REPLAY THE EVENT
Repeated delivery. One identity.
Exact-body HMAC validation and transactional deduplication protect workflow evidence. Terminal attempts are immutable; a late queued event cannot overwrite completion.
Read the concurrency tests ↗CI INTELLIGENCE / DEPLOY SAFETY / RUST + PYTHON + REACT
Trust the release.
Keep the reasons.
A release decision should survive a replayed event, a crashed controller, and a valid signature on an unsafe artifact.
Recorded evidenceThis Vercel page presents saved local runs and a real console
recording. Interactive release operations run in the repository’s
persistent local stack.
G / RELEASE REVIEW OFFICE
RECORDED
EVIDENCE
EVIDENCE
Inspect the decision.
Keep the reasons.
01 / A DECISION NEEDS EVIDENCE
Inspect the raw measurements ↗Synthetic injection accuracy, metadata-fixture vulnerability scans, and actual local HTTP services. These results do not establish production scale, public flake accuracy, or hosted backend availability.
The route changes. Then we ask it again.
Actual HTTP, durable state| Candidate | Controller decision | Proxy route afterward | Observed value |
|---|
The proxy reads the committed route for each new request. In-flight requests can finish on the old upstream. This is a single-host demonstration, without a distributed lease.
CHECK THE SIGNATURE, THEN THE POLICY
Signed does not mean approved.
The fixture contains package metadata. Vulnerable library code is not installed. Local-key integrity does not establish trusted builder provenance.
KEEP THE SCOPE VISIBLE
Measure what the labels support.
Public signature examples are selected, related and small. Quarantine is an expiring proposal, not a root-cause diagnosis or automatic CI mutation.
02 / WATCH THE SYSTEM WORK
Bad candidate. Rollback. Evidence retained.
The authenticated React console switches real synthetic HTTP upstreams, verifies the signed vulnerability report, inspects public CI excerpts and reloads committed state.
03 / FOLLOW THE BOUNDARIES
Signed workflow→Python API→SQLite + fenced epoch→Actual HTTP proxy
Inspectable decisions
Comparable test history, normalized signatures and Terraform reverse dependency reach. Findings explain rules and affected addresses instead of inventing an outage probability.
Bound evidence bytes
The Rust CLI verifies Ed25519 signatures, commit and artifact/SBOM/scan digests, expiry and severity. Altered bytes fail even when the signature is unchanged.
Recover, then serve
Startup restores an interrupted rollout to the last approved service and advances its epoch. A former controller cannot overwrite that recovery.