preparation for ui re-shelling
This commit is contained in:
master
984
docs/modules/ui/v2-rewire/pack-08.md
Normal file
984
docs/modules/ui/v2-rewire/pack-08.md
Normal file
@@ -0,0 +1,984 @@
|
||||
## Pack 8 — Release Control (root menu)
|
||||
|
||||
This pack gives you: **(1)** Mermaid for the **Release Control menu** and **every screen flow**, **(2)** an **ASCII mock** per screen, and **(3)** “**Formerly / Why changed**” per screen. It also adds the missing **Release Bundle Organizer** (digest→version, Vault/Consul-derived env variables, per-repo changelog, bundle composition).
|
||||
|
||||
---
|
||||
|
||||
# 1) Release Control menu graph (Mermaid)
|
||||
|
||||
```mermaid
|
||||
flowchart TD
|
||||
RC[Release Control] --> RC_HOME[Control Plane]
|
||||
RC --> RC_BUNDLES[Bundles]
|
||||
RC --> RC_RELEASES[Releases]
|
||||
RC --> RC_APPROVALS[Approvals]
|
||||
RC --> RC_ENV[Regions & Environments]
|
||||
RC --> RC_DELIVERY[Delivery]
|
||||
|
||||
RC_BUNDLES --> B_CAT[Bundle Catalog]
|
||||
RC_BUNDLES --> B_ORG[Bundle Organizer]
|
||||
RC_BUNDLES --> B_REPOS[Repositories & Versions]
|
||||
|
||||
B_CAT --> B_DETAIL[Bundle Detail]
|
||||
B_ORG --> B_DETAIL
|
||||
|
||||
RC_RELEASES --> R_LIST[Releases List]
|
||||
R_LIST --> R_DETAIL[Release Detail]
|
||||
|
||||
RC_APPROVALS --> A_QUEUE[Approvals Queue]
|
||||
A_QUEUE --> A_DETAIL[Approval Detail]
|
||||
|
||||
RC_ENV --> REG_OV[Region Overview]
|
||||
REG_OV --> ENV_DETAIL[Environment Detail]
|
||||
RC_ENV --> PROMO[Promotion Paths]
|
||||
|
||||
RC_DELIVERY --> TARGETS[Targets]
|
||||
RC_DELIVERY --> AGENTS[Agents]
|
||||
RC_DELIVERY --> WF[Workflows]
|
||||
```
|
||||
|
||||
**Design intent:** Release Control is where you **compose**, **promote**, and **govern** releases/hotfixes—**with bundles as the organizing primitive**, regions first, and security/evidence surfaced at decision points.
|
||||
|
||||
---
|
||||
|
||||
# 2) Release Control → Control Plane
|
||||
|
||||
### Previously
|
||||
|
||||
* **Formerly:** `Control Plane` (top-level)
|
||||
Showed environment pipeline (Dev/Staging/UAT/Prod), pending approvals, active deployments, recent releases.
|
||||
|
||||
### Now (Redesign)
|
||||
|
||||
* **Now:** `Release Control → Control Plane`
|
||||
Adds:
|
||||
|
||||
* **Region-first** pipeline (tabs or left rail: `eu-west`, `us-east`, etc.)
|
||||
* **Per-env SBOM posture** (not just deploy health): critical reachable, SBOM freshness, reachability coverage
|
||||
* **Nightly Jobs / Data Health** summary (feeds, rescan backlog, integration connectivity)
|
||||
* Quick jumps into **Bundles**, **Approvals**, **Environment Detail**, **Nightly Ops Report**
|
||||
|
||||
### Why changed
|
||||
|
||||
This page must drive **release governance**. The first question is not “what deployed?” but:
|
||||
**“What can be safely promoted in each region, given current SBOM + reachability + feed health?”**
|
||||
|
||||
---
|
||||
|
||||
## Screen graph (Mermaid)
|
||||
|
||||
```mermaid
|
||||
flowchart TD
|
||||
CP[Release Control: Control Plane] --> A[Approvals Queue]
|
||||
CP --> R[Releases List]
|
||||
CP --> B[Bundle Catalog]
|
||||
CP --> E[Environment Detail]
|
||||
CP --> P[Promotion Paths]
|
||||
CP --> S[Security Overview]
|
||||
CP --> N[Operations: Nightly Ops Report]
|
||||
CP --> I[Integrations: Status]
|
||||
CP --> EV[Evidence & Audit: Export Center]
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## ASCII mock
|
||||
|
||||
```text
|
||||
┌───────────────────────────────────────────────────────────────────────────────────────────────┐
|
||||
│ RELEASE CONTROL ▸ CONTROL PLANE [Create Bundle] │
|
||||
│ Formerly: Control Plane │
|
||||
├───────────────────────────────────────────────────────────────────────────────────────────────┤
|
||||
│ Region: [All ▾] eu-west us-east ap-south Time: Last 24h ▾ │
|
||||
│ Data Health: OSV OK | NVD STALE | Registry OK | Vault OK | Jenkins DEGRADED → [Nightly Ops] │
|
||||
├───────────────────────────────────────────────────────────────────────────────────────────────┤
|
||||
│ REGION PIPELINE (env status + SBOM posture) │
|
||||
│ ┌───────────────┐ ┌───────────────┐ ┌───────────────┐ ┌───────────────┐ │
|
||||
│ │ Dev │→ │ Staging │→ │ UAT │→ │ Production │ │
|
||||
│ │ Deploy: OK │ │ Deploy: OK │ │ Deploy: ? │ │ Deploy: DEG │ │
|
||||
│ │ SBOM: 0 crit │ │ SBOM: 1 crit* │ │ SBOM: - │ │ SBOM: 5 crit* │ │
|
||||
│ │ ReachCov: 72% │ │ ReachCov: 81% │ │ ReachCov: - │ │ ReachCov: 58% │ │
|
||||
│ │ [Open] │ │ [Open] │ │ [Open] │ │ [Open] │ │
|
||||
│ └───────────────┘ └───────────────┘ └───────────────┘ └───────────────┘ │
|
||||
│ *crit = critical reachable │
|
||||
├───────────────────────────────────────────────────────────────────────────────────────────────┤
|
||||
│ PENDING APPROVALS (region/env aware) ACTIVE DEPLOYMENTS │
|
||||
│ - api-gateway@bundle v2.1.0 staging→prod PASS 1/2 - hotfix 1.2.4 prod-eu RUNNING │
|
||||
│ - user-service@bundle v3.0.0 staging→prod BLOCK 0/2 [View All] │
|
||||
│ [View Approvals] │
|
||||
├───────────────────────────────────────────────────────────────────────────────────────────────┤
|
||||
│ BUNDLES READY / AT RISK │
|
||||
│ - Bundle: platform@v1.3.0-rc1 Staging SBOM: clean Evidence: 92% [Open Bundle] │
|
||||
│ - Bundle: api-gateway@v2.1.0 Prod SBOM: 3 crit* NVD stale [Open Findings] │
|
||||
└───────────────────────────────────────────────────────────────────────────────────────────────┘
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
# 3) Release Control → Bundles → Bundle Catalog
|
||||
|
||||
### Previously
|
||||
|
||||
* **Formerly:** no explicit bundle concept.
