Zen Mesh FAQ

Name: Zen Mesh public AI evidence manifests
Creator: Zen Mesh

Question 1

How does Zen Mesh deliver webhooks to private networks without opening inbound ports?

Accepted Answer

Zen Mesh uses an outbound-only Edge Plane. The zen-agent in your network establishes an outbound connection to Zen Mesh, then receives delivery over that persistent tunnel. No inbound firewall rules, no VPN, no reverse proxy.

Question 2

What security controls protect webhook delivery?

Accepted Answer

mTLS, SPIFFE/SPIRE workload identity, and HMAC payload verification on every data-plane path. External provider webhooks use provider-specific signature verification at ingress. See the security documentation for the full model.

Question 3

Can I use Zen Mesh with Kubernetes?

Accepted Answer

Yes. Deploy the zen-agent as a Helm chart on your cluster. The Edge Plane integrates with Kubernetes and supports zen-egress for delivering to services behind NAT or firewall.

Question 4

Which webhook sources does Zen Mesh support?

Accepted Answer

Stripe, GitHub, Twilio, Shopify, and any custom HTTP webhook source. Zen Mesh validates signatures from supported providers and provides signature verification guidance for custom sources.

Question 5

Is Zen Mesh production-ready?

Accepted Answer

Individual capabilities carry per-item status (WIRED, AUTOMATED_TESTED, etc.) documented in the evidence system. Review the Current Status page for per-capability maturity. Zen Mesh does not claim production-live availability as a global platform.

Question 6

What is the pricing model?

Accepted Answer

Free Forever tier available. Pro Early Bird with 6-month free trial. See zen-mesh.io/pricing for details.

Field	Value
Provider	Twilio
Validation date	`<!-- DATE-YYYY-MM-DD -->`
Cloud endpoint	`<!-- CLOUD-ENDPOINT-URL -->`
Twilio Account SID	`AC<!-- ... -->`
Twilio phone number	`+1<!-- ... -->`
Validator	`<!-- NAME -->`
Platform version	`<!-- COMMIT-SHA or VERSION -->`
Overall result	`PASS` / `FAIL`

Check	Result	Evidence ref
SMS sent to Twilio number	`PASS` / `FAIL`	`twilio-post-cloud-YYYYMMDD/delivery-log.json`
Delivery status = delivered	`PASS` / `FAIL`	`twilio-post-cloud-YYYYMMDD/delivery-log.json`
Event type = incoming_message	`PASS` / `FAIL`	`twilio-post-cloud-YYYYMMDD/delivery-log.json`
Timestamp within 60s of SMS	`PASS` / `FAIL`	`twilio-post-cloud-YYYYMMDD/delivery-log.json`
Status callback delivered (if applicable)	`PASS` / `FAIL` / `N/A`	`twilio-post-cloud-YYYYMMDD/delivery-log.json`

Check	Result	Evidence ref
X-Twilio-Signature header present	`PASS` / `FAIL`	`twilio-post-cloud-YYYYMMDD/validation-evidence.json`
Platform signature verification = valid	`PASS` / `FAIL`	`twilio-post-cloud-YYYYMMDD/validation-evidence.json`
Manual re-verification matches	`PASS` / `FAIL`	`twilio-post-cloud-YYYYMMDD/manual-verify-output.json`
Request URL matches configured URL	`PASS` / `FAIL`	`twilio-post-cloud-YYYYMMDD/validation-evidence.json`

Test	Expected	Actual	Evidence ref
Invalid X-Twilio-Signature	`401` / `403`	`<!-- STATUS -->`	`twilio-post-cloud-YYYYMMDD/negative-invalid-sig.json`
Missing X-Twilio-Signature	`401`	`<!-- STATUS -->`	`twilio-post-cloud-YYYYMMDD/negative-missing-sig.json`
Invalid content type (JSON instead of form)	`400`	`<!-- STATUS -->`	`twilio-post-cloud-YYYYMMDD/negative-invalid-content-type.json`

Twilio Live Validation Evidence Template

Metadata

Positive Test — Inbound SMS Webhook

Signature Validation

Negative Tests

Artifacts

Claim Guard Check

Metadata​

Positive Test — Inbound SMS Webhook​

Signature Validation​

Negative Tests​

Artifacts​

Claim Guard Check​