- -
-

Security Diff

-

Changes from {{ approval().fromEnv }} to {{ approval().toEnv }}

-
-
- + - 2 new CVEs introduced -
-
- − - 1 CVE resolved -
-
- ~ - 3 components updated -
-
- + + +
+ @if (activeTab() === 'overview') { +
+

Overview

+

+ Decision case-file for release approval {{ approval().id }} with governance, risk, + data confidence, and evidence context in one place. +

+
    +
  • Blocking gates: {{ gateBlockCount() }}
    • +
  • Requested path: {{ approval().sourceEnvironment }} -> {{ approval().targetEnvironment }}
    • +
  • Exception requested: {{ requestException ? 'Yes' : 'No' }}
    • +
+
+ } + + @if (activeTab() === 'gates') { +
+

Gates

+

Data snapshot: OSV 35m, NVD 3h 12m, Nightly SBOM rescan WARN

+

Decision digest: {{ decisionDigest }}

+ +
- - - - + + + + - - - - - - - - - - - - - - - - - - + @for (row of gateTraceRows; track row.id) { + + + + + + + @if (expandedGateId() === row.id) { + + + + } + }
FindingChangeSeverityReachableGateResultWhyActions
CVE-2026-1234NEWHIGH - -
CVE-2026-5678NEWMEDIUM - -
CVE-2025-9999FIXEDCRITICAL—
{{ row.gate }} + + {{ row.result }} + + {{ row.why }} + + @if (row.result === 'BLOCK') { +
+ @for (link of row.fixLinks; track link.label) { + {{ link.label }} + } +
+ } +
+

Inputs: {{ row.inputs.join(', ') }}

+

Timestamp: {{ row.timestamp }}

+

Evidence age: {{ row.evidenceAge }}

+
+ } - - @if (selectedWitness()) { -
-
-
-

Reachability Witness

-

{{ selectedWitness()!.findingId }} in {{ selectedWitness()!.component }}@{{ selectedWitness()!.version }}

-
- + @if (activeTab() === 'security') { +
+

Security

+

+ CritR {{ approval().critR }} | VEX coverage 83% | SBOM freshness {{ approval().sbomFreshness }} +

+ +
+
+

By Environment

+
    +
  • Staging CritR: 1
    • +
  • Production CritR: 3
    • +
- - -
-
{{ selectedWitness()!.description }}
+
+

Delta vs Deployed

+

+2 critical reachable introduced / -1 resolved.

+
- -
-
- {{ selectedWitness()!.state | uppercase }} - {{ selectedWitness()!.confidence }}% confidence -
-
- {{ selectedWitness()!.confidenceExplanation }} -
-
- - -
-

Call Path

-
- @for (node of selectedWitness()!.callPath; track node.function; let i = $index; let last = $last) { -
-
- @switch (node.type) { - @case ('entry') { } - @case ('call') { } - @case ('guard') { } - @case ('sink') { } - } -
-
- {{ node.function }} - {{ node.file }}:{{ node.line }} -
-
- @if (!last) { -
- } - } -
-
- - -
-

Analysis Details

-
-
- Data Flow Confidence - {{ selectedWitness()!.analysisDetails.dataFlowConfidence }}% -
-
- Dynamic Loading - - {{ selectedWitness()!.analysisDetails.dynamicLoading ? 'Detected' : 'None' }} - -
-
- Reflection - - {{ selectedWitness()!.analysisDetails.reflection ? 'Detected' : 'None' }} - -
- @if (selectedWitness()!.analysisDetails.conditionalExecution) { -
- Conditional Execution - {{ selectedWitness()!.analysisDetails.conditionalExecution }} -
- } -
- - @if (selectedWitness()!.analysisDetails.guards.length > 0) { -
- Guards Detected -
- @for (guard of selectedWitness()!.analysisDetails.guards; track guard) { - {{ guard }} - } -
-
+ + + + + + + + + + + + @for (item of securityFindings; track item.cve) { + + + + + + + } - + +
CVEPackageComponentReachabilityVEX
{{ item.cve }}{{ item.packageName }}{{ item.component }}{{ item.reachability }}{{ item.vex }}
- -
- - - - -
-
- } - - -
-

Gate Results

-

Policy: stg-baseline v3.1

-
- @for (gate of gates; track gate.name) { -
- {{ gate.status }} - {{ gate.name }} - -
- } +
+ Open Findings (filtered) + Open VEX Hub + Open Exceptions
+ } - -
-

Comments

-
- @for (comment of comments; track comment.id) { -
-
- {{ comment.author }} - {{ comment.time }} -
-

{{ comment.body }}

-
+ @if (activeTab() === 'reachability') { +
+

Reachability

+

Coverage: Build 84% | Image 92% | Runtime 61%

+

Evidence age: Build 42m | Image 38m | Runtime 2h 11m

+

+ Policy interpretation: Runtime coverage below 70% downgrades confidence and can + block strict production promotions. +

+ + + + + + + + + + + + + @for (item of reachabilityRows; track item.component) { + + + + + + + + } + +
ComponentDigestBuildImageRuntime
{{ item.component }}{{ item.digest }}{{ item.build ? 'Y' : 'N' }}{{ item.image ? 'Y' : 'N' }}{{ item.runtime ? 'Y' : 'N' }}
+ +
+ Open Reachability Ingest Health + Open Env Detail +
+
+ } + + @if (activeTab() === 'ops-data') { +
+

Ops/Data Health

+

Live data pending dedicated aggregation contract; using validated stub lens.

+ +
+
+

Feeds

+ @for (row of feedsRows; track row.name) { +

+ + {{ row.status }} + + {{ row.name }} - {{ row.detail }} +

+ } +
+
+

Nightly Jobs

+ @for (row of jobsRows; track row.name) { +

+ + {{ row.status }} + + {{ row.name }} - {{ row.detail }} +

+ } +
+
+

Integrations

+ @for (row of integrationRows; track row.name) { +

+ + {{ row.status }} + + {{ row.name }} - {{ row.detail }} +

+ } +
+
+

DLQ

+ @for (row of dlqRows; track row.name) { +

+ + {{ row.status }} + + {{ row.name }} - {{ row.detail }} +

+ } +
+
+ +
+ Open Data Integrity + Open Integrations + Open Scheduler Runs + Open DLQ +
+
+ } + + @if (activeTab() === 'evidence') { +
+

Evidence

+
    + @for (artifact of evidenceArtifacts; track artifact.name) { +
  • + {{ artifact.name }} - + {{ artifact.status === 'ready' ? 'ready' : 'pending seal' }} +
    • + } +
+

Signature status: DSSE signed, transparency log anchored, replay metadata present.

+
+ + Open Export Center + Open Proof Chain +
+
+ } + + @if (activeTab() === 'replay') { +
+

Replay/Verify

+
+ + + + +
+ + +

Recent Replays

+
    + @for (event of replayEvents; track event.id) { +
  • {{ event.requestedAt }} - {{ event.status }}
    • } @empty { -

    No comments yet

    +
  • No replay requests yet.
    • } -
-
- - + + +
+ Open canonical Replay/Verify
-
+ } - - -