|
||||
|
||||
* Bundling was implied by `Releases` and “components count”.
|
||||
* Digest was primary; “bundle organization” and “per-repo changelog” were not first-class.
|
||||
|
||||
### Now (Redesign)
|
||||
|
||||
* **Now:** `Release Control → Bundles → Bundle Catalog`
|
||||
|
||||
* Lists **Bundle Versions** as the thing that gets promoted
|
||||
* Shows **security posture per bundle** (critical reachable counts, reachability coverage)
|
||||
* Shows **evidence completeness** (is the bundle audit-ready)
|
||||
* One click to “Create Release” or “Request Approval” in a region/env
|
||||
|
||||
### Why changed
|
||||
|
||||
StellaOps is “**promote by digest**,” but humans and auditors reason in **versions** and **bundles**:
|
||||
|
||||
* “api-gateway v2.1.0 in prod-eu” (bundle version)
|
||||
* “what changed since v2.0.9” (changelog)
|
||||
* “what config snapshot was used” (Vault/Consul references)
|
||||
|
||||
---
|
||||
|
||||
## Screen graph (Mermaid)
|
||||
|
||||
```mermaid
|
||||
flowchart TD
|
||||
BC[Bundle Catalog] --> BD[Bundle Detail]
|
||||
BC --> BO[Bundle Organizer]
|
||||
BC --> RV[Repositories & Versions]
|
||||
BC --> AQ[Approvals Queue]
|
||||
BC --> RL[Releases List]
|
||||
BC --> SF[Security Findings (filtered)]
|
||||
BC --> EV[Evidence & Audit: Export Center]
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## ASCII mock
|
||||
|
||||
```text
|
||||
┌───────────────────────────────────────────────────────────────────────────────────────────────┐
|
||||
│ RELEASE CONTROL ▸ BUNDLES ▸ CATALOG [ + Create Bundle ] │
|
||||
│ Formerly: (N/A) Bundles were implicit under Releases/components │
|
||||
├───────────────────────────────────────────────────────────────────────────────────────────────┤
|
||||
│ Filters: Repo ▾ Bundle Name ▾ Version ▾ Region ▾ Env ▾ SBOM Status ▾ Evidence ▾ │
|
||||
├───────────────────────────────────────────────────────────────────────────────────────────────┤
|
||||
│ Bundle Version Repo Scope SBOM (crit*) ReachCov Evidence Actions │
|
||||
│-------------------------------------------------------------------------------------------------│
|
||||
│ api-gateway v2.1.0 gateway-repo 3 crit* 81% 88% [Open] [Rel] │
|
||||
│ user-service v3.0.0-rc1 user-repo 0 77% 91% [Open] [Rel] │
|
||||
│ platform v1.3.0-rc1 multi-repo 1 high* 66% 74% [Open] [Rel] │
|
||||
│ *crit* = critical reachable (hybrid reachability) │
|
||||
│ [Rel] = Create Release / Request Approval │
|
||||
└───────────────────────────────────────────────────────────────────────────────────────────────┘
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
# 4) Release Control → Bundles → Bundle Organizer (the missing core)
|
||||
|
||||
### Previously
|
||||
|
||||
* **Formerly:** partial/implicit across:
|
||||
|
||||
* `Releases` (components count)
|
||||
* SCM/CI (outside StellaOps) for composing “what is in a release”
|
||||
* Vault/Consul config was not attached as a release artifact
|
||||
* No consistent “digest→version” mapping with changelog & config snapshot
|
||||
|
||||
### Now (Redesign)
|
||||
|
||||
* **Now:** `Release Control → Bundles → Bundle Organizer`
|
||||
|
||||
* **Digest→Version**: a microservice digest becomes a **bundle version** (semver/rc)
|
||||
* **Bundle composition**: multiple microservices + their pinned digests/versions
|
||||
* **Env variables**: references to **Vault** and **Consul** keys used for a given env/region
|
||||
(store pointers + redacted resolved values, not secrets)
|
||||
* **Per-repo changelog**: commits/tags between prior version and new digest
|
||||
* Built-in “security/evidence readiness” before generating a release/approval
|
||||
|
||||
### Why changed
|
||||
|
||||
This is the governance kernel: **what exactly is being promoted**, with **what config**, and **what changed**, in a form that is exportable as evidence.
