Veto

Canary checks look at error rate and latency. Plenty of bad releases pass that. In my demo shop a PR says "refactor, no behavior change". The canary shows 0% errors and the same latency, so a normal check would ship it. But checkout stopped calling payments. Orders were confirmed and nobody was charged. Veto is a release gate for Argo Rollouts canaries. While the canary takes half the traffic, it compares stable and canary: request and call metrics from OpenTelemetry in Prometheus, logs from Loki, and the pull request behind the image tag from GitHub. Each difference becomes a numbered evidence item in a hashed bundle. Muse Spark Open explains each item against the PR, in three runs that must agree. Code does everything code can do: a floor aborts clear failures, a detector catches text aimed at the reviewer, and hard evidence caps the verdict at hold whatever the model says. The AI can explain a change. It can never approve one. Results: 8 labelled releases judged 3 times each, Veto 24 of 24 right, the metrics only check 9 of 24 with 15 bad releases shipped. 80 prompt injection attacks, model fooled in 3 of 180 runs, 0 shipped. In a blind test by another developer, the sneaky PR was held, not shipped. Built solo during the event. One helm chart, a UI on the service, and a public replay page for every decision: https://prashant-zo.github.io/veto/