PLATFORM

One graph for the work that ships.

Uncain maps the relationships your delivery system already depends on: the deploy workflow, the Action tag it calls, the package install beneath it, the secret it can reach, and the agent session editing the repo. When trust moves, the graph makes the change visible enough to decide what should run.

MAP

Start with the relationships.

A release workflow is not just a YAML file. It may call a third-party Action, inherit secrets through a reusable workflow, install packages, and hand work to an agent session. Uncain keeps those decisions connected so a change can be judged by what it reaches.

Workflow and reusable workflow paths
Action lineage and package install context
Repositories, environments, secrets, and authority boundaries

DETECT

Watch trust-bearing change.

Trust drift is the moment a previously acceptable path starts carrying different risk. A tag is rewritten upstream. A lockfile loses integrity. A workflow gains `id-token: write`. An agent switches into a more permissive mode. The graph keeps those changes attached to execution context.

Tag, permission, and release-path drift
Package inventory and install-context movement
Agent runtime activity that changes what should be allowed

DECIDE

Turn evidence into a decision.

The useful output is not a larger queue. It is a decision the operator can inspect: cancel the affected run, quarantine the drifted ref, block the risky command, or show why the change can continue.

Blast radius tied to the affected graph
Policy decisions with evidence nearby
Containment and remediation when the shipped path supports it

One graph for the work that ships.

Start with the relationships.

Watch trust-bearing change.

Turn evidence into a decision.

Three lenses. One trust graph.