|
||||
|
||||
---
|
||||
|
||||
## Screen graph (Mermaid)
|
||||
|
||||
```mermaid
|
||||
flowchart TD
|
||||
BO[Bundle Organizer] --> BD[Bundle Detail]
|
||||
BO --> RV[Repositories & Versions]
|
||||
BO --> INT[Integrations: SCM/CI/Registry/Vault/Consul]
|
||||
BO --> SF[Security Findings (bundle filtered)]
|
||||
BO --> EV[Evidence & Audit: Proof Chain + Export]
|
||||
BO --> REL[Create Release]
|
||||
BO --> APR[Request Approval]
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## ASCII mock (tabs show bundle composition + config + changelog)
|
||||
|
||||
```text
|
||||
┌───────────────────────────────────────────────────────────────────────────────────────────────┐
|
||||
│ RELEASE CONTROL ▸ BUNDLES ▸ ORGANIZER: Create/Update Bundle │
|
||||
│ Formerly: (N/A) Composition lived across CI/CD + Releases list │
|
||||
├───────────────────────────────────────────────────────────────────────────────────────────────┤
|
||||
│ Bundle: [api-gateway] Version: [v2.1.0 ▾] Region: [eu-west ▾] Target Env: [staging→prod ▾] │
|
||||
│ Repo(s): gateway-repo, auth-repo, shared-lib-repo │
|
||||
│ Tabs: [Components] [Config (Vault/Consul)] [Changelog] [Security] [Evidence] │
|
||||
├───────────────────────────────────────────────────────────────────────────────────────────────┤
|
||||
│ COMPONENTS │
|
||||
│ Service/Microservice Digest (registry) Derived Version SBOM Reach (H/B/I/R) │
|
||||
│-------------------------------------------------------------------------------------------------│
|
||||
│ api-gateway sha256:abc... v2.1.0 OK YES/NO/YES/YES │
|
||||
│ auth-sidecar sha256:def... v1.8.4 WARN NO/NO/YES/NO │
|
||||
│ shared-config git: tag v4.2.0 → v4.2.1 v4.2.1 - - │
|
||||
│ [ + Add service ] [Auto-derive versions] [Pin digests] │
|
||||
├───────────────────────────────────────────────────────────────────────────────────────────────┤
|
||||
│ CONFIG (Vault / Consul) (stored as references + redacted snapshot) │
|
||||
│ Vault paths: kv/prod/eu-west/api-gateway/* (status: connected) │
|
||||
│ Consul prefix: eu-west/prod/api-gateway/ (status: connected) │
|
||||
│ Resolved variables (redacted): RATE_LIMIT=*** DB_HOST=*** FEATURE_FLAG_X=*** │
|
||||
│ [Validate access] [Snapshot config refs] [Diff vs previous bundle] │
|
||||
├───────────────────────────────────────────────────────────────────────────────────────────────┤
|
||||
│ CHANGELOG (per repository) │
|
||||
│ gateway-repo: v2.0.9 → digest abc... 12 commits 3 PRs [View] │
|
||||
│ auth-repo: v1.8.3 → digest def... 4 commits 1 PR [View] │
|
||||
│ [Generate release notes] [Attach links] │
|
||||
├───────────────────────────────────────────────────────────────────────────────────────────────┤
|
||||
│ ACTIONS │
|
||||
│ [Save Bundle Draft] [Sign Bundle] [Create Release] [Request Approval] │
|
||||
└───────────────────────────────────────────────────────────────────────────────────────────────┘
|
||||
```
|
||||
|
||||
**Reachability note:** the table explicitly shows **Hybrid/Build/Image(Dover)/Runtime** reach flags (second-class, not buried).
|
||||
|
||||
---
|
||||
|
||||
# 5) Release Control → Bundles → Bundle Detail
|
||||
|
||||
### Previously
|
||||
|
||||
* **Formerly:** fragmented:
|
||||
|
||||
* Release row detail (not dedicated)
|
||||
* Evidence scattered under Evidence menu
|
||||
* Config (Vault/Consul) not attached as a release artifact
|
||||
|
||||
### Now (Redesign)
|
||||
|
||||
* **Now:** `Release Control → Bundles → Bundle Detail`
|
||||
|
||||
* Shows: components + digests + derived versions
|
||||
* Config snapshot pointers (Vault/Consul)
|
||||
* Security posture (crit reachable, VEX coverage)
|
||||
* Evidence readiness + export
|
||||
* Buttons: create release, request approval, open findings
|
||||
|
||||
### Why changed
|
||||
|
||||
Bundle Detail is the **canonical “what is this thing?”** page used by:
|
||||
|
||||
* release managers,
|
||||
* security reviewers,
|
||||
* auditors.
|
||||
|
||||
---
|
||||
|
||||
## Screen graph (Mermaid)
|
||||
|
||||
```mermaid
|
||||
flowchart TD
|
||||
BD[Bundle Detail] --> BO[Bundle Organizer]
|
||||
BD --> REL[Create Release]
|
||||
BD --> APR[Request Approval]
|
||||
BD --> SF[Security Findings (bundle filtered)]
|
||||
BD --> VEX[VEX Hub (bundle filtered)]
|
||||
BD --> ENV[Environment Detail (where deployed)]
|
||||
BD --> EV[Evidence & Audit: Export Bundle]
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## ASCII mock
|
||||
|
||||
```text
|
||||
┌───────────────────────────────────────────────────────────────────────────────────────────────┐
|
||||
│ RELEASE CONTROL ▸ BUNDLES ▸ DETAIL: api-gateway v2.1.0 │
|
||||
│ Formerly: (N/A) This information was split across Releases + external CI/CD │
|
||||
├───────────────────────────────────────────────────────────────────────────────────────────────┤
|
||||
│ Scope: Region eu-west | Promotion: staging → production │
|
||||
│ Security: Critical reachable: 3 High reachable: 1 VEX: awaiting 2 │
|
||||
│ Data provenance: SBOM snapshot 2026-02-18T02:00Z | CVE dataset OSV OK | NVD STALE │
|
||||
│ Actions: [Edit Bundle] [Create Release] [Request Approval] [Export Evidence] │
|
||||
├───────────────────────────────────────────────────────────────────────────────────────────────┤
|
||||
│ COMPONENTS (pinned) │
|
||||
│ - api-gateway v2.1.0 digest sha256:abc... │
|
||||
│ - auth-sidecar v1.8.4 digest sha256:def... │
|
||||
│ - shared-config v4.2.1 git tag │
|
||||
├───────────────────────────────────────────────────────────────────────────────────────────────┤
|
||||
│ CONFIG REFERENCES │
|
||||
│ Vault: kv/prod/eu-west/api-gateway/* Consul: eu-west/prod/api-gateway/* │
|
||||
│ Config diff vs previous: 7 keys changed (redacted) [View Diff] │
|
||||
├───────────────────────────────────────────────────────────────────────────────────────────────┤
|
||||
│ DEPLOYMENT FOOTPRINT │
|
||||
│ Deployed in: staging-eu (YES) prod-eu (NO) runtime inventory fresh: 54% │
|
||||
│ [Open Environment Detail] │
|
||||
└───────────────────────────────────────────────────────────────────────────────────────────────┘
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
# 6) Release Control → Bundles → Repositories & Versions
|
||||
|
||||
### Previously
|
||||
|
||||
* **Formerly:** implicit across SCM tags and container registries; StellaOps didn’t own the “digest→version lineage”.
