Migration arc
From Xray to Chainsaw in 90 days. Artifactory keeps running.
The install-path policy surface moves to Chainsaw one watch and one business unit at a time.
90-day arc
Week by week
Xray stays live until each Chainsaw equivalent has been enforcing.
-
01 · Weeks 1–2
Monitor one BU
Mirrors one Xray watch. Xray enforces.
-
02 · Weeks 3–4
Decision diff
Per-package verdicts side by side. False positives go to Billy.
-
03 · Weeks 5–6
First flip
Chainsaw enforces. Xray drops to monitor.
-
04 · Weeks 7–8
Second BU
The first Xray watch turns off.
-
05 · Weeks 9–10
K8s admission
Gatekeeper package policies move into the signed Rego bundle.
-
06 · Weeks 11–12
Roll forward
Remaining BUs onboard. Xray watches ladder off.
Rollback, any week, any BU. One Rego edit returns Chainsaw to monitor. Xray policies are not yet retired at that point in the ladder, so the prior enforcement state stays live.
Decommission ladder
When each Xray watch comes off
| Xray watch | Chainsaw equivalent | Target week |
|---|---|---|
| Vulnerabilities watch | Chainsaw CVE rule + 25-signal compound rules | 6 |
| License watch | Chainsaw license rule, same Rego | 6 |
| Operational-risk watch | Chainsaw publish-velocity, very-new-package and abandoned-repo signals | 8 |
| Custom policy | Customer Rego in signed policy bundle | 10 |
| Build-scan integration | Chainsaw install + publish gate with same Rego | 10 |
Scope
What gets touched. What does not.
| Install-path routing in front of Artifactory | Touched |
|---|---|
| Xray watches | Mirrored, then laddered off |
| Xray policies | Re-expressed in Rego |
| K8s Gatekeeper / OPA package-admission policies | Touched |
| CI policy gates that call Xray | Touched |
| Artifactory storage, identity, namespacing | Not touched |
| Build promotion | Not touched |
| Replication and JFrog Distribution edges | Not touched |
| Existing webhook destinations | Not touched |
| Xray audit history | Exports preserved |
| Xray-licensed seats | Roll forward through the renewal |
Renewal just signed?
The 90-day arc preserves it.
Watches retire one at a time, only after their Chainsaw equivalents have been in enforce for two weeks. Before the scoping call you get a reference architecture, a decision-diff template, sample Rego rules, the watch-to-rule mapping and a rollback runbook.