Reference

Glossary

The words Stableship uses in the app, the CLI and the API, and what each one means.

Verdicts

Every run ends with one verdict. The app shows three of them as Cleared: the release goes out.

In the app	In the API	Means
Cleared	`pass`	Nothing blocks the release.
Cleared	`warn`	Nothing blocks the release, but there are notes to read.
Held	`block`	A proven problem blocks the release.
Skipped	`skipped`	Nothing needed checking.
Cleared	`fail_open`	Stableship could not finish, and the release went out because the change was low-risk.
Overridden	`ship_anyway`	A person chose to ship anyway. Their name and reason are in the activity log.

Runs

A run is one check or audit.

In the app	In the API	Means
Queued	`queued`	Waiting to start.
Preparing	`preparing`	Building the private copy.
Running	`running`	Testing.
Verifying	`verifying`	Replaying what it found on a fresh copy before it can block.
Completed	`completed`	Finished, with a verdict.
Could not run	`failed_infra`	Stableship could not run it. It never counts against your plan, and never holds a low-risk release.
Cancelling	`cancelling`	Stopping.
Cancelled	`cancelled`	Stopped before it finished.
Timed out	`timed_out`	Ran out of time. It never counts against your plan.
On hold	`held`	An audit whose private copy could not be built. It does not count against your plan, and it resumes on your next push to the default branch.

Scopes

quick, security, qa, full and skip, picked from what a change touched, or asked for with auto (the default) and the rest. See How Stableship works.

Findings

Reproduced: proven by replaying it twice on a fresh copy.
Confirmed: a fact Stableship established directly, such as a key in the browser code or row level security off on a public table.
Suspected: a lead that was not proven. It never blocks.
Blocking: proven, and severe enough under your app's policy to hold a release. See What an audit checks.
Severity: critical, high, medium, low or info.
Status: open, fixed, not_seen (Not seen lately: later checks covered it twice and did not see it again) or dismissed.

Kinds of user

Each kind of user has a key, used by --as and the role argument. Rules can also name owner (the person a record belongs to), signed_in (anyone with an account) and public (anyone at all). --as signed_out tests as someone who is not signed in.

Autonomy

How much Stableship does without asking: hands_on, guided or autopilot. Anything that lowers protection always asks a person.

For your coding agent: this page as Markdown