Skip to content
SecHelixv3 alpha
GitHub
DocsContributeSupportWorkbenchGitHub
Core Concepts

Release Decisions

Four release outcomes with fail-closed semantics, and the rules that stop UNKNOWN or BLOCKED coverage from being laundered into a PASS.

The four outcomes

OutcomeDefinition
PASSNo unresolved release-blocking verified findings.
PASS_WITH_KNOWN_RISKExplicit accepted non-blocking risk.
BLOCKEDUnresolved Critical or High finding, or an integrity-critical unknown under the active policy.
INCOMPLETERequired evidence unavailable. Does not imply security certification.

Four outcomes rather than two, because a binary pass or fail forces every uncertainty into one of the two buckets, and in practice that bucket is pass.

Fail-closed semantics

Release gates fail closed to INCOMPLETE for malformed or missing evidence. That is a property of the implementation, not a recommendation: an empty or malformed report cannot produce PASS.

  • Never coerce UNKNOWN or BLOCKED into NOT_APPLICABLE.
  • Never turn LIKELY_BUT_UNPROVEN into VERIFIED to satisfy a gate.
  • Never present INCOMPLETE as a clean result.
  • CI treats exit codes 1 and 2 as non-green.

The gate is the authority

The policy controls which severities block, which severities require independent verification and regression proof, whether accepted risk is permitted, what an accepted risk must carry, the outcome for integrity-critical unknowns, required evidence tools, forbidden deployment states, and severity overrides. See policies/README.md.

Integrity-critical unknowns

The coverage object carries an integrity_critical_unknown flag alongside the four applicability counts. When it is set, the policy decides the outcome.

Default policy
Returns INCOMPLETE. The release is not certified, and the missing evidence is named.
Strict policy
Turns the same condition into BLOCKED, and additionally blocks Medium findings.

If integrity-critical coverage is unknown, the gate must choose INCOMPLETE or a policy-selected BLOCKED. A silent PASS is not one of the options.

INCOMPLETE is not a failure state

INCOMPLETE means the run could not gather what the policy required. That can happen because a tool was unavailable, because an environment could not be reached, or because authorization did not extend to the area in question. All three are legitimate and all three are reportable.

Treating INCOMPLETE as an error to be suppressed is how a gate becomes decorative. Treating it as information is how a team learns which parts of a system it currently cannot assess.