Slipmark Cloud is live

The open-source gate answers one question in CI: is every agent verdict about the exact files being shipped? Slipmark Cloud answers the questions that come after it. Who checks the gate? What did the agents approve last quarter? Who approved a change that failed a rule, and why?

Every run goes on an append-only, hash-chained ledger. Each day the chain heads are signed and published to Sigstore's Rekor, a public transparency log the company does not control, so the record cannot be quietly rewritten, including by us.

Cloud does not take CI's word for it. It reads the commit from GitHub itself, hashes the attested files again and works out every result on its own.

Teams write rules such as "payments code needs a security review". A pull request that touches those files without a current, passing verdict from the named agent fails a required GitHub check. An admin can approve it anyway, but only with a written reason that stays on the record.

Alerts go to Slack, Microsoft Teams, Discord, Google Chat, PagerDuty, email or any webhook, and each failure says which files need which agent and the command to fix it. A Slack app keeps one thread per pull request and lets an admin approve from Slack.

On the Business plan, evidence packs cover one repository and period for SOC 2 CC8.1 and ISO/IEC 27001:2022 Annex A 8.32: a PDF with the JSON attached, and a read-only, expiring link for the auditor.

Free for public repositories. Team is £15 per seat a month, minimum 3 seats. Business is £40 per seat a month, minimum 10 seats. Both have a 14-day free trial. Larger organisations can contract annually by invoice or purchase order.

Source code is never stored: files are hashed in CI, and re-checks hash GitHub's copy in memory. Data is held in London.

Slipmark does not judge whether an agent's review was right. It proves which exact files a verdict was about, refuses when they have changed, and enforces which reviews are required.