|
||||
|
||||
### Now (Redesign)
|
||||
|
||||
* **Now:** `Release Control → Bundles → Repositories & Versions`
|
||||
|
||||
* Per repo:
|
||||
|
||||
* last built digests
|
||||
* derived versions
|
||||
* SBOM status + scan freshness
|
||||
* changelog anchors (tags/commits)
|
||||
* Feeds into Bundle Organizer
|
||||
|
||||
### Why changed
|
||||
|
||||
You can’t do bundle governance without a stable mapping from:
|
||||
**repo changes → artifact digest → bundle version → release approval decision**.
|
||||
|
||||
---
|
||||
|
||||
## Screen graph (Mermaid)
|
||||
|
||||
```mermaid
|
||||
flowchart TD
|
||||
RV[Repositories & Versions] --> BO[Bundle Organizer]
|
||||
RV --> BD[Bundle Detail (filtered)]
|
||||
RV --> INT[Integrations: SCM/Registry/CI]
|
||||
RV --> SF[Security Findings (repo/component filtered)]
|
||||
RV --> N[Operations: Nightly Ops Report (failed scans/builds)]
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## ASCII mock
|
||||
|
||||
```text
|
||||
┌───────────────────────────────────────────────────────────────────────────────────────────────┐
|
||||
│ RELEASE CONTROL ▸ BUNDLES ▸ REPOSITORIES & VERSIONS │
|
||||
│ Formerly: (N/A) Versioning lineage lived outside StellaOps │
|
||||
├───────────────────────────────────────────────────────────────────────────────────────────────┤
|
||||
│ Repo: [gateway-repo ▾] Branch: main ▾ Time: Last 30d ▾ │
|
||||
├───────────────────────────────────────────────────────────────────────────────────────────────┤
|
||||
│ Digest Derived Version Built By SBOM Fresh Crit* Notes │
|
||||
│-------------------------------------------------------------------------------------------------│
|
||||
│ sha256:abc... v2.1.0 Jenkins <24h 3 used in prod-eu? NO │
|
||||
│ sha256:aaa... v2.0.9 Jenkins 7d 0 previous stable │
|
||||
│ Actions: [Open in Bundle Organizer] [View Changelog] [View Findings] │
|
||||
└───────────────────────────────────────────────────────────────────────────────────────────────┘
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
# 7) Release Control → Releases → Releases List
|
||||
|
||||
### Previously
|
||||
|
||||
* **Formerly:** `Releases` (top-level) `/releases`
|
||||
|
||||
* Listed releases with status, env, components, created, actions.
|
||||
|
||||
### Now (Redesign)
|
||||
|
||||
* **Now:** `Release Control → Releases → Releases List`
|
||||
|
||||
* Adds:
|
||||
|
||||
* **Region** filter and region column
|
||||
* **Bundle link** (release points to a bundle version)
|
||||
* **Security snapshot** at time of release creation (crit reachable, feed status)
|
||||
* Evidence readiness (quick indicator)
|
||||
|
||||
### Why changed
|
||||
|
||||
A release is the **execution** of promoting a **bundle** into a **region/env**—with a captured security/evidence snapshot.
|
||||
|
||||
---
|
||||
|
||||
## Screen graph (Mermaid)
|
||||
|
||||
```mermaid
|
||||
flowchart TD
|
||||
RL[Releases List] --> RD[Release Detail]
|
||||
RL --> BD[Bundle Detail]
|
||||
RL --> AQ[Approvals Queue (filtered)]
|
||||
RL --> ENV[Environment Detail]
|
||||
RL --> EV[Evidence & Audit: Export Center]
|
||||
RL --> SF[Security Findings (release snapshot)]
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## ASCII mock
|
||||
|
||||
```text
|
||||
┌───────────────────────────────────────────────────────────────────────────────────────────────┐
|
||||
│ RELEASE CONTROL ▸ RELEASES ▸ LIST [ + Create Release ]│
|
||||
│ Formerly: Releases (top-level) /releases │
|
||||
├───────────────────────────────────────────────────────────────────────────────────────────────┤
|
||||
│ Filters: Status ▾ Region ▾ Env ▾ Bundle ▾ Type ▾(release/hotfix) │
|
||||
├───────────────────────────────────────────────────────────────────────────────────────────────┤
|
||||
│ Release Bundle Status Region Env Path Crit* Evidence │
|
||||
│-------------------------------------------------------------------------------------------------│
|
||||
│ Hotfix 1.2.4 platform@1.2.4 DEPLOYING eu-west staging→prod 0 93% │
|
||||
│ Platform 1.3.0-rc1 platform@1.3.0 READY us-east staging→prod 1 74% │
|
||||
│ Actions: [Open] [Open Bundle] [Open Approvals] [Export Evidence] │
|
||||
└───────────────────────────────────────────────────────────────────────────────────────────────┘
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
# 8) Release Control → Releases → Release Detail
|
||||
|
||||
### Previously
|
||||
|
||||
* **Formerly:** release row “View” icon; no canonical execution page shown in the PoC.
