P

policy-as-code

Open Source security and compliance gate for GitLab CI and GitHub Actions: SBOM, dependency vulnerabilities, SAST, secrets, IaC and licenses, under one versioned policy and one verdict. No SaaS, no code sent to a third party.

Authorization and execution control for AI agents — independent policy and judge approval before consequential tool actions execute. MCP gateway, capability tokens, auditability, and fail-closed execution.

Helm 4 plugin: judge a values set with Helm's own libraries and explain every refusal from x-rule/x-fix annotations in values.schema.json (rule, file:line, fix).

GitGovern for GitLab adds action-bound execution authority to GitLab Duo agents, flows, and CI/CD pipelines.

Structural integrity gate. Intercepts changes before execution and rejects when historical invariants break — even when cosign says Verified OK.

This project serves as a comprehensive reference implementation for enterprise DevSecOps practices, demonstrating how security, automation, and observability integrate seamlessly in modern cloud applications.