Skip to content
Memtru
Documentation menu
Guides

Readiness evidence

Updated 27 October 2026. Memtru 0.1.1 remains in beta testing. These observations are evidence for the paths exercised, not an enterprise certification, an unrestricted commercial launch or a guarantee of absolute security.

What has been checked

  • The tested evaluation-path release passed 212 Python tests, 107 web unit tests, 42 browser tests, 18 operational tests and four document-publication tests, along with static checks, build, publication/secret guards and runtime dependency audits. Later documentation changes have separate release checks.
  • A clean installation of the published CLI produced FAIL reports for the broken Afterlife example and PASS reports for the corrected version.
  • Hosted synthetic account checks covered registration, delivered verification, password recovery, new-password login and reset-link replay rejection.
  • Actual CLI uploads, idempotency, stored results, comparison, token revocation and rejection of revoked access passed. Temporary synthetic records were removed.
  • Sample verification and recovery messages reached Inbox; the checked verification message passed SPF, DKIM and DMARC. This is not an inbox guarantee for every recipient.
  • A bounded performance exercise completed 114 measured requests without errors: upload p95 461 ms at concurrency two; read p95 274 ms at concurrency three. This is not maximum capacity or an SLA.
  • Notification delivery was observed during a synthetic alert drill. A separate normal health check passed.
  • A real hosted evaluation-form check rejected a synthetic credential and delivered a valid request to the operator's Inbox. Delivery of this sample does not guarantee Inbox placement for other messages.
  • An actual application snapshot was encrypted before off-device storage, then recovered with the separately held key on a fresh hosted runner into disposable PostgreSQL. All application tables matched; restored sessions, pending sign-in links and API tokens were invalidated. No production restore was performed.

Integration evidence

The HTTP proof shows a separate application and background worker, with persistent storage and a network adapter. The vulnerable version recreates deleted information; the corrected version prevents that write. Its displayed reports are captured synthetic runs, not a live customer scan.

The framework and provider examples have specific limits. See the adapter capability matrix. A real framework or datastore does not by itself prove real-model behavior, end-user authentication or compatibility with your production application.

What remains unverified

  • Useful findings, repeat adoption and willingness to pay at an external team.
  • Complete provider recovery/cutover, independent recovery-account custody and recovery-time objectives. The verified remote rehearsal covered application data in isolated PostgreSQL, not all external provider configuration.
  • Maximum capacity, continuous availability, every timing race and retrieval path.
  • SSO, automated organization invitations and an audit-log viewer.

Hosted retention now has a bounded hourly database sweep, including inactive projects. A short installation drill observed actual scheduled successes, then restored the hourly cadence. This is not a deletion-deadline guarantee. The first-application guide includes a standalone download verified against the published CLI; it remains synthetic evidence until a participating external team completes its own sandbox integration and evaluation worksheet.

An evaluation scope must be agreed before any customer work. The free beta is not an availability, recovery or compliance commitment. No subscription checkout or enterprise SLA is offered.