Kosli demo — two governance lanes, one platform

One platform, either compliance system — proven, not promised.

The same 6 container images are deployed twice on AWS: once governed end-to-end by Fides, once by Kosli. Each lane has its own pipeline, its own deploy gate, and its own ServiceNow change record. If a customer standardises on Kosli, SARC drives Kosli for real — and the reverse for Fides.

Everything below is live on the demo cluster (sarc-aws).

The two lanes

	podtato-head (Fides lane)	podtato-head-kosli (Kosli lane)
Governance	Fides (self-hosted ledger)	Kosli (app.kosli.com, org Calitii, flow karc-pipeline)
Namespaces	karc-{dev,qa,prod}	karc-kosli-{dev,qa,prod}
URLs	podtato-<env>...	podtato-kosli-<env>.13.134.88.9.nip.io
Deploy gate	Fides change-gate + PreSync assert	in-chart kosli assert artifact --environment PreSync hook
ServiceNow	Fides → CR (u_fides_*)	its own CR (u_governance=kosli) + Kosli evidence

Kosli is not attached to the Fides pipeline — each service answers to exactly one system. Same images (a second deploy, not a second build).

How the Kosli lane works

GitLab pipeline (kosli-deploy.yml)
  ├─ kosli begin trail (per commit)
  ├─ kosli attest artifact  (6 podtato images, by digest)
  ├─ kosli attest generic   (the 8 flow-template controls → trail COMPLIANT)
  ├─ kosli attest deploy     + open the Kosli ServiceNow CR (u_governance=kosli)
  └─ gitops bump → image-tag-kosli-aws.yaml (.image.tag + .image.digest)
                              │
                              ▼
ArgoCD (podtato-head-kosli ApplicationSet, targetRevision: gitops)
  └─ PreSync hook: kosli assert artifact --fingerprint <digest>
                    --environment aws-karc-kosli-<env>
       COMPLIANT → sync proceeds → podtato-head-kosli deploys
       non-compliant / unattested → Job fails → SYNC BLOCKED (fails closed)

The gate is in-cluster (an ArgoCD PreSync Job), so it blocks the actual deploy, not just a CI check.

Live state (all three envs, gated)

Env	Kosli environment	Policies enforced by the gate	State
dev	aws-karc-kosli-dev	karc-dev-permissive	Synced / Healthy
qa	aws-karc-kosli-qa	karc-qa-standard, karc-no-critical-cves	Synced / Healthy
prod	aws-karc-kosli-prod	karc-prod-strict, karc-no-critical-cves, karc-servicenow-cr-required, karc-iac-attestation	Synced / Healthy (manual-sync)

Each deployment passed its Kosli assert before ArgoCD would sync it — including prod’s four-policy strict gate.

Walkthrough for the room (~6 min)

1. Two services, two systems. Open the Fides podtato-head and the Kosli podtato-head-kosli — same app, two namespaces, two hostnames. “Same build, two compliance ledgers.”
2. The Kosli flow. In Kosli (org Calitii → flow karc-pipeline) show the trail for the commit: artifacts by digest + the control attestations, all COMPLIANT.
3. The gate is real. In ArgoCD open podtato-head-kosli-aws-qa → the PreSync kosli-assert hook ran and passed; the app is Synced. “Kosli didn’t just record — it had to say yes before this deployed.”
4. Prod is stricter. Show podtato-head-kosli-aws-prod: the same gate, but four policies (incl. servicenow-cr-required). It passed → prod deployed.
5. Block it (optional, dramatic). Point an env’s tag digest at an unattested image → the PreSync hook fails and ArgoCD refuses to sync. “A non-compliant artifact cannot reach the cluster.”
6. ServiceNow. Show the Kosli-governed change record (u_governance=kosli) with the Kosli trail link + assert verdict — distinct from the Fides CR.

What it proves

• SARC operates both Fides and Kosli as first-class governance systems, independently, on the same infrastructure.
• Kosli here is a real deploy gate, not just attestation — it blocks non-compliant syncs in-cluster, at every environment, with prod strictest.
• The Kosli→ServiceNow change story works even though Kosli ships no public ServiceNow product integration — SARC builds the bridge.

Mechanics + runbook: docs/ci/kosli-parallel.md. Integration detail + assessment: the Kosli integration page.