Your whole supply chain.One place to see it and steer it.
Coverage across every stage, the evidence behind every release, every agent’s actions and the reach of every vulnerability, in one governed platform.
Watch a release meet your policy.
Every release is built in isolation, checked against the rules you set and signed only when it passes. When something is wrong it is stopped with the reason attached, and the latest scan results are checked again before anything is published.
A release moves through source, build, scan, policy, signing and publishing. In each example a rule stops one threat. A look-alike package stops the build before it starts. An install script that tries to send out a credential stops the build where it is. A library with a flaw attackers already use blocks the release at policy. A flaw listed after the scan is caught when the latest scan results are checked again before publishing. A coding agent that tries to publish on its own waits for a person to approve. Whatever is published carries its evidence on every digest.
Know your posture before an attacker does.
Signals from your source control, CI, registries and clusters roll up into coverage for every stage, with the next most valuable step at the top.
AcmePosture
All projects · 214 components · updated 4 min ago
Coverage by stage
Overall coverage, last 12 weeks
Frameworks evidence coverage, not certification
Coverage by project and stage
Recent changes
- Branch protection turned off on ledger-api by an admin. Restored after 3 h.
- Cooling-off period enforced for npm in Payments.
- 12 workflows in checkout still follow moving tags.
- GitLab connected: 38 repositories now report signals.
Next best steps
- Require review before release6 commits reached main without an approved pull request.Source & review
- Pin CI actions by commit37 workflows still follow moving tags.Build & test
- Turn on the cooling-off period14 packages were less than seven days old when installed.Dependencies
Every release carries its proof.
Each stage shows what policy checked, who approved and which exact digest moved. Nothing advances on a pipeline’s say-so.
payments-api 4.18.0
Release to production · started 09:41 by J. Park
- Registered09:41
- Policy passed09:42 · 11 rules
- Signed09:42 · KMS
- Stagingwatch window clear
- Production1 of 2 approvals
Rollout watch window 18:42 left
- us-east100%Healthy
- eu-west50%Canary
- ap-south0%Queued
Error rate and latency stay inside policy. The release watcher can hold this rollout; only people can promote it.
Production approval
- JPJ. ParkPayments leadApproved
- RSR. SinghSecurityWaiting
Evidence for sha256:e3a7…41f0
- ✓Provenance from an accepted builder
- ✓Pull request #482 approved by J. Park
- ✓SBOM attached, 312 components
- ✓CBOM attached, 41 cryptographic assets
- ✓Scans: 0 critical, 2 low
- ✓All dependencies past cooling-off
Provenance
- Commit 9f2c1abPR #482 · approved · main
- Build #7712sealed · 2 workers · engine pinned
- Artifactsha256:e3a7…41f0
- Signaturepayments-release · KMS
- Publishedghcr · ecr
Cryptography (CBOM)
- AES-256-GCM46%
- ECDSA P-25622%
- RSA-204814%
- SHA-25612%
- Ed255196%
0 deprecated algorithms. 2 assets flagged for post-quantum migration.
Every artifact, from commit to cluster.
Open any artifact to see its whole chain of custody: the change and reviews it came from, the build that made it, its evidence and signature, where it was published, where it runs right now and everything that has happened to it since.