|
||||
|
||||
### Now (Redesign)
|
||||
|
||||
* **Now:** `Release Control → Releases → Release Detail`
|
||||
|
||||
* Execution timeline:
|
||||
|
||||
* selected targets
|
||||
* workflow steps
|
||||
* deployment status by target
|
||||
* rollback state
|
||||
* Security snapshot at decision time (crit reachable, reach coverage)
|
||||
* Evidence snapshot (policy decision, approvals, signatures)
|
||||
* Links to Orchestrator/Scheduler when something fails
|
||||
|
||||
### Why changed
|
||||
|
||||
This is the page that explains:
|
||||
|
||||
* what happened,
|
||||
* why it was allowed,
|
||||
* and what evidence proves it.
|
||||
|
||||
---
|
||||
|
||||
## Screen graph (Mermaid)
|
||||
|
||||
```mermaid
|
||||
flowchart TD
|
||||
RD[Release Detail] --> BD[Bundle Detail]
|
||||
RD --> AD[Approval Detail]
|
||||
RD --> ENV[Environment Detail]
|
||||
RD --> WF[Workflows]
|
||||
RD --> T[Targets]
|
||||
RD --> O[Operations: Orchestrator]
|
||||
RD --> S[Operations: Scheduler Runs]
|
||||
RD --> SF[Security Findings (snapshot)]
|
||||
RD --> EV[Evidence & Audit: Export Evidence Bundle]
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## ASCII mock
|
||||
|
||||
```text
|
||||
┌───────────────────────────────────────────────────────────────────────────────────────────────┐
|
||||
│ RELEASE CONTROL ▸ RELEASE DETAIL: Hotfix 1.2.4 │
|
||||
│ Formerly: Releases list → row “View” │
|
||||
├───────────────────────────────────────────────────────────────────────────────────────────────┤
|
||||
│ Bundle: platform@1.2.4 Region: eu-west Path: staging → production Status: DEPLOYING │
|
||||
│ Security snapshot: crit reachable=0 | reach cov=78% | feeds: OSV OK, NVD OK │
|
||||
│ Evidence snapshot: policy decision signed | approvals 2/2 | proof chain complete=YES │
|
||||
│ Actions: [Rollback] [Pause] [Export Evidence] [Open Bundle] │
|
||||
├───────────────────────────────────────────────────────────────────────────────────────────────┤
|
||||
│ TARGET EXECUTION │
|
||||
│ Target Status Workflow Step Last Update Logs │
|
||||
│-------------------------------------------------------------------------------------------------│
|
||||
│ prod-eu-1 RUNNING Deploy → Verify 2m ago [View] │
|
||||
│ prod-eu-2 PENDING Deploy - - │
|
||||
├───────────────────────────────────────────────────────────────────────────────────────────────┤
|
||||
│ TIMELINE │
|
||||
│ ✓ bundle resolved → ✓ policy gates → ✓ approvals → ▶ deploy(prod-eu-1) → ▢ deploy(prod-eu-2) │
|
||||
└───────────────────────────────────────────────────────────────────────────────────────────────┘
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
# 9) Release Control → Approvals → Approvals Queue
|
||||
|
||||
### Previously
|
||||
|
||||
* **Formerly:** `Approvals` (top-level) `/approvals`
|
||||
Showed approval cards with policy gates, approvals count, approve/reject.
|
||||
|
||||
### Now (Redesign)
|
||||
|
||||
* **Now:** `Release Control → Approvals → Queue`
|
||||
|
||||
* Adds:
|
||||
|
||||
* region filter and explicit “this is blocked because crit reachable in env X”
|
||||
* **hybrid reachability** breakdown in the card (H/B/I/R)
|
||||
* explicit “data health” banner if feeds/scans stale (to prevent approving blind)
|
||||
|
||||
### Why changed
|
||||
|
||||
Approvals are where release control meets security/evidence. The queue must show:
|
||||
|
||||
* “blocked because real exploitable risk exists”
|
||||
* “blocked because we don’t have trustworthy data”
|
||||
|
||||
---
|
||||
|
||||
## Screen graph (Mermaid)
|
||||
|
||||
```mermaid
|
||||
flowchart TD
|
||||
AQ[Approvals Queue] --> AD[Approval Detail]
|
||||
AQ --> BD[Bundle Detail]
|
||||
AQ --> SF[Security Findings (filtered)]
|
||||
AQ --> EX[Security Exceptions (filtered)]
|
||||
AQ --> N[Operations: Nightly Ops Report]
|
||||
AQ --> EV[Evidence & Audit: Proof Chain]
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## ASCII mock
|
||||
|
||||
```text
|
||||
┌───────────────────────────────────────────────────────────────────────────────────────────────┐
|
||||
│ RELEASE CONTROL ▸ APPROVALS ▸ QUEUE │
|
||||
│ Formerly: Approvals (top-level) /approvals │
|
||||
├───────────────────────────────────────────────────────────────────────────────────────────────┤
|
||||
│ Filters: Status ▾ Region ▾ Env ▾ Bundle ▾ │
|
||||
│ Banner: NVD stale → approvals may be incomplete [Open Nightly Ops Report] │
|
||||
├───────────────────────────────────────────────────────────────────────────────────────────────┤
|
||||
│ [Pending] api-gateway bundle v2.1.0 staging→prod (eu-west) Policy: PASS 1/2 Approvals: 1/2│
|
||||
│ Security: crit reachable=3 (prod-eu) Reach(H/B/I/R)=YES/NO/YES/YES VEX awaiting=2 │
|
||||
│ Actions: [View Details] [Approve] [Reject] [Request Exception] │
|
||||
│-------------------------------------------------------------------------------------------------│
|
||||
│ [Pending] user-service bundle v3.0.0-rc1 staging→prod (us-east) Policy: BLOCK 0/2 Approvals 0/2│
|
||||
│ Block reason: Evidence incomplete (missing signed policy decision) │
|
||||
│ Actions: [View Details] [Open Evidence] │
|
||||
└───────────────────────────────────────────────────────────────────────────────────────────────┘
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
# 10) Release Control → Approvals → Approval Detail
|
||||
|
||||
### Previously
|
||||
|
||||
* **Formerly:** Approvals card “View Details” (not shown as a full audit-grade page).
