Scan first. Connect later.
Outpost Scan Targets
A repository, an image, or an endpoint that no system claims yet still deserves scanning. Outpost holds these unconnected targets as a first-class domain: saved targets, trend history, and a graduation pipeline into the Garrison estate and Sentinel monitoring. Security work starts before compliance asks for it.
The DevSecOps On-Ramp
No system required to start.
Most security tooling assumes an inventory entry exists before the first scan runs. The Redoubt Forge architecture refuses that ordering: Outpost is designed as its own domain for targets that belong to no system yet. They are saved, scanned, and tracked, and when one earns a place in the estate, graduation carries it there with its history intact.
A Domain of Its Own
Most of what a security team wants to scan is not estate. A prototype with no production environment. A container image built in CI that no system claims. A repository inherited through an acquisition and still under evaluation. Conventional compliance tooling has no place for any of it: no system record means no scan, so the cheapest moment to find a problem passes unused. The architecture takes the opposite position. Outpost is a first-class domain for scan targets not yet connected to a system, elevated from what an earlier design treated as a sub-view of the Vanguard workbench. In the platform's own mnemonic, Garrison is what you have; Vanguard is what you do. Outpost belongs to the doing.
No Framework in Sight
The charter is blunt: an engineer scans on day one with no framework in sight, because nobody should need a framework to get value. Outpost is that sentence expressed as architecture. The target comes first. The system, the framework, and the assessor arrive later, if they arrive at all.
First-class standing changes what a target is allowed to remember. A sub-view renders whatever its parent happens to know; a domain holds state of its own. The design gives Outpost three things to hold: saved targets, the trend history of every scan run against them, and the graduation pipeline that leads from Outpost to the Garrison estate to Sentinel monitoring. In the platform vocabulary the surface carries a deliberately plain label: scan targets. Nothing about that name asks you to define a system boundary, choose a framework, or justify to anyone why a repository deserves a look before it has a home.
The Scan Target Model
A scan target is a reference to something scannable that no system claims yet: a source repository, a container image, an infrastructure endpoint. Against it runs the same fleet that serves the rest of Vanguard: a signed FIPS scanner fleet spanning code, IaC, secrets, SBOM, vulnerability, DAST, antivirus, and cloud posture. The fleet is specified as self-contained: rulesets and vulnerability databases are baked into each signed image at build time, so a scanner starts, runs, emits results, and exits without reaching for anything at runtime. The tools that judge your supply chain are built to survive the same judgment they deliver.
Every scanner emits into one finding shape. A leaked credential, a vulnerable dependency, and a failed hardening check land as the same kind of record, on the same severity ladder, in one queue instead of a queue per scanner. To the person triaging, a finding is simply a scan result; the uniformity is what lets scan results later carry weight as compliance evidence without translation. The access design draws its own line through the domain: saving a target, managing it, and promoting it into the estate are specified as separate permissions, so graduation into Garrison is a deliberate act with a name, never a side effect.
Three Scan Surfaces
The design specifies three surfaces for running a scan. A local CLI scan: the platform CLI is the ephemeral, developer-grade subset of the collection machinery, scoped to scan, collect, and check, with no residency on the machine that runs it. A pipeline scan: GitHub Actions integration through redoubt-forge/gate and GitLab CI through redoubt-ci, running where the code already lives. And a Sentinel-scheduled scan, for targets worth revisiting on a cadence rather than a whim. Three surfaces, one finding shape, one Vanguard result pipeline.
Results Travel. Source Stays.
On the pipeline surface the scanner runs inside the pipeline it serves; what returns to the platform is the finding record, not the repository. The design also admits results the platform never collected at all: an import surface for third-party and air-gapped scan artifacts, each recorded with its digest at receipt.
For scheduled runs the division of labor is strict. Sentinel decides when observation happens and fires the trigger; Vanguard executes; results return as trends. A dispatch that is refused holds and retries on an escalating ladder rather than vanishing, so a scan that never ran cannot masquerade as a clean one. The boundary runs just as firmly in the other direction: the architecture's stated non-goals include ever becoming a code host or a CI product. Outpost points scanners at your repositories and pipelines. It does not audition to replace them.
Trend History
A single scan answers one question, once: what is wrong right now. It says nothing about direction. Teams that scan sporadically re-litigate the same findings every quarter, because nothing holds the thread between runs; the report ages, the context evaporates, and the evidence decays faster than the code improves. The architecture states the alternative in four words: scan results become trends. Outpost keeps that trend history as part of the target itself, so the record of improvement belongs to the thing being improved, not to whoever exported last quarter's report.
A Target Remembers
A finding count is a fact about a moment. A trend is a fact about a team. The design attaches history to the target so the second kind of fact exists at all, before any system, framework, or assessor enters the picture.
Trend tracking is Sentinel's side of the bargain: scan results flow from Vanguard into the monitoring domain, where cadence and change detection live. Aggregation is Citadel's: scan status rolls up into the same command view that carries posture, alerts, and estate inventory, so unconnected targets stay visible in the one place an organization actually looks. A repository nobody has claimed is still on the board. That visibility is the quiet argument for eventually graduating it.
Graduation Into the Estate
The graduation pipeline is named in the architecture as three steps: Outpost to Garrison estate to Sentinel monitoring. Graduation connects a target to a system, and three things change. The target becomes an estate entity in Garrison, which is designed as a temporal estate: what existed at time T, with compliance history retained beyond an entity's lifespan. Scheduled observation replaces ad-hoc scanning. And the platform's division of responsibility takes hold, three-place by design: Sentinel executes collection, Garrison holds custody, Rampart interprets. That last seam is where a scan result becomes mappable to controls across every active framework, and where work that began as security hygiene starts earning its keep as proof.
A Promotion, Not a Migration
The day a side project becomes a production system is usually the day someone discovers that none of its scans count. The graduation pipeline answers that day in advance. One domain holds the saved target, its trend history, and the pipeline itself; the estate it graduates into is temporal by design. The record is the point, and the record carries.
Graduation is specified as an explicit act, not an ambient one. Promoting a target is a separate permission from scanning it, and where Artificer proposes a promotion, the design has the action preview first and wait for a named human to confirm it; nothing a model infers counts until a person says so. After graduation, the evidence fabric's collection-to-satisfaction pipeline applies to what monitoring observes, and infrastructure itself starts producing evidence. The target's compliance life begins with a history already behind it: scanned before it was estate, improving before anything required it to.
Unconnected Is a Status, Not an Exile
The usual toolchain splits the early scan from the eventual proof: a scanner developers like, a compliance product assessors tolerate, and no path between them. The architecture refuses the split. The same compliance control plane that proves the estate also holds the targets that are not estate yet, one graduation away. The scan an engineer runs on day one, no framework in sight, is the first entry in a record built to be inherited.
Related