Repository navigation
Fail Closed Finalization Readiness
The operator requested a fail-closed specification. This selects the outcome rule below, not the previously listed GitHub administrator trust, in-flight ordering, age-evaluation boundary, incident-unblock policy, or an enforcement backend. Those choices still need approval and proof.
Before any managed request that can create a draft, create a tag, or publish a release, the verifier must establish all applicable readiness conditions:
- An approved policy for that operation, including the applicable trust, revocation, freshness, and incident rules.
- Authenticated repository, workflow, run ID and attempt, candidate, full tag ref, authorized principal, and, for promotion, the same managed-created draft and release ID.
- All required current LUnit and qualification proof, cleanup, protected revocation and incident history, and the authority's current state.
- Proven applicable tag and release controls, recoverable intent, and reconciliation or fencing of prior relevant pending operations.
These are logical conditions, not a selected private evidence schema or a claim that the necessary GitHub controls exist. A missing history is not proof that no prior request or incident exists.
| Observation | Required response |
|---|---|
| A required policy, authority, identity, permission, proof, history, control, or terminal outcome cannot be established before dispatch. | Report UNKNOWN with a nonempty redacted reason and issue no GitHub write for that effect. |
| A required condition is independently confirmed violated before dispatch. | Report FAIL with a nonempty redacted reason and issue no GitHub write for that effect. |
| A request may already have been accepted and its outcome or possible late effect is unverified. | Preserve the independently recoverable obligation, report UNKNOWN, and block dependent writes and success. Do not blindly retry or claim that timeout, cancellation, or a later failed check stopped the remote request. |
| An earlier effect is confirmed and fully reconciled. | Record the attributable result; before any later managed effect, revalidate all then-applicable readiness conditions. A past PASS is not a permanent authorization. |
| A conflicting or otherwise unsafe effect is confirmed. | Report the failure, preserve its evidence and unresolved obligations, and signal the operator. Readback cannot undo a published release or establish that a previous race was prevented. |
Failing closed prevents new unauthorized managed dispatches; it cannot retroactively cancel an accepted remote request. If such a request later publishes, reconcile the actual result and apply the selected incident policy where applicable. Do not automatically delete a tag or withdraw a release merely to make the gate appear clean. Finalization outcomes and operator signals are separate from the six-field public qualification summary; they must not disclose credentials or protected evidence.
A different version is not automatically independent of an unresolved request: a late publication can affect repository-wide release state. Until noninterference or fencing is proven under an approved policy, treat other managed release writes in the same repository as dependent and block them too. Read-only reconciliation and separately authorized incident handling remain possible.