Release Governor

Block promotion when malformed LLM outputs leak past staging validation boundaries.

Designed for staging/pre-prod environments with structured CI/CD workflows.

Install

pip install llm-release-governor

What it does

Release Governor sits between your CI contract checker and your staging environment. It consumes a locc artifact, detects leakage the contract checker allowed through, and enforces a promotion policy per environment.

locc (CI) -> Release Governor (staging gate) -> EGA (runtime)

Quickstart

release-governor evaluate \
  --locc-artifact locc_result.json \
  --env staging \
  --sha $GIT_SHA

Exit 0 = ALLOW, Exit 1 = BLOCK, Exit 2 = REQUIRE_OVERRIDE

What it detects

Override path

release-governor override create \
  --env staging \
  --approved-by alice \
  --reason "confirmed false positive" \
  --leakage-types pii \
  --sha $GIT_SHA \
  --identity-hash $ARTIFACT_HASH \
  --expires-in-days 7

Then: commit the override file and re-run evaluate.

Audit log

release-governor evaluate \
  --locc-artifact locc_result.json \
  --env staging \
  --sha $GIT_SHA \
  --audit-log rg_audit.jsonl

{"event_type": "PROMOTION_BLOCKED", "sha": "...", "actor": "system"}

GitHub Actions

- name: Gate promotion
  run: |
    pip install locc llm-release-governor
    locc run --contract contracts/current.json \
             --snapshot snapshots/current.json \
             --output json > locc_result.json
    release-governor evaluate \
      --locc-artifact locc_result.json \
      --env staging \
      --sha ${{ github.sha }}

Environment policies

Stack integration

Release Governor is part of the LLM Reliability Stack.

Consumes locc artifacts. Sits upstream of EGA.

License

MIT

Publishing

Releases are published automatically to PyPI on version tag push.

To release:

git tag v0.1.0
git push origin v0.1.0

To dry-run on TestPyPI first:

Trigger the "Publish to TestPyPI" workflow manually from GitHub Actions.

PyPI trusted publishing must be configured once per project:

PyPI project settings -> Publishing -> Add publisher Owner: Repository: Workflow: publish.yml Environment: pypi