The assurance engine
A machine produced something consequential.
A human has to decide whether the evidence is enough.
release-gate does not generate results and it does not verify them — agents
generate, tools verify, and release-gate assembles the argument those two
leave behind, then says whether that argument is sound enough to put to a
person. It reads an OpenTelemetry trace, a Langfuse export, a promptfoo
result or its own record format; the shape is detected, not declared.
1 · A bounded list, not a score
Two million records is not reviewable, and a score over two million
records is one number standing in for a judgement nobody made.
Criticality comes from reachability in the claim graph, never volume.
A shorter list is not a better case — it can equally
mean detection got worse, which is why that refusal is a property in
the code rather than a caveat in the docs.
2 · Every verdict says what it did not check
A pass that does not state its own coverage is indistinguishable from a
pass that never looked. NOT_ASSESSED is a first-class
answer, kept apart from “we looked and found nothing”
everywhere in the engine. Collapsing those is how a gap comes to read
as a clean bill of health.
3 · When it holds, it returns the work order
A gate that only says no is a nag. Each item arrives with what would
close it, machine-readable with --json, so the next agent
run can go and get the evidence instead of a human re-reading the case
to work out what was missing.
How it is built
Its own checks
AST / taint, PR diff, governance, trace validation, loop simulation, agent score. Each is one producer among the others.
Your tools
Evaluators, red teams, traces, SAST, provers, people. Read in their own words, never re-run.
A model, bounded
Asked only what the rules left open. Any failure is UNKNOWN. A reading never decides.
The case
Claims, evidence, assumptions, contradictions, counterexamples, failed branches, coverage, independence.
The policy
PROMOTE · HOLD · BLOCK, deterministic from the declared policy and the evidence. No score is an input.
It may generate, ingest, normalize and compare evidence, interpret bounded
evidence, and decide whether evidence satisfies policy. It never pretends
that one model, one scanner, one evaluator, one score or one successful test
establishes universal truth.
Proven end to end. One enterprise release
blocks on a single counterexample. None of these outvotes it: a perfect
scanner score, 1,000 passing evals, an evaluator’s “approve”,
or five model judgments. A hostile review
of 25 attack areas found 11 defects; each was reproduced in a test and fixed.
From evidence to production
Signed evidence
Producers sign what they report (DSSE / in-toto). It is checked against keys you trust for named producers. If a signature fails, the evidence is not read.
Deploy check
deploy-check compares what runs with the admitted state, component by component. Anything not shown to match does not pass.
Drilled containment
A kill-switch drill that halts in time checks “it can be paused”. One that fails, or halts late, is a counterexample.
Incidents
A production failure becomes a counterexample. Every later release has to answer it with evidence that release carries.
Diversity-strict
Critical claims need two independent groups of checks, and two models from one provider count as one. Someone other than the author must check.
A signature says who produced a report, never that the report is right.
Signing,
the deploy check
and incidents
are in the reference.
|
producers |
records seen |
evidence |
claims |
reaches a person |
| one agent, one action |
4 |
7 |
6 |
0 |
1 item |
| 10,248 workers |
10,254 |
2,287,133 |
10,258 |
2,420 |
13 items, 7 undroppable |
Measured by the test suite, not written here by hand — a claim that drifts
from the implementation fails a test. One code path carries both rows: 346
engine functions are common to them, 87% of everything the single-agent
path touches.
No config file, no YAML, no account. It will HOLD until a
methodology says what enough means for the decision — inventing that
answer would be claiming a standard it does not have.