|
||||
|
||||
### Now (Redesign)
|
||||
|
||||
* **Now:** `Release Control → Approvals → Approval Detail`
|
||||
|
||||
* Full gate breakdown:
|
||||
|
||||
* security (crit reachable, VEX, exceptions)
|
||||
* evidence (signed decision, proofs)
|
||||
* data freshness (feeds/scans)
|
||||
* Shows “approve” rationale (captured, signed, exportable)
|
||||
|
||||
### Why changed
|
||||
|
||||
Approval is the most scrutinized action. It must produce a **defensible audit artifact**.
|
||||
|
||||
---
|
||||
|
||||
## Screen graph (Mermaid)
|
||||
|
||||
```mermaid
|
||||
flowchart TD
|
||||
AD[Approval Detail] --> BD[Bundle Detail]
|
||||
AD --> SF[Security Findings]
|
||||
AD --> EX[Exceptions]
|
||||
AD --> VEX[VEX Hub]
|
||||
AD --> EV[Evidence & Audit: Proof Chain + Export]
|
||||
AD --> N[Operations: Nightly Ops Report]
|
||||
AD --> RD[Release Detail (after approval)]
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## ASCII mock
|
||||
|
||||
```text
|
||||
┌───────────────────────────────────────────────────────────────────────────────────────────────┐
|
||||
│ RELEASE CONTROL ▸ APPROVAL DETAIL: api-gateway v2.1.0 staging→prod (eu-west) │
|
||||
│ Formerly: Approvals list → card “View Details” │
|
||||
├───────────────────────────────────────────────────────────────────────────────────────────────┤
|
||||
│ Decision: PENDING Requested by: alice.johnson Age: 36d │
|
||||
│ Bundle: api-gateway v2.1.0 Target: prod-eu │
|
||||
├───────────────────────────────────────────────────────────────────────────────────────────────┤
|
||||
│ GATES │
|
||||
│ - Security Gate: FAIL (crit reachable=3) [View Findings] [Request Exception] │
|
||||
│ - Evidence Gate: PASS (policy decision signed, proof chain complete) [Open Proof Chain] │
|
||||
│ - Data Freshness: WARN (NVD stale) [Open Nightly Ops Report] │
|
||||
├───────────────────────────────────────────────────────────────────────────────────────────────┤
|
||||
│ APPROVER ACTION │
|
||||
│ Rationale (required): _______________________________________________________________ │
|
||||
│ [Approve] [Reject] (writes signed decision + links evidence bundle) │
|
||||
└───────────────────────────────────────────────────────────────────────────────────────────────┘
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
# 11) Release Control → Regions & Environments → Region Overview
|
||||
|
||||
### Previously
|
||||
|
||||
* **Formerly:** `Settings → Release Control → Environments` (“Manage Environments”)
|
||||
Region concept was missing/implicit.
|
||||
|
||||
### Now (Redesign)
|
||||
|
||||
* **Now:** `Release Control → Regions & Environments → Region Overview`
|
||||
|
||||
* Regions are the top organizing primitive
|
||||
* Each region lists envs (dev/staging/prod) with:
|
||||
|
||||
* deployment health
|
||||
* **SBOM posture** (crit reachable counts)
|
||||
* freshness of runtime inventory
|
||||
|
||||
### Why changed
|
||||
|
||||
Promotion decisions differ by region (different runtime reality, different config sources, different agent health).
|
||||
|
||||
---
|
||||
|
||||
## Screen graph (Mermaid)
|
||||
|
||||
```mermaid
|
||||
flowchart TD
|
||||
REG[Region Overview] --> ENV[Environment Detail]
|
||||
REG --> PROMO[Promotion Paths]
|
||||
REG --> T[Targets]
|
||||
REG --> A[Agents]
|
||||
REG --> SEC[Security Overview (region filtered)]
|
||||
REG --> OPS[Operations: Platform Health]
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## ASCII mock
|
||||
|
||||
```text
|
||||
┌───────────────────────────────────────────────────────────────────────────────────────────────┐
|
||||
│ RELEASE CONTROL ▸ REGIONS & ENVIRONMENTS ▸ REGION OVERVIEW │
|
||||
│ Formerly: Settings ▸ Release Control ▸ Environments │
|
||||
├───────────────────────────────────────────────────────────────────────────────────────────────┤
|
||||
│ Region: eu-west │
|
||||
│ Environments: │
|
||||
│ - dev-eu Deploy OK SBOM crit*=0 Runtime inventory fresh 68% [Open] │
|
||||
│ - staging-eu Deploy OK SBOM crit*=1 Runtime inventory fresh 61% [Open] │
|
||||
│ - prod-eu Deploy DEG SBOM crit*=5 Runtime inventory fresh 54% [Open] │
|
||||
│ *crit* = critical reachable (hybrid) │
|
||||
│ [Configure Promotion Paths] [Targets] [Agents] │
|
||||
└───────────────────────────────────────────────────────────────────────────────────────────────┘
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
# 12) Release Control → Regions & Environments → Environment Detail
|
||||
|
||||
### Previously
|
||||
|
||||
* **Formerly:** partially under Settings/Release Control and scattered operational pages.
