Glossary

Authorization. The reviewer's approval of the review merge request in GitLab, as themselves. The decision that lets a build ship.

Basis. The written reason a reviewer records when accepting a risk or rejecting a submission. Required; recorded with the reviewer's identity and the time.

CCI. Control Correlation Identifier: the DISA unit of a NIST 800-53 control that evidence is mapped to.

cDSO. Continuous DevSecOps. The pipeline framework that scans, tests, and publishes evidence for containerized software. Attest is the console above it.

cdso_config.yml. The one file in an application repository that configures scanning and carries every justification.

Claim. A reviewer's soft lock on a container: "I am reviewing this now." Lapses after thirty minutes without activity.

Container. A packaged piece of software that will run in production. The cDSO pipeline scanned it automatically before it reached you.

Coverage gap. A member of a system boundary with no scan record. Surfaced; does not affect the verdict.

Delta. What changed between one scan run and the previous run for the same container: findings resolved, findings new, or nothing.

Deployment level. DEVELOPMENT, STAGING, or PRODUCTION. Where the container will run. Changes the container spec gate.

Evidence hash. The commit in the security repository where the scan record for a run lives. Every decision points to one.

Explainable AI. Plain language narration of what a finding is, why it matters, and what closes it, grounded only in the pipeline's evidence. Always spelled out. Never in the decision path.

Gate. One security check the pipeline ran. Each gate maps to formal security controls, the CCIs you see beside a finding.

Hard gate. A pass or fail check that blocks authorization when it fails. The risk cannot be accepted; engineering fixes it.

Justification. A developer's written reason, in cdso_config.yml, that a finding does not need to be fixed before this build ships. Read verbatim by the reviewer.

Mitigation. A justification for a specific CVE. Keyed by the CVE id.

Policy version. The version of the gate policy in force when a verdict was computed. Recorded on every decision.

Review merge request. The submission. Opened by the pipeline in the security repository when every scan passes on a tagged run. Approved or closed by the reviewer as themselves.

Reviewer. The Security Control Assessor, or whoever holds that responsibility. The named person who decides and signs.

Risk owner. The CISO, authorizing official, or program security lead who answers for the decisions.

Scan stage. One phase of the pipeline. Each stage runs one or more scanners whose output feeds the gates.

Security repository. The GitLab project where scan output and review merge requests for a security group live. Ulap managed infrastructure; separate from the application repository.

Soft finding. A check that raises a concern but leaves the call to the reviewer. Accept the risk with a written basis, or reject.

Tagged run. A pipeline run on a Git tag. Only a tagged run with every scan passing opens a review merge request.

Verdict. The pipeline's overall read of a run: AUTHORIZE, CONDITIONAL, or DENY. Distinct from the authorization, which is the reviewer's decision.

Worklist. The developer's view of one container: findings grouped by the change that clears them, worst first, one next action at a time.