| Change tracking with shipped diffs | Supported today | Deployments, config, and GitOps changes, correlated to failing workloads. |
| CSC Score & pre-flight verdicts (SHIP / HOLD / BLOCK) | Supported today | Deterministic; advisory unless you wire the CI gate yourself. |
| Incident investigation with cited evidence | Supported today | Root cause, proposed fix, verify criteria. |
| Autonomous remediation with verification | Supported today (opt-in) | Off until you enable it and grant the namespaced RBAC. |
| Security scanning (CIS, CVE, runtime, SBOM, deprecated APIs) | Supported today (plan-gated) | Includes a privileged Falco DaemonSet — disclosed here. |
| Compliance mapping (SOC 2, PCI, HIPAA…) | Supported today (plan-gated) | Evidence support — not a certification. |
| Engineering Advisor / Opinion / Experience / Reasoning factors | Early Access | Off by default, per-tenant flags — the full list. |
| Multiplayer incident workspace | Early Access | Flag WORKSPACE_ENABLED. |
| Code Graph (repo knowledge graphs for investigation) | Early Access | Ships in the chart, off by default (codeGraph.enabled). |
| Collector resource tuning | Supported today (chart ≥ 5.3.6) | Defaults 25m/64Mi requests, 500m/512Mi limits; override via agent.collector.resources — sizing. |
| HTTP(S) proxy support | Not yet supported | Direct outbound HTTPS to api.changeguard.ai:443 is required. |
kubectl CSC / push-count status columns | Not yet supported | The CR prints blank CSC/PUSHES columns; the dashboard is the source of truth. |
| Terraform plan awareness | Not yet supported | Change intelligence covers Kubernetes and GitOps changes today. |
| On-call schedule awareness | Not yet supported | Recommendations don’t know who is on call. |
| Self-serve API key rotation API | Not yet supported | Rotate in-app; confirm full invalidation via support for high-assurance cases. |
