One signal, end to end — including the ways out.

1. 01 · inbound

   The signal arrives

   Your error tracker posts an event to a per-source endpoint. Déjà runs nothing inside your network. Besides receiving webhooks, it calls the APIs of the tools you connect, with the access you grant — for example to import past pull requests, fetch each merged pull request's files, and check once a day that the GitHub App is still installed.

   EventKeyError: total_centscheckout-api · 03:07:41
2. 02 · authenticate

   Signature and freshness

   The payload signature is checked against the source secret, and the timestamp against the replay window. A rejected delivery is recorded with its rejection class.

   Exit A · Rejected→ no receipt

   Bad signature, unknown source or stale timestamp. No receipt is issued; the rejection is logged with its disposition and surfaces on the source's status.

3. 03 · scope

   Vault and zone resolved

   The event is bound to one vault and one zone, and the binding is part of what gets sealed.

   Scopevault Payments platformzone checkout
4. 04 · queue

   Queued for scoring

   A signal from Sentry, the signal source demonstrated end to end today, is queued for scoring, and nothing is sealed yet: its receipt is issued when scoring ends, at stage 05, 06 or 07, whether or not anything is found. Datadog, Splunk On-Call and Alertmanager · Grafana alerts are scored too, but not yet demonstrated end to end, and a Datadog alert ends only in a no-attribution record (R1-N). An ingestion receipt (R0), written on arrival before any analysis, is issued only for incidents posted to Déjà's own incident endpoint, on Enterprise and Sovereign plans where R0 is switched on.

   Jobqueued for scoringno receipt yet
   Exit B · Not scored yet→ no receipt

   Alerts from New Relic, Dynatrace, Honeycomb, AppDynamics and Splunk (alerts) are received but not scored yet, so they stop here with no receipt. Whether PagerDuty, AWS CloudWatch, Azure Monitor, Google Cloud Monitoring, incident.io, Rootly and FireHydrant incidents reach scoring is still being checked.

5. 05 · eligibility

   Can this be scored at all?

   Attribution needs an affected field, a parseable language, a connected change source and a resolvable service edge. All four, or the gate isn't entered.

   Exit C · Not scorable→ R1-N

   No affected field in the signal — a threshold alert or a page. The receipt records the failed condition and the changes in the window, and stops there.

6. 06 · examine

   Candidates enumerated and scored

   Producer-side changes in the lookback window are collected and each is scored against the affected field on eight weighted signals.

   Examined14 candidates · 30d windowscoring_version 1.0.14
   Exit D · Nothing cleared→ R1-N

   Scoring ran and no candidate reached the threshold. The receipt lists every change examined and the highest score reached.

7. 07 · issue

   Receipt signed and delivered

   At or above the threshold the receipt carries the candidate, the score and the scoring version, and is signed. Inside the low-confidence band it is issued as R1-L instead.

   Receipte4a17c92-5b3d-4f08-9a61-2d7c8e0f4b19CCS 0.96 · signed
   Exit E · Low confidence→ R1-L

   A top score inside the 0.60–0.80 band whose leading candidate changed the field where it is read, or removed or renamed it where it is declared by a service in, or feeding, the failing zone. A record of uncertainty, not a finding — and if either condition fails, the incident gets an R1-N instead.

5 of the 7 stages can end the path. Three of the 5 still write to the ledger — that is the difference between a record of the period and a record of the successes. A delivery that fails authentication is logged against its source rather than sealed, because a payload we could not authenticate is not evidence of anything. An alert from a source Déjà does not score yet is received and gets no receipt, and the trace says so at stage 04 rather than leaving it out.

Roughly fifteen minutes, and nobody changes how they work.

There is no agent, no sidecar, no library to import and no change to your incident process. Déjà attaches to the tools that were already going to fire.

