Proposals, before they're final.
RFCs are how changes to CDK's public specifications get proposed, argued about, and decided — in the open, before they ship.
Six proposals, four still open.
Predicate Type Registry
Formalizes how new predicate types are proposed, versioned, and deprecated.
Multi-Signature Attestations
Allows more than one signer on a single attestation, for dual-control approvals.
Evidence Retention Policy Format
A standard way to express how long evidence must be kept, per framework.
Kubernetes Admission Controller
Blocks non-attested deployments at the cluster level rather than the pipeline level.
Trust Graph Query Language
A query syntax for traversing the Evidence Graph programmatically.
Offline Verification Bundles
Superseded by the standard Sigstore bundle format once it stabilized.
Four stages. No private ones.
Draft
A proposal is written up and opened for comment.
In Review
Open discussion, including from outside the core team.
Accepted
Merged into the relevant specification's next version.
Withdrawn
Closed without merging — the reasoning stays public either way.