From commit to customer: how every new release is certified before you download it.

Caught before a commit even exists.

Local hooks run formatting and lint (Black, isort, flake8), PowerShell analysis (PSScriptAnalyzer), shell linting (shellcheck), a secret scanner that blocks keys and credentials, and a “no new inline frontend” ratchet.

Nothing leaves a workstation unaccountable.

GPG-signed commits, an enforcement-version check, and a manifest guaranteeing managed files are committed. Deep security and dependency gates run before code ever reaches the server.

Each repository runs the checks that fit its languages.

Tests + coverage — the full suite runs, and a self-calibrating coverage gate blocks any regression below the committed floor. Python — Bandit (security patterns), ruff. PowerShell, the code that runs elevated on customer machines — PSScriptAnalyzer + InjectionHunter catch injection, plaintext credentials, and unsafe execution; Pester runs unit tests; a syntax gate parses every single script. Dependencies + deprecated code — every release runs pip-audit (Python) and npm audit (JavaScript) to flag known-vulnerable packages, and scans our own source for deprecated APIs (e.g. calls scheduled for removal in a future language runtime) — blocking them, so a deprecation is fixed in the release that introduces it rather than discovered when an upgrade breaks it. A weighted OWASP scorecard is computed every run and published as evidence.

Two complementary scans, each emitting machine-readable evidence.

Static analysis → SARIF. Every product’s source is scanned for security anti-patterns — injection, unsafe execution, hard-coded credentials, dangerous deserialization — with Bandit (Python) and PSScriptAnalyzer + InjectionHunter (PowerShell, the code that runs elevated on customer machines). Findings are emitted as SARIF, the industry-standard security format.

Supply-chain vulnerability scan. We take the CycloneDX SBOM of exactly what ships — built from the offline wheelhouse, so it lists real pinned versions, not a guess at the source tree — and scan it with Grype against the OSV and GitHub advisory databases. Precise package-and-version matching surfaces genuinely known-vulnerable components without the false positives that fuzzy scanners produce. Together these answer both questions: is the code safe, and is anything we bundle known-vulnerable.

One evidence-based release decision.

Every gate above is aggregated into a single release decision plus a complete evidence bundle — static analysis, security, tests, quality score, and a human-readable report. The decision comes from the gates’ actual results, not an arbitrary score.

Only proven code gets built into what customers receive.

Artifacts ship as native OS packages: Linux .deb/.rpm (each with an offline wheelhouse for air-gapped installs), signed Windows MSI, and signed, notarized macOS packages. Docker is a build-and-test sandbox only — never the deployment format.

Each build also emits a CycloneDX Software Bill of Materials (SBOM) describing exactly what ships. For packages that carry an offline wheelhouse, the SBOM is generated from the shipped wheelhouse — so it lists the real, pinned dependency versions in the artifact you download, not an approximation of the source tree.

The part most vendors skip.

For every artifact and every package format we:

1. Verify the SHA256 against the shipped checksum.
2. Install it on a clean machine — the real package, real post-install scripts, real system services, database provisioning, TLS, and initial-credential generation.
3. Boot and health-check every service.
4. Log in and crawl the entire UI with an automated browser: every page renders, every internal link resolves, zero unhandled console/network errors, functional flows work, and accessibility checks pass.
5. Capture screenshots and a machine-readable result as evidence.

A package that won’t install, a page that errors, a broken link — each is a release blocker, caught here, before a customer ever sees it.

Verify that what you downloaded is exactly what we built.

Every artifact is signed — GPG for Linux, code-signing certificates for Windows, Apple codesign + notarization for macOS.

You get the binary — and its proof.

You don’t just get a binary; you get the binary and its proof — a signed Release Evidence Pack attached to every release, indexed by a manifest so you can see, and cryptographically verify, exactly what backs each claim:

• Software Bill of Materials (CycloneDX) — every component inside the artifact.
• Vulnerability scan report (Grype) — known CVEs affecting what ships.
• Static analysis report (SARIF).
• Unit test results and code coverage.
• Release validation report — the clean-host install + authenticated UI-crawl proof.
• Signed build hashes (SHA256 + GPG).
• Release approval evidence — the aggregated Release Gate decision.

Every item is signed with the AuditToolkit release key, so you can inventory exactly what you’re installing and verify that inventory — and its integrity — came from us. Auditable, reproducible, and in the box every time.