> ## Documentation Index > Fetch the complete documentation index at: https://delivery.vexa.ai/llms.txt > Use this file to discover all available pages before exploring further. # How it works > We publish, your cluster pulls and checks, it rolls out or back, a receipt returns. 1. **We publish** a release to a channel, with its validation evidence. 2. **Your cluster pulls it.** Argo CD syncs; Kyverno verifies the signatures with cosign at admission, and — when you install with [`--verifier-image`](install#step-3-install), which is what turns that gate on — the PreSync verifier checks the entry against your contract before the sync. That is what makes the update safe to roll. 3. **The cluster rolls it out, or rolls it back.** 4. **A receipt goes back to the channel**, so we know how it went. Vexa publishes and gates a release into the channel; your cluster pulls it, admits it, deploys to staging, a human smokes it, you promote to production, and a station report returns to the channel Argo CD works against a generic, deterministic state — a Kubernetes namespace — so this is a deterministic operation. Nothing is pushed to your cluster. We have no access to your cluster. Your cluster has access to the channel, one way. The loop closes with a receipt, and that is the only thing flowing back. Next: [Install](install) · [Upgrade](upgrade) · [The channel](channel)