Release traceability

From an exact source revision to the image that actually runs.

A customer-readable timeline connects source, private build, image digest and environment outcome without exposing registry credentials or repository content.

01

Selected Community source, read-only

For the accepted Community/customer-addon path, the commercial GitHub App is installed for one selected repository. Corvus resolves exact commits and does not write deployment workflows, Dockerfiles, server addresses or credentials into customer source.

  • Exact repository binding
  • Temporary repository-scoped token
  • No repository enumeration in the accepted path
02

Private central build

Community/customer-addon source is fetched into a disposable workspace. Enterprise source uses the separate isolated builder-only GitLab custody boundary. Private images are published to the project's Harbor namespace and verified by digest.

  • Customer VM receives no source credential
  • Commit and build-spec identity are recorded
  • Enterprise source never crosses into customer Git
03

Environment outcome, not a floating tag

The console shows the immutable digest and durable build/deployment state. For live, guarded backup and clone-test evidence appears as distinct stages; a stopped candidate is not presented as a successful release.

  • Exact digest deployment
  • Bounded failure code and correlation
  • No editable digest or host field