# DevOps Integration Checklist

- [ ] Create a service identity and API key scoped only to `write:verification`.
- [ ] Store the key in protected CI secrets; never echo or artifact it.
- [ ] Do not expose the key to forked/untrusted pull requests.
- [ ] Pin actions, images, dependencies, and the MetaSolve client version.
- [ ] Keep raw source and detected secret values out of MetaSolve API payloads and logs.
- [ ] Run local SAST, dependency, secret, and SBOM jobs before evidence binding.
- [ ] Start in report-only mode on 1–2 non-production repositories.
- [ ] Archive scanner output and MetaSolve status with access-controlled retention.
- [ ] Treat `review`, `blocked`, timeout, malformed response, and analyzer failure explicitly.
- [ ] Confirm the CI command exits non-zero for configured blocked decisions.
- [ ] Bind the reviewed commit and immutable image digest to deployment.
- [ ] Require a human approval for production and document exceptions with expiry.
- [ ] Test API outage, key revocation, rate limit, and rollback behavior.
- [ ] Revoke pilot credentials and remove gates cleanly during rollback.