pilot-cd-gate

What problem does it solve?

It helps you decide whether a release is safe to promote by turning cub-scout's structured, read-only Kubernetes/GitOps evidence into a clear pre-deploy gate outcome for Pilot, without cub-scout making any authority calls or PASS/BLOCK decisions itself.

Core Features & Use Cases

• Pre-deploy evidence for CD decisions: Produces strategy-anchored evidence via compare source-truth that Pilot can use to render a verdict for “should this deploy go?”.
• Typed, durable audit artifacts (receipts): Optionally generates and saves a fingerprinted in-toto receipt via receipt verify for attachable, immutable proof and CI gating.
• Strategy-enforced source-truth checks: Requires a caller-declared strategy (git/helm/kustomize/oci + argo/flux variants) so the gate is conformance-based rather than guesswork.
• Explicit missing-evidence reporting: Surfaces proof gaps and safe next actions via structured outputs so operators know what to fix when evidence is incomplete.

Quick Start

Ask Pilot to gate the apply by running cub-scout compare source-truth <kind>/<name> -n <ns> with an explicit --strategy <s> and JSON output, then have Pilot use the evidence to decide PASS/WATCH/ASK/BLOCK.