DOCS.CODECR.ORG / RELEASE 8 OPERATIONS

Operate codecr inside your trust boundary.

Use this manual to prepare the CLI, edge-protected API access, repository events, inherited policy, Kubernetes runtime, hardware-isolated analysis workers, and customer-controlled keys.

RELEASE CONTRACT PREVIEW Examples define the intended operator interface—not proof that an endpoint or artifact is currently issued.

Obtain signed package URLs, checksums, chart versions, webhook endpoints, and environment-specific values from the controlled Trust Center release record before execution.

Open Trust Center controls

01INSTALLSigned CLI + scoped identity

02GOVERNDeterministic policy inheritance

03ISOLATEVPC, microVM, local KMS

04VERIFYEdge and release evidence

01 / GETTING STARTED

Establish identity before repository access.

Every installation begins with a signed artifact, a least-privilege API key, an explicit egress route, and a repository webhook whose signature is verified before its payload is accepted.

01.1

CLI installation

Download only the platform-specific package referenced by your Trust Center release record. Verify its checksum and release signature before placing the binary on a managed workstation or runner.

Artifact gate

The public preview does not publish a CLI archive or checksum. Replace every bracketed value with the immutable artifact data from your approved release record.

shell / controlled workstation

# Download from the signed URI in the Trust Center
curl --proto '=https' --tlsv1.2 --fail --location \
  '<approved-package-uri>' \
  --output codecr-cli.tar.gz

# Verify before extraction
sha256sum -c SHA256SUMS
cosign verify-blob codecr-cli.tar.gz \
  --signature codecr-cli.sig \
  --certificate codecr-cli.pem

tar -xzf codecr-cli.tar.gz
install -m 0755 codecr "$HOME/.local/bin/codecr"
codecr version

01.2

Cloudflare-proxied API key scoping

Cloudflare protects the network edge; codecr authorizes the application action. Issue separate, short-lived keys for human CLI use, CI review, and telemetry ingestion—never one key with combined read, write, and administrative authority.

Workload	Minimum scopes	Maximum TTL
PR review	`repo:read policy:read checks:write`	24 hours
Policy validation	`policy:read policy:validate`	8 hours
Telemetry ingest	`telemetry:write`	1 hour

shell / proposed CLI contract

codecr keys create \
  --name github-review-pilot \
  --scope repo:read \
  --scope policy:read \
  --scope checks:write \
  --ttl 24h

Edge request contract

Send the key only in Authorization: Bearer … over HTTPS. Never place it in a URL, query string, cookie, WAF expression, analytics field, or support ticket.

01.3

GitHub Enterprise and GitLab webhook setup

Create one webhook per enterprise organization or self-managed GitLab group. Restrict events to the pilot scope, retain delivery IDs for replay defense, and reject a payload before parsing when its signature or token is invalid.

Provider	Events	Verification
GitHub Enterprise	Pull request, push, check suite	`X-Hub-Signature-256`
GitLab Self-Managed	Merge request, push, pipeline	`X-Gitlab-Token` + source allowlist

expected endpoint contract

GitHub Enterprise
POST https://api.codecr.org/v1/webhooks/github
Content-Type: application/json
X-Hub-Signature-256: sha256=<signature>

GitLab Self-Managed
POST https://api.codecr.org/v1/webhooks/gitlab
Content-Type: application/json
X-Gitlab-Token: <rotated-secret>

# Activate only the endpoint issued for your pilot.
# Never use placeholder values in production.

02 / CONFIGURATION REFERENCE

Policy is source-controlled architecture.

.codecr.yaml resolves organizational controls into a deterministic repository gate. Parent policies are pinned by digest, repository authors may tighten controls, and only a centrally signed exception may relax them.

02.1

Author a high-assurance policy file

This example blocks high-blast-radius changes in payment services until the Security owner signs off, requires P0 remediation, and prevents a repository-local file from weakening the inherited control.

Pin every parent policy by immutable digest.
Use stable rule IDs that appear in audit evidence.
Bind approval to an identity group, not a display name.
Validate the resolved policy before enabling merge enforcement.

