The architectural change was larger than adding a password prompt. An encrypted archive needs a clear answer to when its contents become trusted, where temporary plaintext may exist, and what happens when resources run out or publication fails.
CIPHERGLASS authenticates the complete encrypted envelope before interpreting the inner archive. Authentication and native archive integrity are reported separately. Plain creation refuses to overwrite an encrypted archive, preserving the user's existing protection. These are useful questions to ask of any protected archival workflow: what is concealed, what is verified, and what can an operation change?
CIPHERGLASS qualified on Linux with 145 of 145 native tests passing, and a separately written C reference and the native implementation read each other's encrypted envelopes and recovered the expected inner bytes.
The public release boundary
Qualification
CIPHERGLASS qualified on September 5, 2026.
Distribution
Its first public distribution is inside 1.28.0 LOCKWIRE, released September 6, 2026.
Public proof
Product facts and qualification counts are free in the source note.
Included in this edition
Everything below is part of the article itself unless it says otherwise. No software, repository access, or product license is included.
Qualification matrix
Table in the article
Six decisions and the retained evidence behind each.
Independent format cross-reading analysis
Written record in the article
The in-article evidence progression from passing local tests to reference/native cross-reading.
Resource and publication decision framework
Written record in the article
The in-article analysis of fixed-cost admission, temporary plaintext, publication, durability and cleanup as separate operating decisions.
CIPHERGLASS in context
ZJX 1.27 CIPHERGLASS
ZJX 1.27 CIPHERGLASS added native passphrase-protected archives, including encrypted internal filenames and metadata. It qualified on September 5, 2026, and reached users for the first time inside 1.28.0 LOCKWIRE on September 6. Current release record.
The architectural change was larger than adding a password prompt. An encrypted archive needs a clear answer to when its contents become trusted, where temporary plaintext may exist, and what happens when resources run out or publication fails.
CIPHERGLASS authenticates the complete encrypted envelope before interpreting the inner archive. Authentication and native archive integrity are reported separately. Plain creation refuses to overwrite an encrypted archive, preserving the user's existing protection. These are useful questions to ask of any protected archival workflow: what is concealed, what is verified, and what can an operation change? Product contract.
The qualification is in the public record: 145 of 145 native tests passed on Linux, and a separately written C reference and the native implementation read each other's encrypted envelopes and recovered the expected inner bytes.
The full engineering edition follows the evidence that turned those promises into a qualified product: independent format cross-reading, separate resource and publication decisions, the difference between a reviewed path and a directly tested one, and a reusable qualification matrix. It builds on 1.26 RELICWIRE, with the analysis grounded in the CIPHERGLASS record rather than a generic encryption checklist.
Edition
Encrypted-archive engineering edition 1.0
Published
Updated
No update recorded
Reading time
7 minutes
Full edition
1,681 words
Article status
Current record
Who this is for
Archive and storage engineers evaluating the confidentiality and restoration contract.
Builders designing qualification gates for protected data workflows.
Not for
Readers seeking ZJX source code or throughput benchmarks.
Detailed contents
01
Make the protected object complete
02
Two answers behind a successful check
03
The disk is inside the operating contract
04
A smaller budget must not buy weaker protection
05
Preserve the user's existing decision
06
The gate beyond local tests
07
A qualification matrix another builder can use
08
What CIPHERGLASS made possible
Evidence and method
historical: Synthesis of the retained CIPHERGLASS qualification record and current public product and release documentation.