checkout-web 2.8.0 Held in eu-west
OCI image · sha256:5d0e…a913 · 212 MB · registered today 08:39
Chain of custody every link verified · 9 records
- ChangePR #9288A. Okafor, M. Chen approved
- SourceCommit 4be71d2signed · main
- BuildHarness #9302accepted builder · engine pinned
- Evidence7 recordsSBOM · CBOM · 3 scans · tests
- Signaturecheckout-releaseprotected worker · KMS
- Publishedghcr · ecrdigests match
- Running3 environments1 held by the release watcher
Where it’s running
| Environment | Traffic | Pods | Since | Status |
|---|---|---|---|---|
| prod · us-east | 100% | 24 / 24 | 09:20 | Healthy |
| prod · eu-west | 25% | 4 / 16 | 09:58 | Held · errors 3.1% |
| staging · us-east | 100% | 3 / 3 | 08:44 | Healthy |
| prod · ap-south | — | — | — | Not admitted yet |
Published copies
- ✓ghcr.io/acme/checkout-web:2.8.0
- ✓123456789012.dkr.ecr…/checkout-web:2.8.0
What’s inside
- Base image
- distroless/nodejs22 · pinned
- Components
- 486 · 0 critical, 1 high (exception)
- Cryptography
- 22 assets · 0 deprecated
- Licenses
- MIT 71% · Apache-2.0 22% · other 7%
- Provenance
- SLSA Build L3
- Policy
- Production service · revision 14 · 12 of 12 passed
Pulls, last 7 days
Activity
- Refused an unsigned rebuild tagged 2.8.0 in dev-sandbox: digest does not matchAdmission · dev-sandbox
- Rollback to 2.7.4 requested, waiting for a personRelease watcher
- Held eu-west at 25%: error rate 3.1%, limit 1%Release watcher
- Admitted to prod eu-west after signature and evidence checkAdmission · eu-west
- Promoted to prod us-east, approved by A. Okafor and R. SinghRelease
- Staging watch window clearRelease watcher
- Signed with checkout-releaseProtected publishing worker
- Policy passed, 12 rulesProduction service · rev 14
- Registered from Harness build #9302Oyzu
Admission checks
- USprod · us-eastsignature, provenance, policyAdmitted
- EUprod · eu-westsignature, provenance, policyAdmitted
- STstaging · us-eastsignature, provenanceAdmitted
- DVdev-sandboxunsigned image, same tagRefused
Clusters admit only this exact digest with its evidence. A rebuild under the same tag is a different artifact.
Where is it running? Answered in seconds.
When a flaw is disclosed, one record links the library to every build, artifact and deployment that contains it. Quarantine it everywhere in one move.
Exposure
1 critical advisory · 7 deployments affected
- 08:12Disclosed
- 08:12Matched to 7 deployments
- 08:19Quarantined everywhere
- 08:213 fixes opened
- 11:405 of 7 patched
Remediation
Mean time to patch: 2 h 51 min
Affected deployments
| Environment | Running | Owner | Status |
|---|---|---|---|
| prod · us-east | payments-api 4.17.2 | Payments | Patched |
| prod · eu-west | payments-api 4.17.2 | Payments | Patched |
| prod · ap-south | invoice-web 1.40.1 | Billing | Rolling out |
| prod · us-east | ledger-worker 2.9.0 | Ledger | Fix in review |
| staging · us-east | invoice-web 1.41.0 | Billing | Patched |
Ask what happened. Get the record, not a guess.
Ask in plain language why a build stopped, what it touched and what else is exposed. Answers cite the audit record, and anything the assistant drafts goes through the same review as your own changes. Enforcement never depends on it.
ledger-api build #4821 Stopped by policy
main · merge of PR #311 by M. Chen · stopped 14:02:17
- Checkout9f41c0e · 3 s
- Dependencies412 resolved · 41 s
- Install scriptsstopped · 14:02:17
- Testnot run
- Registernothing registered
Outbound connection refused build.network.declared-only
- Step
- npm ci › tiny-env-loader@2.4.1 postinstall
- Process
- node scripts/setup.js
- Destination
- 203.0.113.48:443 · not declared
- Payload
- 14 environment variables, 2.1 KB, encrypted
- Read
- AWS_ACCESS_KEY_ID canary CI HOME +11
- Decision
- Denied at the sandbox boundary · build stopped · Security paged
What changed in this version
- +New
postinstallscript, 1 file, obfuscated - +New maintainer added 9 h before publish
- +Reads
process.env, opens a socket - Published 6 h ago · 2.4.0 was 14 months old
Blast radius
- ✓No release or cloud credentials in the sandbox
- ✓Network limited to the npm mirror and Go proxy
- ✓Canary credential tripped, alert at 14:02
- ✓No artifact registered, nothing to recall
Every agent, every action, on the record.
Coding agents act for their developer and never above them. Your automation has an owner and expiring grants. Every action is allowed, refused or held, and audited.
