Stop stacking scanners on cracked concrete and calling it a release system.
Teams already know Syft, Trivy, and Cosign. The tools are excellent. The gap shows up the third time someone copies a pipeline YAML into a new repo and quietly drifts the severity policy, the evidence paths, and the promote rules. That is not a scanner problem. That is a foundation problem.
We built ReleaseFlow (rflow) for that foundation: a local-first, CI-agnostic CLI that turns a release into an immutable manifest plus orchestrated SBOM, scan, and sign evidence—with optional Business Edition gates, verify, and promote approvals—without a hosted control plane you have to babysit.
This post is honest about functionality, simplicity, and value, and about what it actually costs to recreate one rflow-class pipe without buying the glue. Engineering-time figures below are labeled estimates (judgment ranges with stated assumptions), not stopwatched Fremen Labs metrics. Competitor prices are public list / starting-at signals as of September 2026 unless noted.
Direct Answer
Standing up an rflow-equivalent spine for one product is roughly:
- ~2–3.5 eng-months on a lean single-CI path (GitHub Actions, keyless Cosign, minimal gates)
- ~4.5–9 eng-months for production-grade evidence layout, real policy gates, promote/approvals, and multi-CI parity
- ~1–3 eng-months/year afterward to keep scanners, CVE allowlists, and keys healthy
Business Edition list price is $2,500/year unlimited. That is not “free engineering.” It is a deliberate bet that most of that glue should not be re-invented per product.
Honest Scope First
ReleaseFlow is not Artifactory or Nexus. It does not host packages. It is not a full Snyk-class AppSec IDE/PR platform. It is not a Chainguard image catalog.
It is the release evidence layer beside the registry you already trust: versioned YAML under manifests/, Syft/Trivy/Cosign orchestration, optional external evidence refs, and—on Business—gates that re-read real evidence files before promote.
If you need a universal binary repository or a commercial scanner UI as the system of record for every developer workflow, keep those tools. If you need the spine to prove what shipped, what was scanned, and what was signed, keep reading.
What One rflow Pipe Covers
| Capability | What it does | Edition |
|---|---|---|
| Immutable release manifest | Versioned YAML—version, git metadata, artifacts, pointers to SBOM/scan/signature evidence | Open-core |
Bootstrap / release.yaml | Control-plane or app scaffold; same config across CI vendors | Open-core |
| SBOM / scan / sign | Orchestrates Syft, Trivy, Cosign (keys can stay in KMS) | Open-core |
| External evidence | S3 / Azure Blob / on-prem with *.ref.yaml + sha256 when git would bloat | Open-core |
| Policy gates | requireScan, requireSbom, signatures, severities, CVE allowlists | Business |
| Verify / promote | Integrity checks; promote with optional approval token | Business (approvals) |
| Offline license | Ed25519 RFLOW-… license; air-gap friendly | Business |
Path A — DIY With Syft + Trivy + Cosign + Scripts
Assumptions: mid-senior platform / DevSecOps engineer; existing container registry; one primary artifact type; goal is orchestration + evidence + gates—not IDE AppSec UX.
| Workstream | Est. person-weeks |
|---|---|
| Manifest SSoT + bootstrap | 3–6 |
| SBOM + scan + sign wiring | 3–7 |
| Evidence layout / external refs | 2–4 |
| Policy gates + verify | 3–6 |
| Promote / approvals | 2–4 |
| Multi-CI templates (GHA + ADO + GitLab) | 3–6 |
| Hardening + docs | 2–4 |
| Total stand-up | ~18–37 pw (~4.5–9 eng-mo) |
| Lean GHA-only path | ~8–14 pw (~2–3.5 eng-mo) |
| Steady-state | ~1–3 eng-mo/year |
License cost of the open tools: about $0. Opportunity cost is the real number. If a loaded mid-senior engineer is roughly $200k–$320k/year, 4.5–9 eng-months lands on the order of ~$75k–$240k before commercial scanner seats—illustrative only.
Public guides often get a first SBOM+scan+sign job green in days to about two weeks. Production-grade single source of truth, gates, and multi-CI is where calendars stretch into months. Foundations take longer than the penthouse demos suggest. That is the point.
