Status
What exists, what each part does today, what is proven and what is not, and what comes next, said plainly and kept current.
Last updated 15 October 2026. This page is rewritten whenever the facts change. If a sentence here and a sentence elsewhere on the site disagree, this page is the one to believe, and the other is a mistake we would like to hear about.
In one paragraph
Keyward Server 1.0.0-alpha.1 is the first build: a downstream fork of Infisical OSS v0.165.16 with the full upstream
history, the unlicensed typeface replaced, and its provenance in every build. It runs on an internal staging instance
at keyward.vault.exprezoe.com with empty data, for development and testing, and is not open to the public. This
site, with its licensing, update channel, downloads and sign-in, is built and tested. Keyward Desktop, the Keyward
Service, Keyward MCP, the Keyward Connector, the credential helpers, enterprise sync and the command line are
designed, with their decisions written down and their gates named, and not built. Nothing is on sale.
What exists
| Part | State | What that means |
|---|---|---|
| Keyward Server 1.0.0-alpha.1 | built, internal | The image exists and runs on staging. It carries upstream's enterprise paths, excluded from release artifacts by policy; the build that enforces that is not written, so no Keyward Server image leaves Exprezoe. |
| The server's data path | proven | In an isolated restore lab, with a real recovery set of Exprezoe's own vault, the baseline version applied 192 migrations in 39 seconds and decrypted 628 of 628 cells, with 7 of 7 authorization invariants holding. The proof is repeated weekly. |
| This site | built, tested | Licenses, seats, activation, entitlement tokens, the signed update channels, the downloads page, the early-access form, administration, the audit trail. Its tests run on every commit. |
| Staff sign-in | built; on per site | The code is tested against a test issuer. Whether it is switched on for this site depends on Exprezoe Identity being provisioned for it; the home page's line and /api/v1/meta say whether it is. |
| Keyward Desktop and the Keyward Service | designed | The design. No installer exists. |
| Keyward MCP (local) and the Keyward Connector (remote) | designed | The design. Nothing can be connected yet. |
| Credential helpers | designed | The design. |
| Enterprise sync and the relay | designed | The design. |
| The Keyward command line | not started | Upstream's command line exists and works against a Keyward server; the Keyward build of it is not made. |
| A production Keyward Server | not started | Exprezoe's own vault still runs the upstream software. Moving it to Keyward is a separate decision with its own gate. |
What is proven, and how
- Restore and recovery. The weekly proof above. It is the reason the fork's baseline is v0.165.16 and not a newer version: a newer version earns its place by passing the same proof.
- This site. Automated tests cover the licensing API (seats, a race for the last seat, revocation, refresh, a forged token), the update channel (signature, never replacing a published release, per-product channels, yank, range requests), staff sign-in (a replayed sign-in, a missing second factor, a stale sign-in, key rotation at the issuer), the security headers, throttling, the content (every link leads somewhere; the keys the documentation prints are the keys the code trusts) and the audit trail.
- The keys. The release key and the license key were generated inside Exprezoe's vault, on the vault's own host, and have never been on a workstation or on this site. Their public halves are on Verify a download and The API.
What is not proven
- Anything about Keyward Desktop, the Service, the MCP, the connectors or the helpers: they do not exist. Their gates are written down on each page, and are what "proven" will mean for them.
- Keyward Server beyond the server's own data path: certificates and SSH certificates are upstream's and have not been exercised by us.
- Any client, environment or network we have not used ourselves.
What comes next, in order
- The enterprise-exclusion build of Keyward Server, so that an artifact can leave Exprezoe.
- Keyward's identity layer on the server: name, mark, typography, pages, mail.
- Keyward Desktop and the Keyward Service (R1), with the credential helpers (R4) in the same stream.
- Keyward MCP (R2), gated by the adversarial lab.
- The Keyward Connector (R3), which can start as soon as the staging server is stable.
- Enterprise sync and the relay (R5).
Dates are not given, because none would be true.
The changelog
The changelog will carry an entry for every release of Keyward Desktop and of the command line, with what changed, what was fixed and what is known not to work yet. It is empty, because there has been no release.