Source build & independent validation
Reproduce the repository-owned validation gates without confusing maintainer workflows with the supported customer installation path.
Validate the application source
- ✓Check out the exact reviewed commit with a clean worktree.
- ✓Use the repository-pinned SDK, Node.js, pnpm, package, and tool versions.
- ✓Keep test credentials synthetic and isolated from customer environments.
- ✓Treat every failing gate as a release blocker until its owning evidence explains an approved exception.
- ✓Do not sign or publish artifacts from a developer workstation.
Validate provider behavior safely
Provider live-smoke validation creates real infrastructure and can incur cost. Run it only in a disposable, quota-bounded project with a named owner, short-lived credential, cleanup evidence, and an explicit maximum duration.
| Control | Required evidence |
|---|---|
| Isolation | Dedicated provider project/account and test-only network ranges. |
| Credential | Scoped, short-lived secret supplied through the approved secret boundary. |
| Cost | Budget/limit, maximum topology, timeout, and named cleanup owner. |
| Determinism | Pinned fixture revision and reviewed difference when fixtures change. |
| Cleanup | Successful deletion or a tracked residual-resource incident. |
Validate deployable components
Chart, lifecycle-agent, and conformance validation have separate ownership because each crosses a different trust boundary. A successful application build does not substitute for these gates.
- ✓Helm rendering is deterministic and contains only approved image references, storage, ingress, RBAC, and Secret references.
- ✓Agent validation covers configuration, permissions, bootstrap, heartbeat, smoke, bounded logs, and update compatibility.
- ✓Conformance validation covers the catalog, tool images, CVE policy, signed evidence, bundles, and cleanup contracts.
Complete maintainer validation
Packaging and hygiene gates are the final source-level checks. Protected release engineering then creates the signed release artifacts described in the release-status, security, registry, and conformance documentation.