Agent activity
Today · 128 actions · 9 refused · 1 held
Actions by agent
- Coding agents · M. Chen50
- Coding agents · J. Park33
- dep-updater24
- Release watcher15
- sample-remediator7
- Allowed
- Refused
- Held
Agent registry
- DUdep-updaterowner Platform · read, publish request61 days
- RWRelease watcherOyzu · hold, request rollbackBuilt in
- SRsample-remediatorowner SRE · hold, request rollback9 days
Live activity
- CACoding agentfor M. ChenOpened pull request #491Allowed
- CACoding agentfor M. ChenInstall json-parse-turbo 1.0.0Refused · not in catalog
- DUdep-updaterautomation · owner PlatformPublish payments-api 4.18.0Refused · needs approval
- RWRelease watcherOyzuHeld checkout-web in eu-westHeld · errors 3.1%
- RWRelease watcherOyzuRequested rollback to 2.7.4Waiting for a person
Set the bar once. Every build meets it.
Pick a build type and say what every build of that kind must have. Rules from the organization baseline carry down and can’t be loosened. A new service gets the whole bar the moment it’s created, without editing a pipeline.
Production service
Build type for 64 projects · builds on the Org baseline
Build types
- Org baselineEvery build212
- Production serviceCustomer-facing services64
- Regulated · PCICard data, stricter12
- LibraryShared packages88
- InfrastructureTerraform, Helm27
- + New build type
Every Production service build must have
From the Org baseline · can’t be loosened here
- ✓Provenance from an accepted builder, SLSA Build L3Accepted: your builders
- ✓No secrets in the code or the artifactAccepted: Gitleaks, GitHub secret scanning
- ✓SBOM attached and signedAccepted: Syft, CycloneDX
Added for Production service
- ✓Code review with 2 approvals, including a code ownerAccepted: GitHub, GitLab
- ✓Static analysis with no high findingsAccepted: Semgrep, CodeQL
- ✓Container scan with no critical and at most 3 highAccepted: Trivy, Grype
- ✓CBOM with no deprecated algorithmsAccepted: CycloneDX
- ✓License check with no AGPL or unknown licensesAccepted: ScanCode
If any of this is missing, the release waits. It never ships without it.
Quality gates
- Line coverage96% of builds pass
- Mutation score88% of builds pass
- p95 latency in load test93% of builds pass
- Flaky tests99% of builds pass
- Image size100% of builds pass
Works with every pipeline
- GHGitHub Actions38
- JKJenkins14
- HNHarness8
- GLGitLab CI4
0 pipeline files changed
Policy decides. Pipelines just run.
Required evidence follows the build type, not the YAML. When a pipeline skips a scan, the release waits for the evidence instead of shipping without it, whichever CI ran it. Oyzu can produce the missing evidence itself, from scanners you accept, against the exact artifact.
Evidence coverage
Production service · 64 projects · last 7 days
Evidence by project
Gate decisions
- Passed391
- Held for evidence23
- Passed with exception4
Held: fraud-model 2.3.0 Jenkins · build #1188
- ✓Provenance from an accepted builder
- ✓SBOM and CBOM attached
- ✓Pull request #77 approved by 2 reviewers
- ✕Container scan missing the pipeline has no scan step
- ✕Coverage 71%, below 80% gate set by Production service
Exceptions
- LAledger-api · container scan5 high allowed until patched base image · R. Singh9 days
- SIsearch-indexer · coverage 74%legacy module split in progress · A. Okafor3 days
- CWcheckout-web · DAST windowstaging rebuilt, scan rescheduled · R. Singh12 days
- IDidentity-svc · CBOMvendor library pending inventory · J. Park14 days
Try a control before you enforce it.
See exactly what a new rule would have stopped last month, and what it would have broken, then switch it on with confidence.
Cooling-off period
npm · watching only · simulated on the last 30 days
Installs held per day, last 30 days
Impact by project
| Project | Held | Failed |
|---|---|---|
| payments | 64 | 1 |
| checkout | 51 | 0 |
| ledger | 38 | 2 |
| identity | 33 | 0 |
| search | 28 | 0 |
Rule
rule cooling_off applies npm, all projects minimum 7 days since publish except @acme/* internal packages mode watch → enforce
What it would have stopped
- colorful-logger 3.1.4Hijacked maintainer account. Pulled after 31 h.
- fast-yaml-lite 1.9.0New install script that read tokens. Pulled after 52 h.
The right thing.
The easy thing.
The default thing.
Want to see how this would look for your organization? We’d like to hear what you’re building.