Phase 9 · Portfolio case study
CanaryGuard case study
A release-governance system that correlates a verified pull request, bounded CI and security evidence, a structured GitHub Check Run, deterministic policy, deployment observations, and the final outcome under one release identity.
Problem statement
Release evidence was fragmented; authority was ambiguous.
CanaryGuard normalizes evidence without ingesting raw logs, keeps model analysis advisory, and makes deterministic policy the final authority.
Verified intake
Signed GitHub webhooks, replay protection, exact repository grants, and head-SHA correlation establish identity.
Bounded evidence
CI, vulnerability, secret, accessibility, exposure, and agent-policy facts are normalized with strict size limits.
Deterministic policy authority
Failed CI and critical findings block. Higher uncertainty selects a canary. Low risk permits a standard rollout.
Observed delivery
Canary observations, continuation, promotion, rollback, and directional accuracy remain attached to the release.
Tenant boundary
Digest-only credentials, roles, and repository grants prevent cross-tenant evidence access.
Auditable output
Structured Check Runs, a read-only management dashboard, and bounded JSON evidence reports expose the decision trail.
Evidence, not claims
Implementation and production proof are labeled separately.
| Scenario | Policy result | Evidence status |
|---|---|---|
| Safe pull request with complete passing evidence | CONTINUE · STANDARD · 100% | Production-validated |
| Failed CI workflow | BLOCK · BLOCKED · 0% | Production-validated |
| Healthy canary observation | CONTINUE observation | Deterministically tested |
| Threshold breach | ROLLBACK | Deterministically tested |
| Second-organization isolation | Cross-tenant access concealed with HTTP 403 | Production-validated |
Live demonstration
Inspect the public proof surface.
The dashboard shell is public, while release data requires an authorized tenant credential. The repository case-study package contains the threat model, demo script, policy table, examples, evaluation, recovery procedures, completion ledger, and Known limitations.
Safe demonstration boundary
No key belongs in a URL, screenshot, recording, source file, or browser storage. Use a temporary terminal environment for authenticated API calls and unset it afterward.