Status · what is and isn’t live
Honest status — spec, implementation, and the service that doesn’t exist yet.
KYE Protocol™ has two halves: an open contract (specs, schemas, OpenAPI, conformance pack) and a reference implementation (Gateway, SDKs, runtime libs). Both are real and verifiable today. A hosted service — the KYE Cloud Gateway™ — is on the v1.1 commercial track and does not run today.
What’s actually live and verifiable today
The contract and the reference build — measured, not aspirational.
These numbers are real. Run
npx kye-conformance run against the reference Gateway to reproduce them on your own machine. The public mirror packages live under the KYE-Protocol GitHub organisation.
| Component | Status | Reproduce (public mirror) |
|---|---|---|
| v1.0 contract (spec) | frozen · 58 v1.0 normative profiles | published in the public mirror repos |
| JSON Schemas | 69 / 69 validate against examples | git clone https://github.com/KYE-Protocol/schemas && cd schemas && npm ci && npm test |
| OpenAPI | 193 operations across Core / Payments / Extensions, redocly-clean | git clone https://github.com/KYE-Protocol/openapi && cd openapi && npm ci && npm run lint |
| Conformance pack | 41 / 41 black-box scenarios pass | git clone https://github.com/KYE-Protocol/conformance && cd conformance && npm ci && npm run run |
| KYE Reference Gateway™ | 201 / 201 unit + integration tests pass | commercial reference implementation — procurement pack |
| SDK (TypeScript) | 67 / 67 tests | git clone https://github.com/KYE-Protocol/sdk-typescript && cd sdk-typescript && npm ci && npm test |
| SDK (Python) | 51 passed, 2 skipped (async/network) | git clone https://github.com/KYE-Protocol/sdk-python && cd sdk-python && python3 -m pip install -e . && pytest -q |
| SDK (Go) | core surface pass | git clone https://github.com/KYE-Protocol/sdk-go && cd sdk-go && go test ./... |
| Control mappings | 266 across 13 horizontal frameworks | published in the conformance mirror; full register in the procurement pack |
| Trademark audit | 0 gaps across 53 pages × 40 marks | node scripts/audit-trademarks.mjs |
| Patent-safety scan | clean (no positive-form mechanism in public/) | bash scripts/patent-safety-scan.sh |
| Consistency audit | 0 drifts across 53 pages | node scripts/audit-consistency.mjs |
The contract is bank-grade and frozen. The reference implementation is pilot-grade — correctness-first, not throughput-tuned. Production deployments substitute a hardened build behind the same contract.
What is NOT live today
No hosted service. No measured uptime. No production deployments.
- Hosted KYE Cloud Gateway™ service — not running. The reference Gateway runs on your machine via
docker run -p 4000:4000 ghcr.io/kye-protocol/gateway:v1.0. The hosted commercial offering is on the v1.1 track. - Live measured uptime / latency / throughput — none. The targets in the SLA tier table below are the commitments a KYE™-bearing service operates under once deployed; they are not historical performance.
- Tier-1 bank deployments — none yet. “Tier-1 readiness hardening” is the v1.0.x roadmap track (CI supply-chain, governance docs, Gateway runtime hardening, signing-suite construction) — not a present-tense claim. See roadmap →
- Public adopter logos / customer references — none yet. References will land here when each Customer publishes their own. See the engagement model.
- L3 KYE Conformant™ / L4 KYE Certified™ programmes — in development; open with v1.1. L1 KYE Self-Tested™ + L2 KYE Self-Attested™ available today.
- KYE Authority Wallet Pro™ (the production Wallet with real Gateway integration + push approvals) — v1.1 commercial track. The Authority Wallet Demo™ source is built; APK build pending Google Play Console access.
Availability targets per tier (future commitments).
| Tier | Availability target | Eligibility | Service credit on miss |
|---|---|---|---|
| Standard | 99.9% per calendar month | Default tier | 10% → 50% scaling with miss size |
| Enterprise | 99.95% per calendar month | Deployments operating regulated profiles (payments high-assurance, federation, healthcare, treasury) | 15% → 50% |
| Mission-critical | 99.99% per calendar month | Direct-engagement deployments with named scope, dedicated capacity, quarterly drill cadence | 20% → 75% |
These are the SLA tiers defined in the customer-SLA template that ships with the procurement pack under NDA. Once a deployment runs in production for KYE Protocol™ Ltd., availability will be measured at the Customer’s nearest region by a synthetic monitor and published here. No measured uptime to publish yet — these are the contractual targets, not historical performance.
RTO / RPO per component.
| Component | Tier | RTO | RPO |
|---|---|---|---|
| Gateway / PDP | 1 (Critical) | 5 min | 0 |
| Entity / delegation registry | 1 (Critical) | 15 min | ≤ 5 min |
| Audit ledger | 1 (Critical) | 60 min | 0 (synchronous replication) |
| Signal stream | 2 (High) | 15 min | ≤ 5 min |
| Transparency service | 2 (High) | 4 h | 0 (rebuildable from audit) |
| ePDP cache distribution | 3 (Standard) | 8 h | 0 (rebuildable) |
| Conformance reporting | 3 (Standard) | 24 h | 24 h |
Quarterly tabletop + annual live failover exercise required by the disaster-recovery runbook (delivered with the procurement pack under NDA).
Sev-0 to Sev-3.
| Severity | Trigger | Customer notify | Status updates | Resolution target |
|---|---|---|---|---|
| Sev-0 | Full outage / data breach | ≤ 30 min | Every 60 min | 4 h mitigation, 7 d permanent fix |
| Sev-1 | Major component degraded / regulator-notifiable | ≤ 60 min | Every 2 h | 8 h mitigation, 14 d permanent fix |
| Sev-2 | Single tenant or feature impacted | ≤ 4 h | Every 4 business hours | 24 h mitigation, 30 d permanent fix |
| Sev-3 | Cosmetic / minor | ≤ 1 business day | Daily | Best effort |
Sev-0 and Sev-1 trigger the regulatory notification path defined in the incident-response runbook (DORA Art. 19, GDPR Art. 33, PSD2 Art. 96, HIPAA §164.408). Full incident-response runbook is delivered with the procurement pack under NDA.
When and how Customers hear about an incident.
- Initial declaration. Within the per-severity window above, the Comms lead posts to the public status page (this page, when live) and emails the named technical contacts on the Customer's account.
- Status updates. Posted on the published cadence until resolution; every update carries a current state, an explicit ETA when known, and any required Customer action.
- Resolution. Marked “resolved” when synthetic monitors return to within SLA bounds for the dwell window; a post-mortem is published within 14 days for Sev-0 / Sev-1 events.
- Service credits. Customers claim credits within 30 days of month-end per the SLA §5 in the procurement pack; credit is applied to the next invoice.
Channels.
Ready to see your AI agents flagged?
Start in shadow mode. We’ll deliver your first Evidence Pack™ in 4–8 weeks.