# Glossary

> The words Stableship uses in the app, the CLI and the API, and what each one means.

## Verdicts

Every run ends with one verdict. The app shows three of them as Cleared: the release goes out.

| In the app | In the API | Means |
|---|---|---|
| Cleared | `pass` | Nothing blocks the release. |
| Cleared | `warn` | Nothing blocks the release, but there are notes to read. |
| Held | `block` | A proven problem blocks the release. |
| Skipped | `skipped` | Nothing needed checking. |
| Cleared | `fail_open` | Stableship could not finish, and the release went out because the change was low-risk. |
| Overridden | `ship_anyway` | A person chose to ship anyway. Their name and reason are in the activity log. |

## Runs

A run is one check or audit.

| In the app | In the API | Means |
|---|---|---|
| Queued | `queued` | Waiting to start. |
| Preparing | `preparing` | Building the private copy. |
| Running | `running` | Testing. |
| Verifying | `verifying` | Replaying what it found on a fresh copy before it can block. |
| Completed | `completed` | Finished, with a verdict. |
| Could not run | `failed_infra` | Stableship could not run it. It never counts against your plan, and never holds a low-risk release. |
| Cancelling | `cancelling` | Stopping. |
| Cancelled | `cancelled` | Stopped before it finished. |
| Timed out | `timed_out` | Ran out of time. It never counts against your plan. |
| On hold | `held` | An audit whose private copy could not be built. It does not count against your plan, and it resumes on your next push to the default branch. |

## Scopes

`quick`, `security`, `qa`, `full` and `skip`, picked from what a change touched, or asked for with `auto` (the default) and the rest. See [How Stableship works](/docs/concepts#audits-and-checks).

## Findings

- **Reproduced**: proven by replaying it twice on a fresh copy.
- **Confirmed**: a fact Stableship established directly, such as a key in the browser code or row level security off on a public table.
- **Suspected**: a lead that was not proven. It never blocks.
- **Blocking**: proven, and severe enough under your app's policy to hold a release. See [What an audit checks](/docs/help/audits-and-verdicts#what-can-block-a-release).
- **Severity**: `critical`, `high`, `medium`, `low` or `info`.
- **Status**: `open`, `fixed`, `not_seen` (Not seen lately: later checks covered it twice and did not see it again) or `dismissed`.

## Kinds of user

Each kind of user has a key, used by `--as` and the `role` argument. Rules can also name `owner` (the person a record belongs to), `signed_in` (anyone with an account) and `public` (anyone at all). `--as signed_out` tests as someone who is not signed in.

## Autonomy

How much Stableship does without asking: `hands_on`, `guided` or `autopilot`. Anything that lowers protection always asks a person.