Zain Dana Harperauthorized private practice

Operational security systems, described by what they do.

Array, Seed, Sofer, Isomorph, Bounds, Kun, ORCA, and Gate are separate systems for campaign control, native assessment, orchestration, AI red-team testing, trust verification, access recovery, execution, and release authority.

Written authorization first. Targets, credentials, live payloads, client data, and engagement-specific findings remain in the authorized environment.

eight distinct private systems · source roles checked 2026-08-28

Eight-system index.

Seed native security-assessment engine · controlled-private · definition and evidence on the product page
Array authorized offensive campaign orchestrator · controlled-private · definition and evidence on the product page
Sofer private-line orchestration suite · controlled-private · definition and evidence on the product page
Isomorph AI inference-boundary red-team harness · controlled-private · definition and evidence on the product page
Bounds agent, runtime, and release trust verifier · controlled-private · definition and evidence on the product page
Kun local access-recovery vault · controlled-private · definition and evidence on the product page
ORCA ORCA runs private-line assessments by managing engagement state, executing descriptor-backed modules, cataloging findings and artifacts, producing reports and portable bundles, and recording release provenance.
Gate Gate is Sofer's private release-check subsystem. Its Python command-line tools validate readiness, operations, engagement, deliverable, and release manifests; required source, documentation, and test paths; configured controls; and verification-command results. Gate returns pass or fail findings, writes hashed JSON receipts, and blocks advancement when required evidence or controls are missing.

Shared engagement boundary.

Purpose Navigate eight distinct products whose campaign, assessment, orchestration, model-testing, trust, recovery, runtime, and release responsibilities stay explicit. Shared engagements do not make them one product.
Problem High-consequence work requires real operational tooling and a record that preserves authority, execution state, findings, cleanup, provenance, and release decisions.
Components Campaign control, native assessment modules, specialist-agent orchestration, inference-boundary testing, trust sensors, operator runtime, release verification, and verifiable ledgers.
Bounded workflow Define the authority, define the surface, run only within that surface, record the result, and stop when the written scope ends.
Intended users Lawful organizations that need disciplined adversarial evaluation, sensitive-system review, market-risk tooling review, or high-assurance technical evidence.
Testing approach Native test suites, synthetic fixtures, deterministic replay, digest-sealed plans, time-limited approval, containment monitors, artifact hashes, runtime sensors, and release proof chains.
Non-sensitive deployment model Run inside the authorized environment or as an offline review packet. Public material excludes protected infrastructure, counterparties, and environment facts.
Limitations No public release, no public source, no public walkthrough, and no claim that any system is accepted by a third party.
Engagement boundary A written scope and lawful authority are prerequisites. A request without those facts receives only public material.

Contact route.

For work that fits this boundary, start with the public hiring map or email. State the role, the lawful basis, and the review objective at a high level.