Source & deployment policy — bRRAIn Docs

How bRRAIn source code is protected and how all deployable artifacts reach you.

Source & deployment policy

This page is the canonical statement of how bRRAIn protects its source and how every artifact you receive — the brain release, marketplace extensions, the Platform SDK, content packs — gets to you.

Source code is private

The bRRAIn source repository at Qosil/bRRAIn is and will always remain private. This isn't a temporary state — it's the policy.

What this means:

  • We do not publish the platform source.
  • We do not accept public pull requests against the platform repository.
  • Customer contracts, support relationships, and partner agreements do not grant source access except under narrow, contracted source-escrow arrangements for qualifying Enterprise and Sovereign-Cloud customers.
  • Open-source dependencies remain licensed by their respective licenses; we comply with their attribution and redistribution requirements.

What this protects:

  • The integrity of the platform — no fork divergence, no impersonation of bRRAIn binaries.
  • The investment we and our customers have made in bRRAIn's differentiation.
  • Customers' security posture — proprietary defenses that would be diluted by public source.

All deployable artifacts ship from our servers

Every artifact you receive ships from infrastructure bRRAIn controls, not from a public package registry.

  • The brain release is a single Linux amd64 tarball (brrain-handler-<version>.tar.gz) on bRRAIn-controlled object storage, described by a release manifest. The installer (curl -fsSL https://install.brrain.io | sh) and brrain upgrade fetch it. Hosted pods install the same artifact.
  • Marketplace extension tarballs ship from bRRAIn's deployment storage and are fetched by your brain when an extension is installed or updated.
  • The Platform SDK (github.com/Qosil/bRRAIn/pkg/platform-sdk) is in the private bRRAIn repository. Access comes with a developer seat; it is not on a public Go module proxy.
  • Content packs (Exchange purchases) ship through bRRAIn's deployment storage.

There is no public container image, Helm chart, Kubernetes operator or Terraform module for bRRAIn. Anything presented as one did not come from us.

Why we don't use public registries

Public package registries are convenient but they introduce risks:

  • Supply-chain attacks. Compromise of a public registry can introduce malicious artifacts into customer environments.
  • Typosquatting. Public registries are full of look-alike packages. Not being on one removes that path.
  • Availability and policy dependence. Public registries have outages and can change policy or delete artifacts.

How releases are verified

Each brain release has a manifest that names the version, the artifact URL, the artifact's SHA-256 digest and the minimum version it can be upgraded from. The installer and brrain upgrade:

  • refuse a manifest that has no digest;
  • download the tarball and compare its SHA-256 with the manifest, refusing to install on a mismatch;
  • check that the extracted release contains the brrain binary, the Handler's Modelfile and the continuity templates before swapping anything in;
  • keep the previous release for brrain upgrade -rollback.

You can check a release yourself without installing it:

curl -fsSL https://install.brrain.io | sudo sh -s -- --check   # installed vs available (needs root)
sudo brrain upgrade -dry-run                              # what would be downloaded, verified and replaced

Never work around a checksum mismatch; report it (below).

What you can share publicly

You're welcome to share:

  • That you use bRRAIn.
  • Case studies, blog posts, conference talks about your bRRAIn deployment.
  • bRRAIn-issued certifications.
  • Verification chips you've issued from your bRRAInUserID.

You should not share:

  • The contents of any bRRAIn release, extension or SDK source outside your organization.
  • Internal documentation, runbooks, or other materials we provide that are marked confidential.
  • Configuration secrets that grant access to our distribution endpoints.

What we share publicly

Everything user-facing — these docs, the website, the marketplace catalog descriptions, the partner program terms, the certification curriculum syllabi, the bR2bR open standard, the API surface documented here.

The implementation behind the user-facing surface stays private.

Open standards we publish

While the platform source is private, we publish open standards that the broader ecosystem can build against:

  • bR2bR — the bRRAIn-to-bRRAIn open standard for cross-organization memory queries with cryptographic provenance.
  • bRRAIn Platform SDK contract — the interface marketplace extensions and SDK callers use to talk to a brain pod.
  • Documentation conventions — the structure of this docs site.

Open standards are versioned, freely usable, and contributed to as appropriate community standards.

Compliance considerations

This page describes how artifacts are distributed and verified. It does not assert any third-party certification or attestation. For questions about a specific framework, ask bRRAIn; answers that matter to your contract belong in your contract.

Reporting suspected compromise

If you ever suspect:

  • An artifact you received has been tampered with.
  • A download location or manifest has changed without prior notice.
  • The installer or brrain upgrade reports a SHA-256 mismatch.

Contact security@brrain.io immediately. Our standard response includes invalidating any potentially-compromised distribution channel, issuing fresh artifacts, and telling affected customers.

Where to next