Secure Software Delivery Architecture
From Git Commit to Running Workload — the engineering discipline behind shipping software safely, for everyone who ships to production.
The one question this handbook answers
Section titled “The one question this handbook answers”When a container starts running in production, why should anyone believe it is the code the developer wrote?
Every chapter is one link in the chain of custody that answers that question: Developer → Git → Build → Artifact → Deployment → Runtime — identity, evidence, and independent verification at every boundary.
Who this is for
Section titled “Who this is for”Platform engineers, security engineers, SREs, and architects who design or operate the path software travels to production — and anyone who has to answer “how do we know this is safe to run?”
Explore the handbook, part by part
Section titled “Explore the handbook, part by part”I. FoundationsWhy secure software delivery exists, and the trust model that unifies every later chapter.
II. Source TrustGit as the root of trust, and the repository governance that protects it.
III. Build TrustCI as a trust factory, and giving builds a verifiable identity.
IV. Artifact TrustThe artifact lifecycle, provenance, SBOMs, signatures, and attestations.
V. Deployment TrustGitOps, deployment authorization, and admission controllers.
VI. Runtime TrustWorkload identity, runtime authorization, and drift detection.
VII. Platform SecuritySecrets architecture, policy as code, threat modeling, and platform architecture.
VIII. OperationsIncident response, maturity models, and running architecture reviews.
Closing — The Enduring PrinciplesTen principles that outlast any tool: the whole handbook, distilled.
Prefer to read offline?
Section titled “Prefer to read offline?”Take it with you — download the whole handbook as a PDF, or grab the condensed field guide for running an architecture review on the job.
The full handbook (PDF)All 24 chapters in one file — the entire site, formatted for offline reading, printing, or annotation. ~500 KB.
Architecture Review Field Guide (PDF)A condensed, printable checklist for reviewing a platform's trust boundaries in the field — the questions to ask, on one desk reference. ~85 KB.