.md for RBAC, allowlists, and installer steps.

Related: Mission Control · Deploy and Releases.