Release Decisions
Four release outcomes with fail-closed semantics, and the rules that stop UNKNOWN or BLOCKED coverage from being laundered into a PASS.
The four outcomes
| Outcome | Definition |
|---|---|
| PASS | No unresolved release-blocking verified findings. |
| PASS_WITH_KNOWN_RISK | Explicit accepted non-blocking risk. |
| BLOCKED | Unresolved Critical or High finding, or an integrity-critical unknown under the active policy. |
| INCOMPLETE | Required evidence unavailable. Does not imply security certification. |
Four outcomes rather than two, because a binary pass or fail forces every uncertainty into one of the two buckets, and in practice that bucket is pass.
Fail-closed semantics
Release gates fail closed to INCOMPLETE for malformed or missing evidence. That is a property of the implementation, not a recommendation: an empty or malformed report cannot produce PASS.
- Never coerce UNKNOWN or BLOCKED into NOT_APPLICABLE.
- Never turn LIKELY_BUT_UNPROVEN into VERIFIED to satisfy a gate.
- Never present INCOMPLETE as a clean result.
- CI treats exit codes 1 and 2 as non-green.
The gate is the authority
The policy controls which severities block, which severities require independent verification and regression proof, whether accepted risk is permitted, what an accepted risk must carry, the outcome for integrity-critical unknowns, required evidence tools, forbidden deployment states, and severity overrides. See policies/README.md.
Integrity-critical unknowns
The coverage object carries an integrity_critical_unknown flag alongside the four applicability counts. When it is set, the policy decides the outcome.
- Default policy
- Returns
INCOMPLETE. The release is not certified, and the missing evidence is named. - Strict policy
- Turns the same condition into
BLOCKED, and additionally blocks Medium findings.
If integrity-critical coverage is unknown, the gate must choose INCOMPLETE or a policy-selected BLOCKED. A silent PASS is not one of the options.
INCOMPLETE is not a failure state
INCOMPLETE means the run could not gather what the policy required. That can happen because a tool was unavailable, because an environment could not be reached, or because authorization did not extend to the area in question. All three are legitimate and all three are reportable.
Treating INCOMPLETE as an error to be suppressed is how a gate becomes decorative. Treating it as information is how a team learns which parts of a system it currently cannot assess.