.codecr.yaml / payments organization

version: 1

extends:
  - ref: "org://fintech/security-baseline"
    digest: "sha256:<pinned-policy-digest>"

scope:
  include:
    - "services/payments/**"
    - "contracts/ledger/**"

inheritance:
  strategy: strict
  allow_repository_relaxation: false

policies:
  - id: "PAYMENTS-BLAST-RADIUS-001"
    description: "Security approval for high-impact payment changes"
    when:
      service_tags: ["payments", "ledger"]
      blast_radius:
        severity: ["high", "critical"]
    require:
      approvals:
        - group: "security-owners"
          minimum: 1
      checks:
        - "codecr/p0-analysis"
        - "codecr/dependency-map"
    on_violation:
      decision: block
      remediation: required
      evidence_retention: "customer-policy"

exceptions:
  require_signed_record: true
  approver_group: "enterprise-risk-owners"
  maximum_ttl: "24h"

02.2

Resolve multi-repo inheritance

Resolution flows from organization to portfolio, repository, and path. codecr records each source and digest in the decision evidence so reviewers can reproduce the effective rule set without relying on mutable defaults.

01Organization baselineMandatory identity, retention, and P0 controls

02Portfolio overlayPayments, healthcare, defense, or regional controls

03Repository policyService ownership and local test requirements

04Path ruleSchema, migration, secret, or privileged-code guardrail

DETERMINISTIC RESOLUTION

Conflict: The most restrictive enforceable rule wins.
Relaxation: Rejected unless a signed, unexpired exception authorizes the exact rule and scope.
Missing parent: Fail closed; do not evaluate against an unpinned substitute.
Evidence: Record source URI, digest, resolution order, decision, and approver identity.

03 / SELF-HOSTED + VPC

Bring the execution plane to the code.

The self-hosted data plane runs inside the customer network. Kubernetes schedules the services, a hardware-isolated runtime executes untrusted review workloads, and customer KMS policy controls envelope encryption and key rotation.

03.1

Kubernetes and Helm parameters

Use a dedicated namespace, restricted service account, private image mirror, NetworkPolicy default-deny, and an admission policy that rejects privileged pods. Pin the chart version and image digests from the signed release manifest.

Reserved registry contract

The registry path below describes the intended release channel. It becomes executable only when your Trust Center record grants access and supplies an approved version.

values.vpc.yaml / minimum boundary

global:
  deploymentMode: vpc
  imageRegistry: "<customer-private-registry>"
  imagePullPolicy: IfNotPresent

controlPlane:
  replicaCount: 3
  networkPolicy:
    defaultDeny: true
    allowedEgress:
      - "<approved-model-endpoint>"
      - "<approved-source-control-endpoint>"

analysisWorker:
  runtimeClassName: kata-qemu
  hardwareIsolationRequired: true
  ephemeralRootFilesystem: true
  automountServiceAccountToken: false
  timeoutSeconds: 900

kms:
  provider: "<aws-kms|azure-key-vault|gcp-kms|local-hsm>"
  keyReference: "<customer-managed-key-reference>"
  rotationPolicy: customer-managed

telemetry:
  sourcePayloads: disabled
  exportMode: customer-controlled

helm upgrade --install codecr oci://registry.codecr.org/charts/codecr --version <approved-version> --namespace codecr-system --create-namespace --values values.vpc.yaml

03.2

Hardware-isolated microVM setup

Route every untrusted checkout and model-assisted remediation task into a runtime class backed by a hardware-isolated virtual machine. Destroy the root disk, memory, network namespace, and derived workspace on completion, cancellation, timeout, or failure.

RUNTIMEKata Containers or approved microVM classNo fallback to the default container runtime.

FILESYSTEMRead-only image + ephemeral workspaceNo host path, persistent volume, swap, or shared cache.

NETWORKDefault deny + explicit destinationsBlock metadata endpoints and arbitrary Internet egress.

TEARDOWNTerminate on every exit pathEmit hashes and decision state—never source payloads.

03.3

Local KMS key management

Customer Security owns key creation, policy, rotation, disablement, and audit review. codecr receives only the runtime permission required to generate or decrypt a data key for the authorized environment.

