REFP 0.1.0

Release check / 01 Local-first CLI

Prove config shape.
Not secret values.

Catch missing, extra, and differently resolved environment variables before deploy. Every artifact is signed. No raw value is written.

cargo install --git https://github.com/B-Divyesh/sf-release-env-fingerprint --bin refp
Test the comparison model
  • No network
  • Keyed hashes
  • Signed JSON
Risograph proof sheets comparing environment rows, with a magnifier and one outlined missing row
Plate A / environment shape0 values exposed

One portable proof across

Method / 02 Three controlled steps

A proof, not another vault.

Keep the secrets where they already live. Verify only what a release needs to know.

  1. 01

    Capture

    Run an explicit command. Values stay in memory while names, types, and presence are classified.

    refp capture … -- env -0
  2. 02

    Sign

    Bind the artifact and safe non-secret hashes to a project-local key with HMAC-SHA-256.

    staging.refp.json
  3. 03

    Compare

    Fail before deploy on shape drift, type changes, safe-value changes, or policy violations.

    exit 2 · drift detected

Bench / 03 Browser-only model

Seed a drift. See the release fail.

Paste names or NAME=value rows. This teaching demo compares in your browser; it never sends or stores the text. Use the signed CLI for real release gates.

A Trusted baseline
B Candidate release

Local processing only

No comparison yet. Run the seeded example or enter your own variable list.

Rules / 04 Safe invariants

Say what must match.

Rules are reviewed as TOML. Sensitive values never become policy material.

refp.tomlpolicy v1
# Shape required in every release
version = 1
required_names = ["DATABASE_URL"]
required_prefixes = ["PUBLIC_"]

[non_secret]
names = ["NODE_ENV", "PUBLIC_API_ORIGIN"]

[hosts]
PUBLIC_API_ORIGIN = ["api.example.com"]
Required shape
Exact names and at least one key for required prefixes.
Endpoint boundaries
Host allowlists run in memory; full URLs are discarded.
Safe resolution
Only explicit non-secrets receive project-keyed value hashes.
Artifact trust
Every comparison verifies both signatures before reading drift.

Runbook / 05 CI ready

Helpful in a shell. Stable in a script.

release gate
$ refp compare --key .refp-key \
    --baseline production.refp.json staging.refp.json

production → staging
✕ DRIFT DETECTED
- missing    PUBLIC_API_ORIGIN
+ extra      PUBLIC_API_URL
~ type       LOG_LEVEL (String → Integer)
~ resolved   NODE_ENV (allowlisted hash changed)

exit 2 · signatures valid · 0 values persisted
0Valid, no drift
2Drift or policy violation
1Input, command, or signature error
--jsonMachine-readable on every command

Gate / 06 Before the next deploy

Make drift fail early.

One binary. One reviewed policy. No account, network, or secret migration.

cargo install --git https://github.com/B-Divyesh/sf-release-env-fingerprint --bin refp