Status — what is live, preview, built, and designed
This page is the product map. Witbitz deliberately separates four states:
- Live: serving production users today.
- Private beta: available to invited integrators, contract may change.
- Built, not production traffic: implemented and demonstrated, but not a property of ordinary production Spaces.
- Designed: architecture is specified, but the production mechanism is not complete.
Use this page before making a security, product, or enterprise claim.
Summary
| Area | Status | What to say |
|---|---|---|
| Async Spaces | Live | Persistent shared rooms with AI turns, sealed ledger, documents, widgets, and artifacts. |
| Admission gate | Live and checkable | Gated Spaces refuse reads and writes without an allow-listed identity. |
| Content-blind storage | Live and checkable | The store holds ciphertext sealed to the room key; no operator recovery recipient. |
| Delegated authority | Live and tested | High-stakes actions require human approval before execution. |
| Egress lock | Live and enforced | The browser-visible app can reach only a published allowlist. |
| Signed build certificate | Live and checkable | /cert.json binds the deployed render build and egress footprint. |
| Reproducible render build | Live and checkable | Published source rebuilds to the deployed Lambda hash. |
| Platform API | Private beta | Tenant-keyed /v1 API; invite-only, public OpenAPI. |
| Owner rule | Built, opt-in, not enabled by default | Owner-governed rooms and tiered admission are implemented, but inert unless configured. |
| On-prem VPC tier | Runnable today | The runtime can run in a customer's boundary with customer model, storage, and IdP seams. |
| Bridge protocol | Early preview | Cross-organization governed collaboration exists as an early protocol surface. |
| Attested server tier | Built and independently verifiable, not production traffic | Nitro enclave verification is demonstrated, but ordinary production Spaces do not run inside it. |
| Attested client | Server seam built; native clients not shipped | Policy can require attestation, but production native clients are still future work. |
| Sealed Spaces | Designed | The platform-never-receives-mk tier is specified, not yet the production Space path. |
| Companion | Optional roadmap | A native helper may improve notifications and key storage, but the platform does not depend on it. |
Live today
Async Spaces
The production Spaces app runs the async model: a member posts a turn, the render opens the sealed ledger, the agent answers, state is re-sealed, and the Space goes cold again. Idle Spaces do not require a running server process.
Read: Async Spaces
Identity and admission
Spaces support key-possession membership and deployed signed identity for gated rooms. For an email-gated Space, reads
and writes both require an allow-listed identity. A link holder without that identity receives 403.
Read: The Verified Room and Verify it yourself
Delegated authority
Effectful agent actions go through propose, approve or deny, then execute. Execution is refused unless the proposal is approved and has not already run. The audit trail is sealed with the room.
Read: Delegated authority
Verifiable privacy checks
The current production checks cover the admission gate, the app's egress footprint, content-blind storage at rest, the signed build certificate, and a reproducible build of the published render source.
Read: Verify it yourself
Private beta
Platform API
The /v1 API is tenant-keyed and documented with a public OpenAPI contract. Access is invite-only during private beta;
the contract may change with invited integrators before general availability.
Read: Platform API
Built but not default production behavior
Owner rule
The owner rule lets an app owner mandate signed admission policy and tiered capabilities for every governed room. The implementation is opt-in and behavior-neutral: unset keys leave existing rooms unchanged.
Read: The owner rule
Attested server tier
The Nitro enclave tier is built and independently verifiable: the room key is generated inside AWS Nitro hardware, the image measurement is reproducible from published source, and browser-side verification can check the hardware attestation. No ordinary production Space runs inside an enclave today.
Read: The attested tier
Preview and designed work
Bridge
The Bridge is the cross-organization frontier: sovereign Spaces collaborate without merging trust domains. It is an early protocol preview, not the primary production app path.
Read: The Bridge
Attested client
The server-side admission seam exists, but the native attested client shells are not shipped. The rule for the future client is that the reproducible web bundle must be bundled inside the attested binary and loaded locally.
Read: The attested client
Sealed Spaces
Today the server-side render receives mk briefly while a member is active. Sealed Spaces is the designed stronger
tier where the platform never receives mk and can append without reading.
Read: The double blind
Companion
The Companion is optional roadmap. Installed web app behavior already covers much of the original need: reachability, passkey-based key durability, and local client decrypt. A native Companion may still improve notification reliability and device-keystore ergonomics.
Read: The Companion
Machine-readable source: status.md · every doc in one fetch: llms-full.txt (HTML) · ← overview · platform →