|
||||
|
||||
### Now (Redesign)
|
||||
|
||||
* **Now:** `Release Control → Regions & Environments → Environment Detail`
|
||||
|
||||
* Environment posture includes:
|
||||
|
||||
* deployment status
|
||||
* **image SBOM status**
|
||||
* reachability coverage (build/image/runtime)
|
||||
* config sources (Vault/Consul pointers used)
|
||||
* Shows “what’s running” and “what is promotable next”
|
||||
|
||||
### Why changed
|
||||
|
||||
This page must connect runtime truth (inventory) to release governance (approvals).
|
||||
|
||||
---
|
||||
|
||||
## Screen graph (Mermaid)
|
||||
|
||||
```mermaid
|
||||
flowchart TD
|
||||
ED[Environment Detail] --> AQ[Approvals Queue (env filtered)]
|
||||
ED --> RL[Releases List (env filtered)]
|
||||
ED --> BD[Bundle Catalog (env compatible)]
|
||||
ED --> SF[Security Findings (env filtered)]
|
||||
ED --> INT[Integrations: Vault/Consul/Registry]
|
||||
ED --> AG[Agents]
|
||||
ED --> TG[Targets]
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## ASCII mock
|
||||
|
||||
```text
|
||||
┌───────────────────────────────────────────────────────────────────────────────────────────────┐
|
||||
│ RELEASE CONTROL ▸ ENVIRONMENT DETAIL: prod-eu (eu-west) │
|
||||
│ Formerly: Settings ▸ Release Control (partial) + scattered ops pages │
|
||||
├───────────────────────────────────────────────────────────────────────────────────────────────┤
|
||||
│ Deploy Health: DEGRADED | Active release: Hotfix 1.2.4 (RUNNING) │
|
||||
│ SBOM Posture: crit reachable=5 | high reachable=7 │
|
||||
│ Reachability coverage: Build 92% | Image/Dover 96% | Runtime 54% │
|
||||
│ Config sources: Vault kv/prod/eu-west/* | Consul eu-west/prod/* │
|
||||
├───────────────────────────────────────────────────────────────────────────────────────────────┤
|
||||
│ WHAT’S RUNNING (inventory) │
|
||||
│ Service Version/Digest SBOM Fresh Crit* Reach(H/B/I/R) │
|
||||
│-------------------------------------------------------------------------------------------------│
|
||||
│ api-gateway v2.0.9 / sha256:aaa... <24h 3 YES/NO/YES/YES │
|
||||
│ user-service v2.9.4 / sha256:bbb... 3d 0 NO/NO/NO/NO │
|
||||
│ Actions: [View Findings] [Open Bundles compatible] [Open Approvals] │
|
||||
└───────────────────────────────────────────────────────────────────────────────────────────────┘
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
# 13) Release Control → Regions & Environments → Promotion Paths
|
||||
|
||||
### Previously
|
||||
|
||||
* **Formerly:** implicit in pipeline UI + Settings/Release Control environments; not region-aware.
|
||||
|
||||
### Now (Redesign)
|
||||
|
||||
* **Now:** `Release Control → Regions & Environments → Promotion Paths`
|
||||
|
||||
* Configure per region:
|
||||
|
||||
* allowed paths (dev→staging→prod)
|
||||
* gates required per hop
|
||||
* required evidence set for promotion (e.g., policy decision signed)
|
||||
|
||||
### Why changed
|
||||
|
||||
Promotion rules are governance, and **regions differ**.
|
||||
|
||||
---
|
||||
|
||||
## Screen graph (Mermaid)
|
||||
|
||||
```mermaid
|
||||
flowchart TD
|
||||
PP[Promotion Paths] --> ED[Environment Detail]
|
||||
PP --> WF[Workflows]
|
||||
PP --> POL[Administration: Policy Governance]
|
||||
PP --> EXW[Administration: Exception Workflow]
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## ASCII mock
|
||||
|
||||
```text
|
||||
┌───────────────────────────────────────────────────────────────────────────────────────────────┐
|
||||
│ RELEASE CONTROL ▸ PROMOTION PATHS (eu-west) │
|
||||
│ Formerly: implicit pipeline + Settings ▸ Release Control │
|
||||
├───────────────────────────────────────────────────────────────────────────────────────────────┤
|
||||
│ Path: dev-eu → staging-eu → prod-eu │
|
||||
│ Gates per hop: │
|
||||
│ - dev→staging: SBOM scan required, evidence optional │
|
||||
│ - staging→prod: no crit reachable, VEX required for high+ reachables, signed policy decision │
|
||||
│ Workflow template: prod-deploy-v3 │
|
||||
│ [Edit] [Link Workflow] [View Policy Rules] │
|
||||
└───────────────────────────────────────────────────────────────────────────────────────────────┘
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
# 14) Release Control → Delivery → Targets
|
||||
|
||||
### Previously
|
||||
|
||||
* **Formerly:** `Settings → Release Control → Targets`
|
||||
|
||||
### Now (Redesign)
|
||||
|
||||
* **Now:** `Release Control → Delivery → Targets`
|
||||
|
||||
* Targets are region/env scoped (prod-eu-1, prod-us-2, etc.)
|
||||
* Show target readiness and compatibility (agent health, required capabilities)
|
||||
|
||||
### Why changed
|
||||
|
||||
Targets are operational, but they determine whether a release can execute safely. Keeping them under Release Control preserves governance context.
