Skip to content
Zenzic Icon
v0.30.0

Deterministic Document Integrity
Engine for Technical Documentation.

Treat your Markdown documentation like production code. Detect broken links, credential leaks, and topological defects before merge.

Get started View on GitHub
100%
Deterministic
0
Subprocesses
O(N)
RE2 Engine
CI/CD
Native Gates
// EXECUTION_LAYER

Pain Point

Documentation drift is silent. Teams usually see it after deployment.

zenzic check all · 0.30.0
✘ SECURITY BREACH DETECTED
✘ Finding: Secret detected (aws-access-key) — rotate immediately.
✘ Location: docs/deploy.md:4
✘ Credential: AKIA************MPLE
Action: Rotate this credential immediately and purge it from the repository history.
standalone • 3 files (2 docs, 1 assets) • 0.0s • 87 files/s
docs/assets/unused.png ⚠ [Z405] File not referenced in any documentation page.
docs/deploy.md:1 ⚠ [Z502] Page has only 6 words (minimum 50).
    1  ❱  # Deploy
    2  │
    3  │  ```bash
docs/index.md:1 ⚠ [Z502] Page has only 18 words (minimum 50).
    1  ❱  # Welcome
    2  │
    3  │  See the [intro page](./intro.md) for details.
docs/index.md:3:8 ✘ [Z104] './intro.md' not found in docs
    1  │  # Welcome
    2  │
    3  ❱  See the [intro page](./intro.md) for details.
       │          ^^^^^^^^^^^^^^^^^^^^^^^^
    4  │
    5  │  ![architecture](./assets/old-diagram.png)
docs/index.md:5 ✘ [Z104] './assets/old-diagram.png' not found in docs
    3  │  See the [intro page](./intro.md) for details.
    4  │
    5  ❱  ![architecture](./assets/old-diagram.png)
       │  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    6  │
    7  │  This project was migrated from **OldPlatform** in Q1 2026.
docs/index.md:7:33⚠[Z601][Z601] Obsolete or unauthorized brand term 'OldPlatform' detected. Use semantic versioning (e.g., 'vX.Y.Z') in active prose, or suppress if this is a historical ledger.
    5  │  ![architecture](./assets/old-diagram.png)
    6  │
    7  ❱  This project was migrated from **OldPlatform** in Q1 2026.
       │                                   ^^^^^^^^^^^
────────────────────────────────────────────────────────────────────────────────
Summary: ✘ 1 security breach ✘ 2 errors ⚠ 4 warnings 💡 0 info • 3 files with findings
FAILED: Hard errors detected. Exit code 1 is mandatory.
Refer to https://zenzic.dev/reference/finding-codes for remediation · Try 'zenzic check --help' for options.
🔒 Suppression Audit: 0/30 (inline: 0, per-file: 0)
Z101
Broken link→
 Z102
Anchor missing→
 Z104
File not found→
 Z105
Malformed URI→
 Z201
Credential leak→
 Z202
Path traversal→
 Z205
Forbidden scheme→
 Z401
Missing index→
 Z402
Orphan page→
 Z405
Unused asset→
 Z501
Empty content→
 Z502
Short content→
 Z505
Invalid frontmatter→
 Z601
Brand obsolescence→
// FAILURE_TOPOLOGY

Reporter & Credentials

Zenzic in Action CI gate blocks regressions before merge.

Every finding is pinned to file, line, and source. Structured output for human eyes and machine parsing alike.

Gutter reporter

Each error shows the exact offending source line with gutter context. No scrolling through logs to find what broke.

docs/guide.md
✘[FILE_NOT_FOUND]'intro.md' not reachable from nav
15│ before continuing.
16❱ See the getting started page for details.
17│ Then configure your environment.

Credential Scanner

Scans every line — including fenced bash and yaml blocks — for leaked credentials. Exit code 2 is reserved exclusively for security events and cannot be suppressed.

SECURITY BREACH DETECTED
✘Finding:GitHub token detected
✘Location:docs/tutorial.md:42
✘Credential:ghp_************3456
Action:Rotate this credential immediately and purge it from the repository history.

Severity summary

Every run ends with a compact summary. You know immediately whether the check failed hard or only emitted warnings.

✘ 2 errors⚠ 1 warning• 1 file with findings
FAILED: One or more checks failed.
// DIAGNOSTIC_OUTPUT

The Zenzic Engineering Ledger

Three invariants enforced on every commit. No exceptions. No shortcuts.

These are not aspirations — they are gates. Every release of Zenzic ships only when all three pass.

01

Zero Assumptions at System Boundaries

Every public entry point validates its inputs at the boundary. Internal hot paths carry no defensive checks — the shape is guaranteed by the type system, enforced by mypy --strict on every merge.

docusaurus.config.ts · adapter run 
# Docusaurus project
uvx zenzic check all .

# Outcome
# exit 0 -> no blocking findings
# exit 1 -> quality gate blocks merge
02

Subprocess-Free Analysis

Production-grade tools do not shell out during analysis. No subprocess.run(), no os.system() inside per-item loops. Zenzic validates your documentation stack without executing it.

mkdocs.yml · adapter run 
# MkDocs project
uvx zenzic check all .

# Same gate semantics as Docusaurus
# deterministic findings, same exit codes
03

Deterministic Dependency Graph

Every dependency is pinned in a lockfile, audited by Dependabot, and scanned for SPDX licence compatibility. No transitive surprises at release time. uv lock and reuse lint run on every commit.

zensical.toml · adapter run 
# Zensical project
uvx zenzic check all .

