Gates and verdicts¶
The gate policy is deterministic code. There is no model in the decision path. Thresholds live at the top of the policy and nowhere else, and the policy version is recorded on every decision.
How a verdict is computed¶
| Outcome | Verdict |
|---|---|
| Any hard gate fails | DENY |
| No hard gate fails, any soft gate fails | CONDITIONAL |
| Every gate passes | AUTHORIZE |
A hard gate failure returns the build to engineering. It cannot be risk accepted. A soft gate failure is a finding for the reviewer: accept with a written basis, or reject.
For a system of several containers, the system verdict is the worst of its members. A boundary member with no scan record is surfaced as a coverage gap and does not affect the verdict.
Hard gates¶
| Gate | Label | What it means | What closes it |
|---|---|---|---|
| G1 | All scan stages pass | Every scan stage in the pipeline finished. A failed or missing scan job means the evidence for the other gates is incomplete. | Rerun or fix the failed scan job. |
| G2 | No unmitigated vulnerabilities | Every CVE found is either fixed by the installed version or carries a mitigation entry in cdso_config.yml. |
Update the package, or record a mitigation keyed by the CVE id. |
| G3 | No malware detected | No file matched a malware signature. | Remove the flagged file and rebuild. Never justified. |
| G4 | No live credentials in image | No credential verified live against its provider. Unverified pattern matches do not fail this gate. | Revoke and rotate, remove from source and image history, rebuild. |
| G5 | Approved base image, non root user | The image is built from an approved base and runs as a non root user. | Change FROM to an approved base, add a USER instruction, rebuild. |
| G6 | No open SAST findings | Every static analysis finding is fixed in the code or excluded by rule id with a written reason. Evaluated only when static analysis ran. | Fix the code, or add an exclusion keyed by the rule id. |
| G7 | No Dockerfile errors | No error level lint rule against the Dockerfile. | Fix the lines named. hadolint.ignores carries any deliberate deviation. |
Soft gates¶
| Gate | Label | What it means | What closes it |
|---|---|---|---|
| S1 | No High or Critical CVEs awaiting mitigation | No High or Critical CVE is waiting on a mitigation decision. A Critical is fixed, never mitigated; a High may be justified but the reviewer scrutinises the reason. | Update the package or record the mitigation. |
| S2 | Vulnerability DB current | The vulnerability database was no more than 30 days old when the scan ran. | Rerun the scans; the database refreshes on each run. |
| S3 | No Dockerfile warnings | Warnings have been triaged: fixed or listed under hadolint.ignores with a reason. |
Fix the lines or record the ignore. |
| S4 | All DAST alerts mitigated | Every dynamic scan alert against the running application carries a mitigation. Evaluated only when a dynamic scan ran. | Fix the behaviour flagged, or record zap.skip_reason. |
| S5 | Code coverage at or above 50% | The application test job reported line coverage at or above the floor. Evaluated only when full pipeline data is present. | Add tests, or record why the floor does not apply. |
| S6 | No failed CI jobs | No job in the run failed. Manual and skipped jobs are excluded. Evaluated only when full pipeline data is present. | Fix or rerun the failed job. |
Deployment level¶
The container spec gate (G5) reads deployment_level from cdso_config.yml. A root user passes at DEVELOPMENT and fails at PRODUCTION. Root at PRODUCTION can be justified with a reason a reviewer can check: what needs it, what limits it, and what would remove the need.
Thresholds¶
| Threshold | Value |
|---|---|
| High severity set | Critical, High |
| Vulnerability database maximum age | 30 days at scan time |
| Coverage floor | 50% line coverage, advisory |
Policy version¶
The current policy is version 0.2.0. Every decision records the version it was made under. A change to the gate set or a threshold is a policy decision, is versioned, and never silently reclassifies a recorded verdict.
Controls¶
Each gate maps to formal security controls through CCIs, the DISA unit of a NIST 800-53 control that evidence is mapped to. The CCI reference in the console profile menu lists every control with its description and family.