Separate keys by environment and data classification.
Bind use to workload identity and encryption context.
Deny direct key export and broad wildcard principals.
Alert on policy change, disabled rotation, or decrypt outside the expected runtime identity.

KEY AUTHORITYCUSTOMER

Material: Never exported
Rotation: Customer schedule
Revocation: Immediate customer action
Audit: Customer security log

Acceptance evidence: key ARN or resource ID, policy digest, workload identity, rotation state, last rotation timestamp, and a denied unauthorized decrypt test.

04 / PRODUCTION OPERATIONS

Publish once. Verify from every boundary.

The production record is incomplete until DNS, edge TLS, cache state, WAF behavior, security headers, accessibility checks, and regional performance measurements are attached to the deployed version.

04.1

Activate `docs.codecr.org` without ambiguous DNS.

Publish the two verification TXT records first, prove them through independent resolvers, then replace only the conflicting docs address record with the exact Sites CNAME. TTL remains Auto; unrelated apex, mail, and verification records are outside this change.

Strict change boundary

Start the CNAME as DNS-only during hostname validation. Enable Cloudflare proxying only if the approved architecture and the upstream custom-hostname service explicitly support the proxied path; never assume an orange-to-orange route is valid.

Cloudflare proxied-record behavior ↗TXT domain-control validation ↗

HOSTNAME MANIFESTVALIDATION REQUIRED

TYPECLOUDFLARE NAMECONTENT

TXT_openai-site-verification.docsopenai-site-verification=EYZwpNDHRABS3NS5paO82xoe0aAC2FmU8idcuVC_0zI

TXT_cf-custom-hostname.docsab7477e1-8aa8-4ab3-a326-140847c587b4

CNAMEdocscustom-domains.chatgpt.site.

Exact owners: _openai-site-verification.docs.codecr.org, _cf-custom-hostname.docs.codecr.org, and docs.codecr.org.

01
Open the change record. Capture the current zone export, any existing docs A/AAAA/CNAME values, their proxy state, and the rollback owner.
02
Publish verification first. Create both TXT records with TTL Auto. Wait until Cloudflare authoritative DNS plus 1.1.1.1 and 8.8.8.8 return the exact values.
03
Clear only the collision. A CNAME cannot coexist with another A, AAAA, or CNAME at docs. Remove the recorded conflicting docs value; preserve every unrelated record.
04
Create the route. Add docs → custom-domains.chatgpt.site., CNAME, TTL Auto, initially DNS-only.
05
Wait for both planes. Require the Sites hostname state and certificate state to be active before application acceptance testing.
06
Prove TLS and content. Confirm the SAN contains docs.codecr.org, the chain verifies, HTTPS returns the approved documentation release, and no fallback hostname appears.

resolver + TLS acceptance

dig +short CNAME docs.codecr.org @1.1.1.1
dig +short CNAME docs.codecr.org @8.8.8.8

dig +short TXT _openai-site-verification.docs.codecr.org @1.1.1.1
dig +short TXT _cf-custom-hostname.docs.codecr.org @1.1.1.1

openssl s_client \
  -connect docs.codecr.org:443 \
  -servername docs.codecr.org \
  -verify_hostname docs.codecr.org \
  -verify_return_error </dev/null

curl --fail --silent --show-error \
  --location --output /dev/null \
  --write-out 'status=%{http_code} tls=%{ssl_verify_result} url=%{url_effective}\n' \
  https://docs.codecr.org/

04.2

Purge the changed URLs. Verify the bytes.

Invalidate only the documentation URLs changed by the release unless the release invalidates the entire asset map. A cache status is transport evidence; the SHA-256 digest is the artifact-integrity check.

