OUTCOME PLAYBOOK
Prove a safe release
Protect requests and effects, then produce signed release evidence that a deployment gate can verify independently.
- 1. Choose
- 2. Install
- 3. Run
- 4. Verify
- 5. Harden
- 6. Operate
#Choose the package boundaries
Required packages establish the local success path. Production and operate packages close durability and evidence boundaries.
Required
1. Protect requests
@absolutejs/auth + rate-limitRejects unknown actors and abusive request volume.
Required2. Protect effects
@absolutejs/secretsKeeps credentials outside package and effect payloads.
Production3. Evaluate
@absolutejs/vulnerabilitiesNormalizes findings and produces signed policy evidence.
Production4. Attest
@absolutejs/attestBinds claims to the exact release artifact digest.
Operate5. Gate and prove
@absolutejs/deploy + auditVerifies evidence before promotion and retains the release trail.
#Prerequisites
One immutable artifact digest used by every evidence producer.
A trusted signing key with rotation and revocation policy.
Pinned scanner intelligence and explicit admission policy.
#Install the complete surface
BASH
bun add @absolutejs/auth @absolutejs/rate-limit @absolutejs/secrets @absolutejs/vulnerabilities @absolutejs/attest @absolutejs/deploy @absolutejs/auditSmallest useful file tree
TXT
security/
request.ts # auth, rate limit, secret boundary
scan.ts # SBOM and vulnerability policy
attest.ts # signed artifact statement
release.ts # deploy gate and verification
audit.ts # immutable release evidence#Run and verify
Evaluate
Generate or import a small scanner result and evaluate one explicit policy.
Proof of success: A known vulnerable fixture fails with a deterministic finding id.
- 1. Choose
- 2. Install
- 3. Run
- 4. Verify
- 5. Harden
- 6. Operate
#Expected results
Abusive or unauthorized requests fail before secrets or effects are exposed.
A vulnerability policy produces deterministic pass/fail evidence.
Attestation, deployment, and audit records share the release artifact digest.
#Development to production
DevelopmentLocal key and scanner fixtureProductionManaged signing boundary and pinned intelligence snapshot
Evidence trust depends on key custody and reproducible inputs.DevelopmentConsole verificationProductionFail-closed deploy admission plus immutable audit sink
Release assurance must be independently enforceable and reviewable.#Failure decisions
A release bundle cannot be verified.
Check firstSeparate missing evidence, invalid signatures, stale intelligence, and a genuine policy failure.
ThenFail closed with the exact missing or invalid trust-chain link.
Evidence is individually valid but belongs to another release.
Check firstCorrelate the artifact digest across vulnerability, attestation, deploy, and audit records.
ThenReject evidence produced for a different artifact.