1. 01

   Create the vault

   A vault is the organisation-level scope that owns a chain. Signup needs a work email address, because a vault is identified by an organisation rather than a person.
2. 02

   Connect an error tracker

   This is the signal side. Déjà reads event payloads — error class, message, service, timestamp — and nothing else from that system. Sentry is the source demonstrated end to end today; the status page lists the rest honestly.
3. 03

   Connect a change source

   This is the change side. Déjà reads merge and deploy metadata and the diffs needed to detect field-level changes. It does not clone your repositories or read code unrelated to a change.
4. 04

   Sign the genesis receipt

   Written once at setup, with your organisation and the time inside the signature, as a link in your governance chain: every later governance receipt chains behind it, and the ledger is append-only, enforced in the database rather than by convention.
5. 05

   Invite your audit firm

   Auditor access is scoped to an engagement, is read-only, and is itself recorded as a governance receipt. Auditors are never counted as seats and never charged for.

What it reads, and where it writes back.

8 weighted signals, published thresholds, no model.

There is no inference step and nothing is ranked probabilistically. The same normalised inputs and the same pinned scoring version produce the same result and the same score, which is what makes a second run a check rather than a second opinion.

And three gates, which are not weights

• Deploy anchor

  Merged is not deployed. Where deploy anchoring is available it distinguishes the two; where it is not, the receipt records that the anchor was unavailable rather than assuming release.

• Change site

  A low-confidence receipt additionally requires that the leading candidate changed the field where it is read, or removed or renamed it where it is declared by a service in, or feeding, the failing zone. A candidate inside the band that meets none of these produces an R1-N, and the receipt records that the gate blocked it.

• Eligibility

  An affected field, a parseable language, a connected change source and a resolvable service edge. All four, or scoring is never entered and the incident exits at stage 05.

• Threshold

  0.80 to attribute

  At or above, the receipt names the candidate and carries the score, and is signed. Below, the incident takes one of the two exits beneath.

• Low-confidence band

  0.60 – 0.80

  Inside the band, and with the change-site gate passed, the receipt is issued as R1-L: a record that something was found and that we are not confident in it. Below the band there is no candidate to be unsure about, and the incident gets an R1-N.

• Version

  scoring_version 1.0.14

  Every receipt carries the scoring version that produced it, so a receipt from March is re-checkable against March's rules rather than today's.

Changing a weight changes the scoring version, and historical receipts keep the version that issued them. A vendor that can silently re-tune the thing that produced your evidence has not given you evidence. The weights above are the ones this build ships, read from the same constant the engine scores with.

What happens when something goes wrong on our side.

The question a security review actually asks is not how the product behaves when it works. These are the failure modes and what each one produces.

• A source goes quiet

  Not detected yet

  Déjà does not yet alert you when a connected source stops sending, and in the ledger a quiet source looks the same as a quiet period. Until that exists, check a long silence at the source.

• A delivery is rejected

  Rejections carry a disposition

  Bad signature, unknown source, stale timestamp, unhandled event type — each is recorded with its class rather than silently dropped, and surfaces against the source that sent it.

• A secret is rotated

  Both secrets accepted for 24 hours

  The overlap window means a rotation doesn't lose deliveries, and the rotation is sealed as a governance receipt so the change is part of the record.

• The fix doesn't hold

  The failure is on the chain too

  A resolution whose gates do not all pass gets its own receipt (R2-F), and a recurrence after one that passed is designed to be linked to it (R2-R) rather than start a fresh story. Both follow a resolution receipt. Most organisations get no resolution receipt (R2) yet: Déjà issues one only for an incident with an attribution receipt (R1), once 48 hours have passed since a user marked it resolved, and only if every gate then has a reading, which takes connected source control, Sentry, and Datadog (with a metrics read key) or New Relic.

• Extraction fails

  Recorded, never guessed

  Where a field can't be extracted from a payload shape, the receipt says extraction failed. It does not fall back to a lower-confidence guess presented as a result.

• We have an outage

  Queued, not lost

  Inbound deliveries are queued and processed when service resumes. A receipt sealed after a delay carries its own timing rather than pretending to be contemporaneous.

Every one of these produces something readable in your ledger. The failure mode we consider unacceptable is the silent one — a status indicator that stays green because the thing that would have turned it red was never recorded.

The last step happens on a machine we don't control.

Fifteen minutes to the first sealed receipt.

Fourteen days to decide, and the trial is more useful with your audit firm in it than without.