Zen Mesh FAQ

Name: Zen Mesh public AI evidence manifests
Creator: Zen Mesh

Question 1

How does Zen Mesh deliver webhooks to private networks without opening inbound ports?

Accepted Answer

Zen Mesh uses an outbound-only Edge Plane. The zen-agent in your network establishes an outbound connection to Zen Mesh, then receives delivery over that persistent tunnel. No inbound firewall rules, no VPN, no reverse proxy.

Question 2

What security controls protect webhook delivery?

Accepted Answer

mTLS, SPIFFE/SPIRE workload identity, and HMAC payload verification on every data-plane path. External provider webhooks use provider-specific signature verification at ingress. See the security documentation for the full model.

Question 3

Can I use Zen Mesh with Kubernetes?

Accepted Answer

Yes. Deploy the zen-agent as a Helm chart on your cluster. The Edge Plane integrates with Kubernetes and supports zen-egress for delivering to services behind NAT or firewall.

Question 4

Which webhook sources does Zen Mesh support?

Accepted Answer

Stripe, GitHub, Twilio, Shopify, and any custom HTTP webhook source. Zen Mesh validates signatures from supported providers and provides signature verification guidance for custom sources.

Question 5

Is Zen Mesh production-ready?

Accepted Answer

Individual capabilities carry per-item status (WIRED, AUTOMATED_TESTED, etc.) documented in the evidence system. Review the Current Status page for per-capability maturity. Zen Mesh does not claim production-live availability as a global platform.

Question 6

What is the pricing model?

Accepted Answer

Free Forever tier available. Pro Early Bird with 6-month free trial. See zen-mesh.io/pricing for details.

Field	Value
Provider	Shopify
Validation date	`<!-- DATE-YYYY-MM-DD -->`
Cloud endpoint	`<!-- CLOUD-ENDPOINT-URL -->`
Shopify store	`<!-- STORE-NAME -->`
Shopify API version	`2024-01`
Validator	`<!-- NAME -->`
Platform version	`<!-- COMMIT-SHA or VERSION -->`
HMAC enforcement deployed?	`YES` / `NO`
Overall result	`PASS` / `FAIL`

Check	Result	Evidence ref
Event triggered via Admin API	`PASS` / `FAIL`	`shopify-post-cloud-YYYYMMDD/delivery-log.json`
Delivery status = delivered	`PASS` / `FAIL`	`shopify-post-cloud-YYYYMMDD/delivery-log.json`
Event topic matches triggered event	`PASS` / `FAIL`	`shopify-post-cloud-YYYYMMDD/delivery-log.json`
Timestamp within 60s of trigger	`PASS` / `FAIL`	`shopify-post-cloud-YYYYMMDD/delivery-log.json`

Check	Result	Evidence ref
X-Shopify-Hmac-SHA256 header present	`PASS` / `FAIL`	`shopify-post-cloud-YYYYMMDD/validation-evidence.json`
Platform signature verification = valid	`PASS` / `FAIL`	`shopify-post-cloud-YYYYMMDD/validation-evidence.json`
Manual re-verification matches	`PASS` / `FAIL`	`shopify-post-cloud-YYYYMMDD/manual-verify-output.json`
X-Shopify-Shop-Domain matches	`PASS` / `FAIL`	`shopify-post-cloud-YYYYMMDD/validation-evidence.json`

Test	Expected	Actual	Evidence ref
Invalid HMAC signature	`401` / `403`	`<!-- STATUS -->`	`shopify-post-cloud-YYYYMMDD/negative-invalid-sig.json`
Missing signature (if enforced)	`401`	`<!-- STATUS -->`	`shopify-post-cloud-YYYYMMDD/negative-missing-sig.json`
Unknown event topic	graceful	`<!-- RESULT -->`	`shopify-post-cloud-YYYYMMDD/negative-unknown-topic.json`

Shopify Live Validation Evidence Template

Metadata

Positive Test — Webhook Delivery

Signature Validation

Negative Tests

Artifacts

Claim Guard Check

Metadata​

Positive Test — Webhook Delivery​

Signature Validation​

Negative Tests​

Artifacts​

Claim Guard Check​