Eight gates, answered one at a time, with no combined score.
A certified build is not yet a release. Eight gates stand between the two, answered one at a time: Blueprint validation passed, build verified, policy passed, code review passed, security passed, QA passed, provenance complete, rollback available. Each appears on its own line with what it checked, so nothing is waved through on a general impression. The release also carries an explicit risk level, and the policy profile decides which levels need a named person to approve.
No combined score to hide behind
Gates are never averaged into a single number that one strong result can carry. Security passing does not compensate for QA failing, and a well-reviewed change with incomplete provenance still stops. Until every gate clears, there is no release to deploy.
The risk level is written on the release
Risk follows what the change touches — stored data, permissions, published capabilities, external interfaces — and is written on the release rather than read from the absence of red. The policy profile maps each level to what it requires, up to a named human approver. A medium-risk release and a low-risk release do not travel the same path.
Gates are cleared by whoever did not build it
The agents that produced the change do not clear its gates. Review is done by an agent independent of the builder, security review runs separately again, and the policy engine evaluates the actual rules instead of asking a model whether the release looks acceptable. A convincing summary moves nothing.
In this capability
- Gate-by-gate evidence
- Independent review and security
- Explicit risk level
- Human approval where required
Releases
The rest of Releases
Build Certification
Nine steps in fixed order: Blueprint validation, policy, dependency resolution, target resolution, generation, unit tests, integration tests, artifact verification, pull request.
Provenance
Every artifact names what produced it: product, Blueprint version, generator, agents, policy profile and commit.
Rollback
A release you can ship is a release you can reverse. The previous verified artifact stays available, record intact.
GitHub Flow
Branches, pull requests, reviews, CI and releases stay in GitHub. Foundariq records why each one exists.
Stop managing prompts. Start managing software strategy.
Connect your repositories. Let Foundariq understand what you have already built. Then tell it what your portfolio should build next.
Read-only to start · Your code stays in your GitHub · [email protected]