Healthy infrastructure is not enough
A candidate may be ready, fast, and error-free while producing worse answers. InferCrane accepts
aggregate evidence from a customer-owned evaluation suite, verifies its signature and revision
identity, and lets Release Guard enforce explicit score thresholds.
InferCrane does not store prompts or generated outputs in this evidence format and does not choose an
LLM judge for you.
Create an evaluator key
Keep the private Ed25519 key outside the control plane. The operator authorized to attach evidence is
the trust boundary.
Ingest a result from any evaluator
Have Ragas, DeepEval, a custom CI evaluator, or another customer-controlled system emit the strict
content-free evaluator result contract:
Bind that aggregate result to the exact immutable candidate revision, sign it, and explicitly attach
it through the control-plane API:
Unknown fields are rejected, so prompt and generated-output bodies cannot accidentally enter the
evidence envelope. If API attachment fails, the signed local file remains available for a safe
evaluation attach retry.
Sign aggregate evidence directly
The signed payload records deployment, immutable revision, suite and evaluator versions, normalized
score, pass/fail result, sample count, result-artifact digest, and evaluation time. Attaching the same
evidence twice is idempotent.
Fail closed in Release Guard
Active and candidate evidence must use the same suite version and evaluator version to be comparable.
Missing or incomparable required evidence leaves the decision waiting. A failed suite, score below
the minimum, or regression beyond policy rejects the candidate. The evaluator cannot activate a
revision; promotion remains a separate, authorized control-plane decision.
An artifact digest proves which private result bundle was evaluated, not that the evaluator was
well-designed. Teams remain responsible for representative datasets, evaluator calibration, privacy,
and human review of high-risk changes.