Witness checks build evidence against a signed release policy The open-source tool can stop releases with missing or untrusted build records. Keep policy authority separate from the build signer and test that rejection actually blocks deployment.