Release Evidence Briefings
Short, evidence-grounded briefings on the problems we are solving, the methods we use, and the limitations we acknowledge.
Ticket closure records that work stopped. It does not record that risk was retired. This briefing explains why closure is a workflow event rather than proof, and what evidence is required to claim a vulnerability was actually remediated.
Read the briefing →Assertion-based approvals treat verbal confirmation, ticket status, or a scanner green light as sufficient to ship. This briefing catalogs the hidden costs of that shortcut and why evidence-backed approval is cheaper across the release lifecycle.
Read the briefing →When policy changes, past release decisions are often re-graded against the new standard. Policy-version binding prevents this retroactive rewrite and gives regulated teams a defensible basis for every historical decision.
Read the briefing →AI coding agents can produce changes faster than teams can verify them. This research note examines the gap between generated code and the evidence required to release it, and what governance structures close that gap.
Read the briefing →A benchmark framework for evaluating verification evidence for AI-generated code changes.
Read the briefing →Comparing tickets marked closed with independently verified remediation evidence, based on synthetic illustrative data.
Read the briefing →A research note on the structural gap between security claims and the evidence required to support consequential release decisions.
Read the briefing →