# AEGIS — Release Certification Checklist

- **Document ID:** ARCH-54
- **Phase:** E.4 — Readiness & Long-View
- **Status:** Draft for review (post four-reviewer discipline)
- **Version:** 0.1
- **Date:** 2026-07-10
- **Owner:** Chief Security Architect

---

## 1. Purpose

Operationalize ARCH-28 (Release Security Gate) as an executable checklist. Every production release passes; deliverable is a signed **Release Certification Attestation** stored per ARCH-43 (Evidence Traceability).

## 2. Executable Checklist

Machine-readable YAML in `docs/releases/checklist.yaml` (versioned). CI executes it; each check produces a signed evidence artifact.

### 2.1 Categories

- **Architecture** — no drift vs. approved architecture; consistency checks pass (ARCH-41).
- **Threat Model** — updated; adversary profiles current.
- **Dependencies** — SBOM diff; SCA clean; provenance attested; licenses OK.
- **Testing** — unit/property/fuzz/integration/contract/regression all green; Golden Invariants green.
- **Chaos** — game-day results recorded; failure-mode expectations met.
- **Recovery** — restore drill passed with Recovery Integrity Attestation.
- **Operational** — runbooks updated; on-call briefed; monitoring updated; air-gap variant integration test passed.
- **Debt** — no expired-unrenewed debt entries; new debt registered.
- **Documentation** — ARCH-* and ADR updates present for changes.
- **Metrics** — new metrics registered; alarm thresholds set.
- **Verification Matrix** — new claims added with evidence links.
- **Trust Score** — subsystem scores within acceptable range.
- **Ceremony** — signing hierarchies exercised where release requires.
- **Owner + Auditor sign-off** — recorded.

Each item has: `check_id`, `description`, `runner`, `evidence_ref`, `signer`, `status`.

## 3. Failure Handling

- Any category `Fail` blocks release.
- Emergency releases (per ARCH-28 §5) can defer non-blocking items with Owner + Auditor sign-off, tracked as Debt.

## 4. Sign-off Workflow

1. All automated checks green.
2. Owner reviews Release Certification Report (aggregated evidence).
3. Auditor signs (independent).
4. Release triggered.

## 5. Storage

- Attestation stored in Recovery Domain object store + transparency log entry.
- Publicly-referenced hash for third-party verification.

## 6. Assumption (hypothesis)

- **H-1.** *Executable checklist catches release issues that human review might miss.*
   - Evidence: pilot on early releases.
   - Validation: measure post-release incidents attributable to gate misses.
   - Confidence: Medium.
   - Expiration: 12 months.
   - Review Date: 6 months.

## 7. Independent Architecture Review

- **F-1.** *Checklist proliferation.* Owned; retirement discipline.
- **F-2.** *Automation cost.* Amortized across releases.

## 8. Adversarial Architect Review

- **A-1.** *Insider skips checks via emergency path.* Emergency scoped + audited + Debt.
- **A-2.** *Attacker fakes evidence artifact.* Signature + consistency check.

## 9. Operational Reliability Review

- **O-1.** Runbook per failure mode.
- **O-2.** Rollback tied to same signed attestation.

## 10. Self-Critique

- **S-1.** *Checklist can become bureaucratic.* Reviewed periodically for value; items retired when no longer signal.
- **S-2.** *Evidence artifact schema stability.* Versioned.

## 11. First-Target Analysis and Redesign

**Target:** the automated runners themselves. If compromised, they can green-light bad releases. Response: runners are versioned code + hash-pinned + signed + regression tests + auditor samples runner logs; runner drift monitored.

## 12. Future Risks / Known Limitations / Out-of-Scope / Retirement

- **Future Risks.** Automation may miss context; human judgment still required.
- **Known Limitations.** Executable check ≠ real-world verification alone.
- **Out-of-Scope.** Emergency-response bypass (governed separately).
- **Retirement Conditions.** Never.

## 13. Decisions

### D-54-1. Executable YAML checklist producing signed Release Certification Attestation

- **Reason.** Docs-as-code (mandate #43) + release-gate discipline.

## 14. Change Log

- **0.1 (2026-07-10)** — Initial draft.