A demo of Kosli governing a two-component system — a Spring Boot backend (orders-api) on Azure App Service and a mobile app (Mobile Orders, Android + iOS) — where every control (peer review, tests, SonarQube, mutation testing, mobile security scan, integration tests, release approval) is attested to Kosli, and Kosli's policies, not a green pipeline, decide whether a build may be published and released.
One pipeline (ci-build.yml) runs on every push to main,
attesting to one Kosli flow, order-system-ci, whose trail is the commit SHA:
flowchart LR
trail["trail: begin + attest PR"] --> peer["peer review<br/>evaluate PR facts"]
trail --> backend["backend<br/>build, unit tests,<br/>mutation tests, sonar"]
trail --> android["mobile: android<br/>package + Oversecured"]
trail --> ios["mobile: ios<br/>package + Oversecured"]
peer --> publish{{"Publish gate"}}
backend --> publish
android --> publish
ios --> publish
publish -->|compliant| staging["Deploy to staging"]
staging --> integration["Integration tests"]
integration --> approval{{"Manual approval"}}
approval --> release{{"Release gate"}}
release -->|compliant| prod["Deploy to production"]
- Publish gate —
kosli assert artifact --environment azure-appservice-stagingagainst the staging environment policy: did the build produce everything it owed (peer review, unit tests, Sonar quality gate, mutation score, both mobile scans)? Passing deploys to staging, not production. - Release gate — after a human approves the protected
production-releaseenvironment,kosli assert artifact --environment azure-appservice-prodjudges the build against every policy attached to production: everything the publish gate checked, plus a passing integration test run and a named approver. Only then does the same build reach production.
Full design rationale, setup steps and gotchas: CLAUDE.md.
- Sonar: https://sonarcloud.io/project/overview?id=kosli-dev_azure-java-appservice-demo
- Azure Portal: https://portal.azure.com/#@/resource/subscriptions/96cdee58-1fa8-419d-a65a-7233b3465632/resourceGroups/rg-kosli-orders-api-demo/overview
- API URL staging: https://kosli-orders-api-demo-staging.azurewebsites.net/api/health
- API URL prod: https://kosli-orders-api-demo.azurewebsites.net/api/health
- Happy case — a change passes all checks and is deployed to prod CI · Trail · Staging snapshot · Prod snapshot
- Blocked from staging — e.g. failed mutation tests CI · Trail
- Deployed to staging but blocked from prod — e.g. failed integration tests CI · Trail · Staging snapshot
- Peer review control unsatisfied — a committer approves their own PR PR · CI · Trail
- Mutation tests fail but are overridden, then deployed to staging and prod CI original failure · CI attestation override · CI re-run to deploy · Trail