Release Evidence
Release Evidence
Section titled “Release Evidence”Release evidence is the operator-facing proof that a V1 gateway package can be installed, upgraded, rolled back, and reviewed without secret-bearing artifacts. It ties Helm, Cosign, SBOM, provenance, backup/restore, upgrade/drain, rollback, checksums, release notes, and no-secret scans into one metadata-only record.
Audience
Section titled “Audience”- Release owners preparing a V1 release candidate.
- Operators checking upgrade and rollback readiness.
- Security reviewers checking artifact policy and no-secret gates.
- Platform teams validating managed or self-hosted evidence.
What is this?
Section titled “What is this?”This page explains the public release-evidence workflow. The machine contracts are the M8 release evidence bundle and the M9 release-candidate evidence manifest. The docs site should explain required fields and failure modes; it should not publish generated bundles unless they are intentionally curated for public release.
When do I use it?
Section titled “When do I use it?”Use it before publishing a release candidate, accepting a managed or self-hosted deployment handoff, or changing docs that mention package integrity, rollback, or no-secret posture.
What happens?
Section titled “What happens?”- The release record names the source repository, source ref, source revision, package version, and release-candidate bundle.
- Package artifacts link Helm chart, release notes, checksum manifest, image or chart digests, Cosign verification, SBOM, and SLSA-style provenance.
- The M8 compatibility check links self-hosted readiness, release evidence bundle validation, backup/restore report, and upgrade/drain report.
- The upgrade/drain path proves new stateful sessions are denied during drain, active sessions complete or terminate by timeout, readiness gates pass before traffic cutover, and rollback boundaries are known.
- The artifact policy confirms metadata-only records and false for secrets, credentials, raw tokens, prompts, tool payloads, request bodies, response bodies, and customer data.
- No-secret scan result is a release blocker when it does not pass.
Required evidence
Section titled “Required evidence”| Evidence area | Required proof |
|---|---|
| Helm | Chart renders with install diagnostics and hardening defaults. |
| Cosign | Signature verification, certificate identity, OIDC issuer, transparency log, and transcript digest. |
| SBOM | SPDX or CycloneDX artifact with digest and generator. |
| Provenance | Builder, build type, source repo, source ref, source digest, and materials. |
| Backup/restore | Metadata counts, restore target, post-restore governed call, audit event, no-secret scan. |
| Upgrade/drain | Drain start, new-session denial, drain timeout, readiness result, rollback behavior, audit events. |
| Release notes/checksums | Package artifacts with digests. |
| No-secret scan | Pass result with forbidden classes checked. |
What can go wrong?
Section titled “What can go wrong?”- A release package records customer data, prompts, payloads, request bodies, response bodies, raw tokens, credentials, or secret material.
- The M9 manifest claims M8 compatibility without validating the M8 release evidence bundle.
- Upgrade starts without drain timeout or active-session lookup through PostgreSQL and Valkey.
- Rollback is described without a previous Helm revision or readiness boundary.
- Generated
release/or report output is committed by accident when it is not the deliverable. - Docs describe certified air-gapped packaging, Terraform modules, or a Kubernetes operator as V1 defaults. Those need source before publication.
Source truth
Section titled “Source truth”- contracts/jsonschema/release-evidence-bundle.schema.json
- contracts/jsonschema/release-candidate-evidence.schema.json
- Read Managed and Self-Hosted for deployment posture.
- Read Sessions and Revocation for drain behavior.
- Read Security Review for the hardening and no-secret gate.
Type set in Geist, Source Serif 4, and Departure Mono.