Claims and the tests behind them
Every claim on this site is backed by a test in the Nojam repository. A claim with no test doesn’t go on the site. Pilot customers get the repository and can run any of them.
Claims and their tests
| Claim | Test |
|---|---|
| A merge applies without a second approval only if its plan makes exactly the same changes as the reviewed one | carryover_test.go |
| Production approval needs a session, MFA and a recent step-up; the author cannot approve | approval_assurance_test.go, approvers_test.go |
| Each job gets its own Vault credential, sealed in transit and revoked when Terraform finishes | vault_test.go, vaultsealed_test.go |
| The issuer can be closed to everyone except Vault | TestIssuerAllowedCIDRs, TestIssuerKeyGivenToVault |
| Deleting what cannot be rebuilt needs break-glass; 50 KV-granting policies recreated without a hold | TestCriticalMounts |
| A parent-namespace wildcard policy is held and named | TestRecommendedBaseline, TestVaultEnterpriseParentPolicyReachesChild |
| Break-glass needs a reason, extra approvers and an optional ServiceNow record | TestBreakGlassReason, TestBreakGlassApprovers, TestBreakGlassRecord |
| Break-glass through a Vault control group that Nojam cannot skip | TestVaultEnterpriseControlGroupBreakGlass |
| Cross-namespace grants are named on the pull request | TestCrossNamespaceGrants |
| One isolated namespace per team on Vault Enterprise | TestVaultEnterpriseJobNamespace, TestVaultEnterpriseNamespaces |
| Namespace vending through a pull request | TestVaultEnterpriseNamespaceVending |
| Jobs ride through Vault leader changes and performance standbys | TestVaultEnterpriseLeaderChange, TestVaultEnterprisePerformanceStandby, TestStandbyRetries412 |
| Providers only from your mirror, matching the committed lock file; changes shown | TestProviderPinning, TestProviderLockfile, TestProviderChanges, TestModulePinning |
| A mirror filled with no network access at all | TestDirectorySourceMirrorsWithoutTheNetwork, TestDirectorySourceRefuses |
| Your own pipeline steps run after every plan and cannot be dropped by a pull request | TestPipelineSteps |
| The audit log is hash-chained and anchored, signed and write-once | TestAuditAnchors, TestAuditAnchoringLine |
| One export ties a change together from commit to apply | TestJobEvidence |
| The support bundle never contains secrets, plans or logs | TestSupportBundle |
| Old plan files and webhook payloads are pruned; the change record stays complete | TestRetentionJobs, TestPruneWebhooks |
Measured numbers and their conditions
These ran on deliberately small machines with a local or in-memory Vault. A production Vault with persistent storage and audit devices answers more slowly, so expect longer plans.
| What | Result | Conditions |
|---|---|---|
| Resources in one state | 52,875 | 4 vCPU shared server, local Vault |
| 30 days of daily changes on one shared state | 24,402 resources, 21.8 MB state, all passed | as above |
| Plan time as one state grows | about 5 min at 12,000 resources, about 21 min at 24,000 | as above |
| Applying an approved plan | about 800 resources in 20 to 40 s | as above; the saved plan is applied without a second refresh |
| Created in one apply | 31,725 resources in 9 min 41 s | as above |
| An estate of 121 stacks | 37,707 resources; bootstrap 1 h 6 min; one team’s change 24 s; no failures | 1 CPU, one runner with one slot, Vault in development mode |
| Throughput, 100 stacks of 20 resources | opened to applied in 7 min 38 s with one runner slot, 5 min 4 s with four | server and runner on 1 vCPU, no provider downloads |
| Footprint | peak memory 282 MB for server, runner and OpenTofu | 1 vCPU and 2 GB, 30 minutes of continuous plans and applies |
| Failover | leader killed or database restarted mid-apply: applied exactly once | real processes, SIGKILL |
What Nojam does for speed, and what it can't
Nojam doesn't make a single large plan faster. That time is OpenTofu and Vault's API, the same under any orchestrator.
It saves time around the plan: it plans only the stacks a change affects, applies the approved plan without refreshing again, carries the approval from pull request to merge when nothing changed, and makes it safe to split one large state so plans stay small and run side by side.
Capacity follows CPUs. Give each runner host as many slots as it has CPUs, and add hosts as you need them.
Run the tests on your own estate
A pilot gives you the repository and the test farm setup, so your team can check any claim on this page.