Enterprise release truth¶

The enterprise workflow is deliberately small: collect deterministic evidence, evaluate policy, preserve the decision, and make every later change visible.

Stable evidence contract¶

gig trace --format json and gig guard --format json expose the versioned Release Truth Graph. The current graph version is 2026-08-1; its machine contract is published at docs/schemas/release-truth-v2026-08-1.schema.json. New fields can be added within this schema version, while removals or semantic changes require a new version.

Provider evidence has an explicit collection state:

• complete: provider evidence was collected.
• unavailable: the provider supports it, but collection failed or was not authenticated.
• unsupported: the provider cannot supply that evidence.

Missing evidence never silently becomes safe. A previously safe graph becomes unknown until the evidence gap is resolved.

Gate and SARIF¶

gig guard ABC-123 --repo github:owner/name --target prod
gig guard ABC-123 --repo github:owner/name --target prod --format sarif > gig.sarif

The gate exits zero only for safe. Blocking findings, review findings, and evidence gaps are deterministic records with stable IDs, provenance, impact, severity, and remediation. SARIF can be uploaded to GitHub Code Scanning.

GitHub users can call .github/workflows/gig-gate.yml; GitLab users can include .gitlab/ci/gig-gate.yml and provide GIG_TICKET.

Replay an incident¶

Keep snapshots at important checkpoints, then compare them:

gig replay \
  --baseline .gig/checkpoints/qa-failed.json \
  --current .gig/releases/current/snapshots/abc-123.json

Replay reports changes in commits, pull requests, checks, deployments, dependencies, risks, and verdict. It does not mutate either snapshot.

Tamper-evident packets¶

gig packet attest --input release-packet.xlsx
gig packet verify \
  --input release-packet.xlsx \
  --attestation release-packet.xlsx.attestation.json

The attestation records a SHA-256 digest, file size, creation time, and schema version. Verification fails if the packet changes.

Human approval ledger¶

Export the graph first, then bind a decision to its digest:

gig guard ABC-123 --repo github:owner/name --target prod --format json > gate.json
gig approval record \
  --graph gate.json \
  --actor jane@example.com \
  --role release-manager \
  --reason "Change window approved"
gig approval verify --graph gate.json

An approval contains the actor, role, decision, reason, expiry, evidence digest, and ticket. Changing the evidence or waiting past expiry invalidates it.

The ledger is a portable local JSON contract. Teams that need centralized authorization should store it in their controlled evidence system and protect the write path with their existing identity provider.