Put preflight in your pipeline.

# .github/workflows/verify.yml
name: Vraelis Verification
on: [deployment_status]
jobs:
  verify:
    if: github.event.deployment_status.state == 'success'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: 20 }
      - run: node scripts/verify-gate.mjs
        env:
          VRAELIS_API_KEY: ${{ secrets.VRAELIS_API_KEY }}
          VRAELIS_CLAIM: ${{ vars.VRAELIS_CLAIM }}
          PREVIEW_URL: ${{ github.event.deployment_status.target_url }}
          # The plan a person approved for this claim. Until it is set, the job stops at step 1.
          VRAELIS_REVIEWED_PLAN_ID: ${{ vars.VRAELIS_REVIEWED_PLAN_ID }}

// scripts/verify-gate.mjs -- ship only when the deployed build keeps its promise.
// 0 verified   1 failed   2 blocked   3 no decision reached   4 the plan still needs a person to approve it
import { randomUUID } from "node:crypto";

const API = "https://vraelis.com/api/v1/verifications";
const headers = {
  "content-type": "application/json",
  "x-api-key": process.env.VRAELIS_API_KEY,
  "idempotency-key": randomUUID(),
};
const request = { deployment_url: process.env.PREVIEW_URL, claim: process.env.VRAELIS_CLAIM };
const post = (body) => fetch(API, { method: "POST", headers, body: JSON.stringify(body) });

// 1. Submit the claim. With no reviewed_plan_id this answers 202 "review_required": Vraelis derived a plan,
//    nothing ran, nothing was charged, and there is NO verification_id yet, only a reviewed plan to approve.
const planId = process.env.VRAELIS_REVIEWED_PLAN_ID;
if (!planId) {
  const prepared = await post(request);
  if (!prepared.ok) { console.error("Vraelis request failed: " + prepared.status); process.exit(3); }
  const plan = await prepared.json();
  console.error("A person has to approve this plan before it can run: " + plan.reviewed_plan_id);
  (plan.requirements || []).forEach((r) => console.error("  " + r));
  process.exit(4); // nothing ran, so this is not a verdict and must not be read as one
}

// 2. Approval happens outside this script: the Review queue in the console, or
//    POST /v1/verifications/plans/{id}/approve. Holding the id is not approval.

// 3. Resubmit the SAME deployment and claim with the approved plan. This runs exactly what was reviewed,
//    and it is the first response that carries a verification_id.
const started = await post({ ...request, reviewed_plan_id: planId });
if (!started.ok) { console.error("Vraelis refused the run: " + started.status); process.exit(3); }
const { verification_id } = await started.json(); // this response also carries human_reviewed: true

// 4. Poll until a DECISION lands. While the run is going the body is just the id and the state.
let decision = null, out;
for (let i = 0; i < 120 && decision === null; i++) {
  await new Promise((r) => setTimeout(r, 5000));
  const res = await fetch(API + "/" + verification_id, { headers });
  if (!res.ok) { console.error("Vraelis request failed: " + res.status); process.exit(3); }
  out = await res.json();
  decision = out.decision ?? null; // "verified" | "failed" | "blocked", absent while still running
}

// 5. Gate on the DECISION, never the run state. A finished run is not a pass; only "verified" ships.
switch (decision) {
  case "verified": console.log("Verified"); process.exit(0);
  case "failed": console.error("Failed: the claim did not hold"); (out.failures || []).forEach((f) => console.error("  " + f.title)); process.exit(1);
  case "blocked": console.error("Blocked: no verdict was reached"); process.exit(2);
  default: console.error("No decision within the polling window"); process.exit(3);
}