Claim
CI builds and tests on GitHub-hosted runners and, for main only, signs a manifest of the tested image digests with Sigstore; the deploy refuses, before changing anything, any release whose signature, signing workflow, repository, branch, runner, trigger, commit or image digests do not match, using a verifier pinned outside the release.
Status
- implemented
- Capped at Implemented: the code, tests and records are private, so this is self-reported and cannot be verified publicly.
- lab
- Local machine, local clusters or CI runners.
- personal lab
- My own projects. Public repositories carry CI-verified evidence; private ones are self-reported.
Source
A personal project whose repository is private and cannot be published. So this claim is self-reported: it stops at Implemented and links to no artifacts.
Limitations
- LIMITNot yet deployed; the deploy path was exercised against a local registry with a stand-in verifier, and the verifier itself against a virtual Sigstore.
- LIMITThe host's statement of which images it runs is not independently attested.
- Source: private repository. The design is in ADR-0015.
Related claims
Implemented·environment:LabSelf-reported · private source
A Go service receives one record per request from nginx over a Unix datagram socket, aggregates them per minute into exact SLI counts and mergeable exponential histograms in SQLite, and counts records lost in transit against nginx's own request counter. A lab burst of 200,000 requests showed the loss accounting exact (1,603 missing records counted, 1,603 send failures logged by nginx) and, after tuning the socket queue, no loss in three runs.
Observability·Personal lab · no public artifactsEvidence →
Implemented·environment:DeployedSelf-reported · private source
This site deploys only commits on main whose CI passed, by pinning the tested image digests, health-checking the release and rolling back automatically; production is then checked from the internet with the full end-to-end suite.
CI/CD·Personal lab · no public artifactsEvidence →