kapas(1) — Kapas

kapas — a release control plane that fails closed. It does not ship your code. It decides whether your code is allowed to ship — and records the reasoning either way.

kapas verify # dry-run the whole sequence; execute nothing; print the plan
kapas release --env production --tag v2026.08.21
kapas rollback --to <ledger-target>

kapas release · productionsurface of record: the ledger

$ kapas release --env production --tag v2026.07.25
  1  PREFLIGHT      ✓ confirmed; tag == release/prod HEAD; 5 adapters resolved
  2  GATE           ✓ "pnpm release:check" exited 0 — lint, typecheck, test, build
  3  DEPS_AUDIT     ✗ release blocked: next 16.2.9 — middleware/proxy authorization
                      bypass (high ≥ floor high, production tree)
  4  ARTIFACT       — not reached. nothing was built, deployed, or migrated.
 15  ROLLBACK       — skipped: nothing was promoted; production never changed
 16  LEDGER         ✓ recorded 5 step results; outcome: blocked

exit 1 — blocked. your pipeline was green. it would have shipped this.

The refusal above is the product. Everything else exists so this line can be trusted.

DESCRIPTION

Two failure modes ship green through ordinary CI: the bad migration (applied at boot, unbacked, by an all-powerful role) and the known-vulnerable dependency(reported by a scanner nobody reads, blocked by nothing). Both are expensive precisely because nothing stopped them.

Kapas runs the gated sequence across your own providers — your Vercel, your Fly, your Neon, your GitHub Actions. It holds no long-lived credential and never proxies production traffic. When every gate passes, traffic moves. When one fails, the release stops, restores what moved, and writes down why.

The absence of a pass is a failure.a missing signal, a malformed signal, and a failing signal are the same signal

A green unit test is not a green production path.the gate runs backup → migrate-as-owner → privilege-check before traffic moves

"Skipped" means does not apply — never failed quietly.run/skip is decided from config shape before execution; execution can only pass or fail

Exceptions carry an owner, a reason, and an expiry.an accepted advisory re-blocks the day its acceptance lapses — recorded in the ledger

THE SEQUENCE

Sixteen steps, in order, per release. Where each runs is a typed property of the step — deploy steps stay in your CI with your secrets; the red rows are the control plane's own: the gates it will not delegate and the recovery that must work when your CI is the thing that broke.

#	STEP	RUNS IN	GATE
1	PREFLIGHT	kapas	typed confirmation · tag == deploy-branch HEAD · adapters resolved
2	GATE	tenant-ci	the tenant's declared checks exit 0
3	DEPS_AUDIT	tenant-ci	fails closed at a severity floor on the production tree
4	ARTIFACT	tenant-ci	build once; deploy this exact digest everywhere
5	ROLLBACK_MARK	kapas	capture the rollback target before anything mutates
6	DB_BACKUP	kapas	copy-on-write restore point before any migration
7	MIGRATE	tenant-ci	expand/contract enforced; owner role, never the app role
8	GRANTS	tenant-ci	least-privilege CRUD re-applied to the runtime role
9	PRIV_CHECK	tenant-ci	runtime role owns nothing, no CREATE; platform caveats recorded
10	CANARY	tenant-ci	deploy without moving production traffic
11	HEALTH_CANARY	kapas	canary healthy before any traffic moves
12	PROMOTE	kapas	traffic moves only to a health-checked canary
13	HEALTH_PROMO	kapas	production healthy after cutover, or the release rolls back
14	FANOUT	kapas	dependent surfaces in dependency order, each fully gated
15	ROLLBACK	kapas	every promoted surface restored to its captured mark, reverse order
16	LEDGER	kapas	one immutable record: plan, evidence, outcome — green or blocked

Data steps 6–9 apply only to surfaces that own a database; elsewhere they are recorded as skipped, with the reason. Evidence doubles as the resume checkpoint: a crashed release resumes without re-executing anything that passed — it promotes the exact canary the crashed run deployed.

EXIT STATUS

0released — every gate held; traffic moved; the ledger holds the lineage: commit, digest, backup ref, migrations, grants, privilege report, health, promote.

1blocked — a gate refused before traffic moved. Production never changed. This is the exit code that pays for the product.

2rolled-back — a post-promote gate failed; every promoted surface was restored to its captured mark, in reverse dependency order.

3failed — rollback itself could not complete. Stated plainly, paged loudly, never dressed up as anything else.

WHAT IT IS NOT

not a host

Never runs your app or database, never proxies prod traffic. Your compute stays on your providers; Kapas decides and records.

not a credential keeper

Deploy steps run in your CI with your secrets. Kapas-run steps mint short-lived, scoped, per-release tokens — and store nothing that could deploy on its own.

not a lock-in

kapas init writes standard, reviewable artifacts you own. Delete Kapas; keep a working pipeline. Proven in tests, not promised.

not a flatterer

Where a platform ceiling can't be removed, the check records the caveat instead of pretending. Claiming more safety than exists is the worse bug.

PROVENANCE

Extracted from production systems we run, not imagined. The same sequence was built by hand across our own products — different stacks, same discipline — until the repetition was the product insight. Kapas releases all of them before it opens to anyone.

production systems on the dogfood roster — Next on Vercel, a Python monorepo on Fly, a websocket surface, one Neon each

canonical steps; 36 gated instances for a three-surface release, dependency-ordered

products found exposed by one advisory on 2026-07-25 — the day the gate earned its place

long-lived provider credentials stored. the mark is a slashed zero for a reason