How we built the delivery evidence chain

Short summary

Appaloft is an open-source delivery platform that enforces explicit promotion and verifiable evidence at each deployment step. Its four-link chain (freeze → preview → promote → verify) uses canonical JSON manifests of file hashes rather than tarball hashes, enabling meaningful dedup, mutation detection, and path safety. The system fails closed: absent evidence never silently passes, and secret scanning runs before artifacts become immutable.

• •Appaloft's evidence chain links approved artifacts to running workloads via freeze → preview → promote → verify
• •Artifact identity uses SHA-256 over canonical JSON manifest-of-hashes, not tarball hashes, enabling dedup and mutation detection
• •Fail-closed design: missing evidence never passes silently; secret scanning runs at freeze time

Generated with AI, which can make mistakes.