# Output is machine-readable and human-readable
# for CI and local review
04

Standalone Markdown Repositories

Runs on repositories without a framework-specific adapter by validating Markdown files and internal references directly.

standalone repository · adapter run 
# Plain Markdown repository
uvx zenzic check all docs/

# Use in CI, pre-commit, or local checks
# without changing repository structure
// ADAPTER_SURFACE

Get Started

From zero to documentation integrity in one command.

No configuration required. No account needed. Works on any Markdown project.

zenzic · quickstart
✓ zenzic · python 3.10+ · ready

# run the documentation quality gate

$ uvx zenzic check all

# exit 0: no blocking findings

# exit 1: quality gate blocks merge

Read the full docs → Star on GitHub

Enterprise

Enterprise Governance & Scoring

Track suppression debt, enforce quality policies, and govern documentation health across teams and repositories.

// GOVERNANCE_GATE

Health Metrics

Quality Score Deterministic health check, per commit.

Track a deterministic score in CI to block regressions. A holistic, elegant view of your documentation health.

Metrics
Overall Health
98
+2%
CI Command
zenzic score --save
Internal Links Health
99
Anchor stability
100
External references
97
Orphan Detection
95
Unused Assets
91
Nav Isolation
100
// SUPPRESSION_POLICY

Governance

Suppression CAP — Live Preview

When active suppressions exceed the configured CAP, zenzic-action writes this summary directly to the GitHub Actions job panel. No log diving required.

CAP exceeded — exit 1

✘ Suppression CAP Exceeded +13
Active suppressions 43
CAP limit 30
Excess debt +13
📋 Remediation Playbook →

CAP within limit — exit 0

✔ Suppression CAP — Within Limit
Active suppressions 18
CAP limit 30
Excess debt -12

Home

Core Capabilities

  •   Security Enforcement

    Detects hardcoded credentials (Z201), path traversal (Z202/Z203), and policy violations (Z610/Z611) before they reach production. Non-suppressible security findings exit 2 or 3 — never silenced.

    Security Reference

  •   Topological Graph Analysis

    Virtual Site Map (VSM) builds an adjacency matrix over your document network — detecting orphaned pages, dead-end nodes, and broken cross-file links via Breadth-First Search.

    Graph Analysis

  •   Policy-as-Code Engine

    Declarative [policies] rules enforce governance constraints across every file — required/forbidden frontmatter (Z610–Z613), Zero-Trust external link whitelisting (Z614), URL scheme enforcement (Z615), and Cross-Namespace topological boundaries via the Virtual Site Map (Z616).

    Policy Configuration

Why Zenzic?

Zenzic provides a deterministic quality architecture for your documentation suite, with no probabilistic models or LLM dependencies.

100% Determinism and Baseline Tracking

Every Zenzic run is a pure function of its inputs. Given the same repository state and .zenzic.toml, the output — finding codes, severity levels, exit code, SARIF structure — is bit-for-bit identical across machines, platforms, and time.

With Baseline and Regression Tracking, existing technical debt can be recorded into a deterministic snapshot (.zenzic-baseline.json) via --update-baseline. Subsequent CI runs validate against --baseline .zenzic-baseline.json using line-shift invariant SHA-256 signatures, tagging baselined findings without dropping them (Radical Unawareness) and enforcing Document Quality Score (DQS) anti-regression rules.

Documentation as a Security Surface

Zenzic treats documentation as a security surface. The tiered code model enforces a hard boundary between quality findings (suppressible, exit 1) and security findings (non-suppressible, exit 2/3):

  • Z201 — Credential Scanner: Hardcoded tokens, API keys, and secret patterns detected before reaching PRs.
  • Z202 / Z203 — Path Traversal Guard: Filesystem boundary security violations caught at scan boundaries.
  • Suppression CAP: Configurable ceiling on total active zenzic:ignore suppressions.

Semantic Linting and Readability Metrics

Evaluate content quality without relying on probabilistic models or LLMs:

  • Z510 — Heading Hierarchy: Detects skipped heading levels (e.g. H3 directly following H1).
  • Z511 — Excessive Sentence Length: Enforces maximum sentence word count (max_sentence_length = 40).
  • Z512 — Empty Section: Identifies heading sections containing no prose content before the next heading or EOF.

Beyond static link checks, Zenzic's Smart Link Graph constructs an adjacency matrix over your document network to perform Breadth-First Search (BFS):

  • Z410 — Unreachable Graph Node: Documents completely isolated or unreachable from navigation entry points.
  • Z411 — Dead-End Node: Documentation pages containing no outgoing links.

Configuration Validation Engine

Formal schema validation for .zenzic.toml (Z110 TOML syntax errors, Z111 schema type mismatches) with exact line-number extraction. Fatal config errors halt document graph scanning to prevent false-positive cascades and protect LSP stability.

.zenzic.toml

[engine]
# Validation prevents bad config execution
max_sentence_length = "40" # Z111: Expected int, got str

[policies]
disallowed_domains = ["example.com"]

Quickstart

Or run directly with no installation:

uvx zenzic check all

Ecosystem Delivery

Zenzic is structured into three dedicated delivery mechanisms to support your entire development workflow:

  •   Core Engine (CLI)

    Python CLI with AST rule engine, Virtual Site Map topology analyzer, Policy-as-Code Engine, Custom Rule SDK v3, and Audit Mode.

    CLI Reference

  •   GitHub Action

    Zero-setup CI/CD quality gate with SARIF upload, PR annotations, and Sovereign Audit mode. Pin the Core version for reproducible gates.

    GitHub Action Reference

  •   VS Code Extension

    Real-time LSP client delivering sub-50ms inline diagnostics, Policy-as-Code findings (Z610/Z611), Quick Fixes, and DQS scoring.

    Extension Guide