Engineering case study
CanaryGuard case study
A release-governance system that correlates a verified pull request, bounded CI and security evidence, a structured GitHub Check Run, deterministic policy, deployment observations, and the final outcome under one release identity.
Problem statement
The release review and decision process.
CanaryGuard normalizes evidence without ingesting raw logs, keeps model analysis advisory, and makes deterministic policy the final authority.
Verified intake
Signed GitHub webhooks, replay protection, exact repository grants, and head-SHA correlation establish identity.
Bounded evidence
CI, vulnerability, secret, accessibility, exposure, and agent-policy facts are normalized with strict size limits.
Deterministic policy authority
Failed CI and critical findings block. Higher uncertainty selects a canary. Low risk permits a standard rollout.
Observed delivery
Canary observations, continuation, promotion, rollback, and directional accuracy remain attached to the release.
Tenant boundary
Digest-only credentials, roles, and repository grants prevent cross-tenant evidence access.
Auditable output
Structured Check Runs, a read-only management dashboard, and bounded JSON evidence reports expose the decision trail.
Validation results
Production checks and automated tests.
| Scenario | Policy result | Evidence status |
|---|---|---|
| Safe pull request with complete passing evidence | CONTINUE · STANDARD · 100% | Production-validated |
| Failed CI workflow | BLOCK · BLOCKED · 0% | Production-validated |
| Healthy canary observation | CONTINUE observation | Deterministically tested |
| Threshold breach | ROLLBACK | Deterministically tested |
| Second-organization isolation | Historical secondary-tenant request rejected with HTTP 403 | Production-validated |
Test counts describe a specific revision, not a coverage percentage. This update passed 534 tests locally; its CI and deployment are verified separately. Phase 8 recorded 509 tests; the deployed baseline 92ae5ea66cbc passed 531. The current authorization contract returns HTTP 403 for denied role permissions and HTTP 404 for an ungranted repository or release. The historical 403 observation above records rejection, not proof of the current resource-concealment response.
Live demonstration
Inspect the release evidence.
The dashboard shell is public, while release data requires an authorized tenant credential. The repository case-study package contains the threat model, demo script, policy table, examples, evaluation, recovery procedures, completion ledger, and Known limitations.
Using the dashboard safely
No key belongs in a URL, screenshot, recording, source file, or browser storage. Use a temporary terminal environment for authenticated API calls and unset it afterward.