Zero bad releases.
Not by luck, and not by heroics on a Friday night. By a gate that would rather say no than hope — and a ledger that writes down every answer it gives.
unrecorded releases. Every attempt ends in one immutable record — shipped, blocked, or rolled back.
warning states. A gate holds or it fails. There is deliberately no outcome in between.
god credentials stored. Deploys run in your CI with your secrets; Kapas keeps nothing that could ship on its own.
kapas is Hindi for raw cotton — the unspun material, before it becomes thread. Nothing in the name is about deploys, and that is the point: the mark carries the meaning. A zero, slashed. The promise the product actually makes.
We built the same release pipeline by hand eight times, for eight of our own production systems. Single Next apps. A Python monorepo with a worker fleet. A websocket surface nobody remembered to version. Every one of them ended up needing the same discipline: back up before you migrate, migrate as the owner and never as the app, prove the runtime role can't do what it shouldn't, canary behind a health check, and keep the old deployment close enough to reach.
Then one morning an audit gate refused a release. A middleware authorization bypass in the framework — in an app whose entire access model is middleware. The pipeline was green: lint, typecheck, tests, build, all of it. Four of our products were exposed, and only the one repo with a gate found out.
That is the whole thesis. Safety that lives in one repo's shell script is not safety — it's luck with better posture. So we extracted the discipline into a control plane that runs it across every repo the same way, refuses the same things for the same reasons, and writes every decision into a ledger you can hand to anyone who asks what shipped.
Kapas releases our own inventory first. When it's boring, we'll open it.
— Dushyant, who has been the person paged for all eight
It decides. It does not host.
Your compute stays on your Vercel and Fly; your data stays in your Neon. Kapas never runs your app, never proxies your traffic — it decides whether a release may proceed, and records why.
It fails closed.
A missing signal is a failure, never a pass. The dependency gate blocks at a severity floor; exceptions require an owner, a reason, and an expiry — and re-block the day the expiry lapses.
It writes everything down.
Commit, artifact digest, backup reference, migrations, grants, the privilege report, health results, who promoted, what rolled back. One immutable record per release — the answer to "what shipped?" that doesn't depend on memory.
It can be deleted.
It scaffolds standard artifacts into your repo — a workflow, a config, hooks — that keep working without it. Ejectability is the trust story, and it's proven in tests, not claimed.
One sequence, sixteen steps, every release.
PREFLIGHT / GATE / DEPS_AUDIT / ARTIFACT / ROLLBACK_MARK / DB_BACKUP / MIGRATE / GRANTS / PRIV_CHECK / CANARY / HEALTH_CANARY / PROMOTE / HEALTH_PROMO / FANOUT / ROLLBACK / LEDGER
the order is the safety contract — steps that don't apply are recorded as skipped, with the reason