Governed delivery does not end when the repository is created

The governed repository lifecycle

Repave is a governed repository lifecycle system. It records what a repository is supposed to look like, explains when that state has diverged, and can restore supported drift without changing desired configuration or the approved baseline. The concepts in the workflow are first-class pages on the lifecycle overview.

• Start

  Establish a governed repository via Generate or Adopt.

• Intentional change

  Configure and Upgrade meet at intentional change.

• Continuous governance

  Observe then Remediate.

Why this is a different problem

Live infrastructure drift is not this product. That domain is Overpass. Engineering economics is Toll. Repave is not being defined as another IDP.

Governance is on the path

This is repository governance, not cloud reconciliation. Intent becomes recorded desired state on an approved baseline. Gates run. Git is the review surface. Observe explains what remains true. Evidence is left behind whether the next step is configure, upgrade, or remediate.

1. 01 Intent Generate, adopt, configure, or upgrade through a governed experience.
2. 02 Recorded state repave.yaml holds desired inputs and the approved baseline.
3. 03 Gates Deterministic. Failures block the write. Agents do not skip them.
4. 04 Observe, then act Read-only evidence first. Then remediate, configure, or upgrade as appropriate.

Know when a repository has left the path

Observe is read-only evidence. Remediate restores only supported governed-file drift, then Observe checks the result. Detail lives on those concept pages, not as a second copy of the workflow.

Configure and upgrade are not remediation

If the recorded region is us-east-1 and a governed file was edited to us-west-2, remediate restores east. If the team actually wants west, that is Configure. If the catalog has a newer approved baseline, that is Upgrade — both are intentional change, not drift.

Intent in, evidence out

The product does not care whether the request came from a person or a job. Context is applied, gates run, Git is the review surface, and evidence is left on the far side.

1. 01 Intent Portal, CLI, API, operator, or Dispatch (generate is the wired Dispatch write today).
2. 02 Governed path Context, mandatory gates, provenance. No ungated write.
3. 03 Realization Repository on the far side. Outcome plus evidence. Observe can re-check state.

Humans, automation, and Dispatch

Intent can arrive from the portal, CLI, API, operator, or Dispatch. Governance does not change with the source. Dispatch is a governed cross-domain experience — not “the Repave chatbot,” and not the policy authority.

Today on Repave: Dispatch can participate in generate through the same /generate gates. It may explain observed repository state and surface findings. It cannot adopt, configure, upgrade, or apply remediation, and it cannot approve its own work.

1. 01 Advisory Answers and proposals. Writes nothing.
2. 02 Supervisory Confirm to act. Realization still hits the gates. Default for hosted generate.
3. 03 Autonomous Opt-in, already-governed operations, kill switch. Cannot invent evidence.

Same path, several doors

• Portal

  Workbench on this origin once you are invited: overview, generate, adopt, configure, upgrade, verify.

• CLI

  repave generate, import, update --input, upgrade, observe, remediate, verify.

• API and operator

  HTTP contracts for generate, import, updates, upgrades, observe, and remediate. Operator opens upgrade PRs on pin drift.

• Terraform
• OpenTofu
• Pulumi
• Helm
• Ansible
• GitHub

Generated output, not a pitch

Three public repos, each emitted in one run with no hand edits afterward. Lineage you can observe, upgrade, or restore when the recorded path is still reconstructable.

• OPA guardrails

  Rego that blocks a destructive delete without replacement, plus Conftest fixtures.

  opa-policy-platform-guardrails

• Checkov baseline

  Custom Python checks and YAML rules, not a starter template.

  checkov-policy-platform-baseline

• Helm chart

  Templates, values, and a runbook for a payments API service.

  helm-payments-api

Waitlist, then accounts

Hosted generate is waitlist-first. Invoice is the close this week. There is no card form on the waitlist.