|
||||
|
||||
---
|
||||
|
||||
## Screen graph (Mermaid)
|
||||
|
||||
```mermaid
|
||||
flowchart TD
|
||||
T[Targets] --> ED[Environment Detail]
|
||||
T --> A[Agents]
|
||||
T --> WF[Workflows]
|
||||
T --> RD[Release Detail]
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## ASCII mock
|
||||
|
||||
```text
|
||||
┌───────────────────────────────────────────────────────────────────────────────────────────────┐
|
||||
│ RELEASE CONTROL ▸ DELIVERY ▸ TARGETS │
|
||||
│ Formerly: Settings ▸ Release Control ▸ Targets │
|
||||
├───────────────────────────────────────────────────────────────────────────────────────────────┤
|
||||
│ Filters: Region ▾ Env ▾ Status ▾ │
|
||||
│ Target Region Env Agent Status Capabilities │
|
||||
│-------------------------------------------------------------------------------------------------│
|
||||
│ prod-eu-1 eu-west prod-eu agent-eu-1 READY deploy,verify,inventory │
|
||||
│ prod-eu-2 eu-west prod-eu agent-eu-2 DEGRADED deploy │
|
||||
│ Actions: [Open] [Test] [Assign Workflow] │
|
||||
└───────────────────────────────────────────────────────────────────────────────────────────────┘
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
# 15) Release Control → Delivery → Agents
|
||||
|
||||
### Previously
|
||||
|
||||
* **Formerly:** `Settings → Release Control → Agents`
|
||||
|
||||
### Now (Redesign)
|
||||
|
||||
* **Now:** `Release Control → Delivery → Agents`
|
||||
|
||||
* Agents are tied to targets and regions
|
||||
* Must show whether agents can also provide required **runtime inventory** signals (needed for hybrid reachability)
|
||||
|
||||
### Why changed
|
||||
|
||||
Agent health affects not only deployment but **whether your reachability and inventory data is trustworthy**.
|
||||
|
||||
---
|
||||
|
||||
## Screen graph (Mermaid)
|
||||
|
||||
```mermaid
|
||||
flowchart TD
|
||||
AG[Agents] --> T[Targets]
|
||||
AG --> ED[Environment Detail]
|
||||
AG --> OPS[Operations: Platform Health]
|
||||
AG --> N[Operations: Nightly Ops Report]
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## ASCII mock
|
||||
|
||||
```text
|
||||
┌───────────────────────────────────────────────────────────────────────────────────────────────┐
|
||||
│ RELEASE CONTROL ▸ DELIVERY ▸ AGENTS │
|
||||
│ Formerly: Settings ▸ Release Control ▸ Agents │
|
||||
├───────────────────────────────────────────────────────────────────────────────────────────────┤
|
||||
│ Agent Region Status Deploy Capable Runtime Inventory Last Seen Notes │
|
||||
│-------------------------------------------------------------------------------------------------│
|
||||
│ agent-eu-1 eu-west OK YES YES 1m ago - │
|
||||
│ agent-eu-2 eu-west DEGRADED YES NO 2h ago inventory stuck│
|
||||
│ Actions: [Open] [Restart] [View Logs] │
|
||||
└───────────────────────────────────────────────────────────────────────────────────────────────┘
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
# 16) Release Control → Delivery → Workflows
|
||||
|
||||
### Previously
|
||||
|
||||
* **Formerly:** `Settings → Release Control → Workflows`
|
||||
|
||||
### Now (Redesign)
|
||||
|
||||
* **Now:** `Release Control → Delivery → Workflows`
|
||||
|
||||
* Workflow templates include:
|
||||
|
||||
* deploy steps
|
||||
* verify steps
|
||||
* evidence capture steps (sign decisions, export proofs)
|
||||
* optional SBOM scan / rescan triggers (for hotfix)
|
||||
|
||||
### Why changed
|
||||
|
||||
Workflows enforce consistency across releases/hotpatches and ensure evidence is captured uniformly.
|
||||
|
||||
---
|
||||
|
||||
## Screen graph (Mermaid)
|
||||
|
||||
```mermaid
|
||||
flowchart TD
|
||||
WF[Workflows] --> RD[Release Detail]
|
||||
WF --> PP[Promotion Paths]
|
||||
WF --> T[Targets]
|
||||
WF --> EV[Evidence & Audit: Proof Chains]
|
||||
WF --> OPS[Operations: Scheduler/Orchestrator]
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## ASCII mock
|
||||
|
||||
```text
|
||||
┌───────────────────────────────────────────────────────────────────────────────────────────────┐
|
||||
│ RELEASE CONTROL ▸ DELIVERY ▸ WORKFLOWS │
|
||||
│ Formerly: Settings ▸ Release Control ▸ Workflows │
|
||||
├───────────────────────────────────────────────────────────────────────────────────────────────┤
|
||||
│ Workflow Template: prod-deploy-v3 │
|
||||
│ Steps: │
|
||||
│ 1) Resolve bundle + config refs (Vault/Consul) │
|
||||
│ 2) Policy gates (security + evidence + data freshness) │
|
||||
│ 3) Require approvals │
|
||||
│ 4) Deploy to targets │
|
||||
│ 5) Verify (health + smoke) │
|
||||
│ 6) Capture evidence (signed decision, logs, provenance) │
|
||||
│ 7) Export bundle (optional) │
|
||||
│ [Edit] [Clone] [Assign to Promotion Path] │
|
||||
└───────────────────────────────────────────────────────────────────────────────────────────────┘
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## What stayed intact (your requirement)
|
||||
|
||||
* **Release Control is a root menu** (not grouped under Settings).
|
||||
* Security + Evidence + Operations remain separate roots; Release Control screens **link** to them where needed (findings, nightly jobs, export evidence), but do not absorb them.
|
||||
|
||||
---
|
||||
|
||||
## Next pack options (you choose with one line)
|
||||
|
||||
1. **Pack 9 — Administration (Settings)**: Identity & Access, Trust & Signing, Policy Governance, Notifications, Usage & Limits, System (with same Mermaid + ASCII + formerly/why).
|
||||
2. **Pack 10 — Integrations**: consolidate integrations + feeds under a coherent “data sources” model and show how degraded integrations bubble up into approvals/releases.
|
||||
Reference in New Issue
Block a user