Path B — Buy Platform Pieces
Public starting-at / list signals (re-check before you quote them in a procurement deck):
| Stack | Public signal | Still leaves for you |
|---|---|---|
| ReleaseFlow Business | $2,500/year unlimited | Process + the registry you already have |
| Snyk | Free; Team from $25/mo on the plans page; Enterprise contact sales. Mid-market is often per contributing developer / credits—verify live | Manifest SSoT, Cosign spine, multi-CI control-plane bootstrap |
| JFrog | SaaS Ent X from ~$950/mo; self-hosted Pro X from ~$27k/yr; Ent X from ~$51k/yr | Often more platform than a release-evidence CLI needs if you already have a registry |
| Chainguard Catalog | From ~$19k for a team of 10 (hardened images) | Complements bases; does not orchestrate your app release spine |
| Harness CD | Typically modular / quote | Strong CD/approvals; not a local SBOM/scan/sign SSoT CLI |
Scanner and CD platforms are excellent at their center of gravity. Few ship the same local-first manifest + evidence + gate + promote spine as one CI-agnostic binary at mid-market unlimited pricing.
Why This Work Is On the Calendar Anyway
Compliance pressure is not a slogan:
- EU Cyber Resilience Act — in force December 2024; main obligations December 2027; vulnerability reporting obligations from September 2026. SBOM and technical documentation expectations are part of the manufacturer story.
- NIST SSDF / CISA attestation — secure development practices and federal attestation language push retainable evidence of how software was built and handled.
- SLSA-ish provenance — industry practice for build integrity; complements SBOM + signing. It is not a literal substitute for CRA text, and CRA does not “require Cosign.”
None of those statutes say “buy rflow.” They do say teams will keep paying someone—engineers or vendors—for evidence-backed releases.
Functionality, Simplicity, Value
Functionality. One CLI covers the release spine most mid-market teams cobble together from Actions snippets, wiki pages, and “ask the platform person.” Open-core records. Business decides whether a release may proceed.
Simplicity. Local binary, release.yaml, doctor checks, same spine in the CI you already run. Prerequisites stay honest: git, container tooling, Syft/Trivy/Cosign on PATH as needed.
Value. The scarce resource is not another YAML linter. It is repeatable evidence and gates that still mean something when the third product copies the first product’s pipeline and quietly drifts. Unlimited-use Business pricing is aimed at that multi-product reality: one license, many spines—not a tax per seat every time a developer joins a repo.
Estimated Leverage Across Products We Run On rflow
Fremen Labs
Products on the spine: Vorsam, Navo, ReleaseFlow, Avail, Paladin, Elastro, Speed Read.
Scaling model (estimate): after product #1, shared templates and CLI reuse about 50–70% of stand-up work. Remaining per product is roughly 0.3–0.5 × T(1) for wiring, allowlists, and artifact quirks.
| Scenario | Eng-months to DIY-equivalent (estimate) |
|---|---|
| Seven products × lean path (shared library) | roughly ~8–15 eng-months total |
| Seven products × full multi-CI / gates path | roughly ~15–36 eng-months total |
| Steady-state if each product forked its own scripts | closer to linear in products/teams—the failure mode rflow is meant to avoid |
That is the engineering work the spine is designed to absorb, not a claim that we timed seven DIY rebuilds with a stopwatch. If we later publish measured before/after metrics, those numbers replace this section.
At Business list price, one org-wide license is $2,500/year—versus rebuilding glue seven times, or stacking per-seat scanners and still writing promote and manifest logic.
Mentat Advisors (separate)
Windtrap runs on the same class of release spine, but it is a Mentat Advisors product—not Fremen Labs branding. Treat its leverage with the same per-product estimate model, and keep Mentat copy Mentat-owned.
What We Will Not Claim
- Exact “we saved X months” as audited fact without timesheets
- That
rflowreplaces Artifactory, full Snyk AppSec, or Chainguard catalogs - That CRA “requires Cosign” or “requires SLSA L3”
- That open-core silently enforces Business gates without a license
- Competitor negotiated quotes that are not on a public pricing page
Key Takeaways
- Open scanners are free. The glue—manifest SSoT, evidence layout, gates, promote, multi-CI—is where eng-months go.
- One product DIY spine: roughly 2–9 eng-months depending on rigor, plus 1–3 eng-months/year to maintain.
- Multi-product companies pay either in eng-months or in platforms. Shared templates help; forked scripts do not.
- Business Edition at $2,500/year unlimited is priced for that multi-product reality beside the registry you already have.
- Keep commercial scanners and registries for their real jobs. Use
rflowfor the release foundation.
One good release pipe looks small until you multiply it by products, CI vendors, allowlist churn, and auditors who ask “prove what shipped.” DIY is real and often right for a single greenfield experiment. Build the foundation once—or keep pouring concrete on every new product.
Want the evidence layer without a registry migration? See pricing, compare tools, or read the FAQ.