EXPECTED RELEASE DIGESTS

/styles.css: 037072136cafbac47bc292e3ec2c764af02b334622b91c84b1f616013656a9c9
/app.js: 59519f22a3983fe0f09fed703915a4d5021bc439561c5f3a3c5302c5d065e295

Cloudflare single-file purge ↗CF-Cache-Status reference ↗

purge exact documentation URLs

CF_ZONE_ID="<codecr.org-zone-id>"
CF_API_TOKEN="<scoped-cache-purge-token>"

curl --fail --silent --show-error \
  --request POST \
  "https://api.cloudflare.com/client/v4/zones/$CF_ZONE_ID/purge_cache" \
  --header "Authorization: Bearer $CF_API_TOKEN" \
  --header "Content-Type: application/json" \
  --data '{
    "files": [
      "https://docs.codecr.org/",
      "https://docs.codecr.org/styles.css",
      "https://docs.codecr.org/app.js"
    ]
  }'

Token scope: Zone · Cache Purge · codecr.org only

hash + edge-header verification

DOCS_VERIFY_DIR="$(mktemp -d)"
trap 'rm -rf -- "$DOCS_VERIFY_DIR"' EXIT

curl --fail --silent --show-error \
  https://docs.codecr.org/styles.css \
  --output "$DOCS_VERIFY_DIR/styles.css"
curl --fail --silent --show-error \
  https://docs.codecr.org/app.js \
  --output "$DOCS_VERIFY_DIR/app.js"

sha256sum \
  "$DOCS_VERIFY_DIR/styles.css" \
  "$DOCS_VERIFY_DIR/app.js"

for ASSET_URL in \
  https://docs.codecr.org/styles.css \
  https://docs.codecr.org/app.js
do
  curl --silent --show-error --head "$ASSET_URL" \
    | awk 'BEGIN{IGNORECASE=1} \
      /^(HTTP\/|CF-Cache-Status:|Age:|ETag:|CF-Ray:)/'
  curl --silent --show-error --head "$ASSET_URL" \
    | awk 'BEGIN{IGNORECASE=1} \
      /^(HTTP\/|CF-Cache-Status:|Age:|ETag:|CF-Ray:)/'
done

FIRST REQUESTMISS, EXPIRED, or REVALIDATED may be valid after purge.

SECOND REQUESTExpect HIT or UPDATING when the active cache policy makes the asset eligible.

INVESTIGATEBYPASS, DYNAMIC, or NONE/UNKNOWN requires policy/header review when caching is expected.

ACCEPTANCEHTTP 200, expected SHA-256, expected release path, and no superseded bytes.

04.3

Cloudflare edge protocol

Proxy only validated hostnames, enforce Full (strict) where the approved origin architecture supports it, purge changed URLs after publication, and protect the telemetry API with narrow custom controls plus mandatory origin authorization. Never cache authenticated API responses.

Full (strict) documentation ↗Exact codecr telemetry WAF policy ↗WAF custom rules ↗

CONTROLLED TTL AUTO WINDOWNO BROAD DELETIONS

Inventory before mutationExport the zone and query apex plus docs A, AAAA, CNAME, TXT, CAA, and MX records through authoritative DNS.

Resolve the exact owner collisionAt docs, retain verification TXT records and replace only a conflicting address/CNAME record. Never delete apex A records required by codecr.org.

Observe—not churnWith TTL Auto, wait for authoritative and recursive answers to converge. Do not alternate record values during propagation.

Roll back from the recordIf validation or TLS fails after the change window, restore the captured docs value and proxy state; attach the failure evidence.

04.4

Post-publication acceptance record

Execute the checks after the custom domain is active. A single local request cannot prove a global SLA; capture repeated cold and warm measurements from every contracted region and attach the raw results.

01HostnameExact CNAME and both verification TXT records resolve; certificate and Sites state are active.DNS + CONTROL PLANE

02CDN cachePurge changed URLs; confirm expected digest and observed CF-Cache-Status.ZONE ACCESS

03SSL/TLSValid hostname certificate, verified chain, HTTPS redirect, no 526, no loop.EDGE TEST

04PerformanceFive cold + five warm samples per region; approve p95 TTFB only below 1.2s.MEASURE

05AccessibilityKeyboard, focus, reflow, contrast, screen-reader, and 200% text checks completed.MANUAL QA

06RollbackPrevious approved version, DNS value, proxy state, owner, trigger, and recovery objective recorded.CHANGE RECORD