Your change board gains authority. It does not lose any.
If someone has sent you this page, the question you are about to ask is whether a security vendor is now in your deploy path. The answer is no, and this page exists to show the work rather than assert it.
Churchill does not approve anything, cannot approve anything, and adds no step that WestGate controls. What it does is make your existing approval the only path that works. Today an approved release is the way changes are supposed to happen. After Churchill it is the way they can happen.
The governance screen your change board works in. Quorum, published state, and who holds a seat, all in one view.
Asked in your words. Answered without hedging.
{{ q.q }}
{{ q.a }}
Every one of these is expanded, with the mechanism, in the Technical FAQ. Nothing above is softened there.
Exactly what changes, and what does not.
{{ s }}
{{ c }}
You need a change Churchill has not approved. Here is the whole path.
Written out in full because this is the sequence you will judge us on, and because you should know the constraints before you agree to anything, not after.
{{ s.v }}
What this is: a governed maintenance event that produces a signed change and a protected application on the other side. What it is not: a way to hot-patch a running settlement broker. If your continuity plan needs the second thing, plan the change as a maintenance window.
Reasons to say yes, in your terms rather than ours.
Not the security argument. The five things that change for the team that owns the hosts.
{{ u.v }}
Reasons to say no, from us.
You will find these eventually. Better that you find them here, in week one, than in a pilot in week nine.
{{ l.v }}
Put it on a host you own and try to break your own pipeline with it.
Thirty days, non-production, a host you choose. Run your real release process against it and see what it refuses. That is a better evaluation than any conversation with us.
Churchill is built and validated on IBM LinuxONE.