ciphr — the security layers

Build

The starting state is the default build — the artefact a deployment actually gets. Not "everything on".

Surface entries switchable

ADR-20. Every entry is off until a deployment names it — with a date and a reason, or the server does not start.

All five. The list is the one in crates/ciphr-server/src/surface.rs as of 2026-08-24. Four sit on this ring; honeypot_alert sits on the auth ring, because that is where it adds code.

Lenses

What may never become switchableADR-20 property 4 — the closed list
Coverage of the review of 2026-08-21hides what that review did not read
Show the cutswhat the onion cannot represent

How to read it

built, not switchable
a property of the deployment, not code
switchable (surface entry)
not built, or deferred
reviewed core — a band, not a ring
a cut: ignores every ring

Rings are not quality levels. Each ring is a boundary with a gate, and its label says what is checked. Outwards it is not the quality that decreases but the number of parties that increases.

Navigation

Drag to pan, wheel to zoom. Tab moves between elements, Enter opens one, Esc closes it.

The diagram is assembled in the browser from a table of elements and needs JavaScript for that. The content itself is in docs/ in full — the diagram orders it, it is not its source.