Governed Release Copilot

Evidence in. Approval enforced. Trusted answers out.

Governed Release Copilot is a synthetic public reference for turning business application change evidence into a controlled release story:

Change Evidence → AI Draft → Human Approval → SharePoint Knowledge → Agent Q&A with Citation

The repository proves the contract and fail-closed governance behavior without requiring a Microsoft tenant or exposing organization data. The exact claim-to-evidence mapping is maintained in docs/evidence-matrix.md.

Problem

Workflow, form, SharePoint, and database changes often leave evidence in different tools. Manual release notes can then drift away from the change that was tested. This reference addresses that risk with a normalized ReleaseChangeV1 contract, a canonical hash validator, and a deterministic decision policy.

What The Public Reference Proves

Claim	Evidence
Valid evidence reaches ReadyForApproval.	Policy test and valid sample
Missing evidence becomes NeedsInput.	Policy test and missing-fields sample
A previously accepted canonical hash becomes Duplicate.	Policy test and duplicate sample
Invalid input, hash mismatch, failed tests, or unavailable rollback fail closed.	Validator tests, policy tests, and rejected sample
Public content is scanned for tenant data and secrets.	Privacy scanner, scanner tests, and CI workflow
Video narration and captions are frozen and checked for parity.	Video manifest and documentation tests
Validation tools are exposed as Model Context Protocol (MCP) tools for Microsoft 365 Copilot.	MCP server, MCP tests, and appPackage

Governance Model

ReadyForApproval  complete evidence, valid schema and hash, passed tests
NeedsInput        required evidence is absent or a test has not run
Duplicate         canonical changeHash already exists in the registry
Rejected          invalid schema/hash, failed tests, or no rollback

No public decision publishes content. ReadyForApproval means only that a human may review the proposed AI draft. The architecture diagram shows the approval and approved knowledge boundaries, while DECISIONS.md records the policy choices.

Architecture

The editable source is docs/architecture.mmd. Work IQ is shown as a context source for citation-backed Q&A; approved SharePoint release notes remain the publication boundary. Live tenant proof is explicitly listed as an owner action in DECISIONS.md.

Run Locally

Prerequisites:

• Python 3.12
• gitleaks 8.30.1

python -m pip install -r requirements-dev.txt -e .
python -m pytest -q
python scripts/verify.py

Evaluate the synthetic samples:

grc-validate samples/valid.json
grc-validate samples/missing-fields.json
grc-validate samples/rejected.json

The optional duplicate registry is a JSON array of accepted hashes:

grc-validate --registry accepted-hashes.json samples/duplicate.json

Run the Model Context Protocol (MCP) server:

python src/governed_release_copilot/mcp_server.py

Submission Package

• Architecture source and rendered PNG
• Evidence matrix
• Submission-form draft
• Eight-scene narration and captions
• Synthetic payloads
• GitHub Actions verification
• Declarative Agent package (manifest, agent configuration, API plugin, logo)
• Python Model Context Protocol (MCP) server and Toolkit config

AI Production Transparency

The product proof is the schema, policy, tests, CI, and Microsoft architecture. Gemini may be used to generate narration from the frozen public script. Veo may be used only for optional six-second intro and outro polish based on sanitized title cards. Neither tool generates product UI, test evidence, or claims about tenant behavior. The binding decisions are recorded in DECISIONS.md.

Safety Boundary

All committed examples are synthetic. The privacy scanner rejects email or UPN shapes, canonical GUIDs, tenant domains, internal hostnames, real-looking ticket IDs, credentials, private keys, and absolute user paths. CI also runs gitleaks over the working tree and all fetched Git refs through scripts/verify.py.

License

MIT