CanaryGuardRelease governance

System design

CanaryGuard architecture

CanaryGuard collects GitHub evidence through verified webhooks and limited API requests. Deterministic policy makes the release decision; AI analysis is advisory. PostgreSQL stores release records, access permissions, evidence, deployment outcomes, and customer requests.

Release path

How a release is reviewed and recorded.

  1. 01

    Verified input

    Webhook signatures, commit matching, repository grants, and input validation identify the request and its release.

  2. 02

    Normalized evidence

    CI, vulnerability, secret, accessibility, exposure, and agent-policy adapters emit limited versioned facts.

  3. 03

    Deterministic policy

    Hard-coded controls select BLOCK, CANARY, or CONTINUE after advisory risk analysis.

  4. 04

    Observed outcome

    Deployment attempts, traffic observations, promotion or rollback, and prediction accuracy share one release identity.

  5. 05

    Customer requests

    The public form creates a customer request. An administrator reviews it before any contract, payment, or tenant setup.