Secure and govern

Security works best when people barely notice it. If doing the right thing takes extra steps, people will eventually skip them, so the safe path has to be the default path.

Every release PR meets the same gates, listed in one registry: static analysis (Semgrep), an image scan (Trivy), provenance (the commit signature plus the SLSA attestation, checked by Conforma), the SBOM, values validation, a change request in the company's change tool (ServiceNow, or any tool behind a webhook), API compatibility against the spec the target environment runs, and a check ride read from the test evidence signed onto the image. Two of them, the check ride and API compatibility, report without blocking until every app is ready for them, and say so. The change request gate is a stub until a cluster names a change tool, and admission-policy validation is still a stub, and a stub says so loudly in its result and on the dashboard. Each gate is promoted to real enforcement on its own, and none is ever reported with more confidence than it has earned.

Identity comes from the platform, not from secrets the platform has to guard. The event broker authenticates callers with Kubernetes TokenReview against each pod's own projected token. Images and provenance are signed keylessly against a self-hosted Fulcio that trusts the cluster's own issuer, while commits are signed against public Sigstore, because a human's GitHub identity is what the public instance already trusts. Release policy validates the provenance attestation itself (which tasks really ran), in addition to the commit signature, not instead of it.

Tenancy is structural: every app gets a CI namespace and one namespace per environment, as peers, so pipeline permissions and running workloads never share a blast radius. Secrets come through External Secrets from Infisical, with no persisted credentials, and an admission policy closes the case RBAC cannot express.