quality gate layer

2026-05-07 17:00:10 +02:00
parent 4c44db802d
commit ed0f270278
6 changed files with 267 additions and 0 deletions
--- a/docs/ARCHITECTURE-BLUEPRINT.md
+++ b/docs/ARCHITECTURE-BLUEPRINT.md
@@ -243,6 +243,10 @@ Architecture lesson:
 Repository quality packs should be normal extensions. A score is not a
 certification verdict; it is a normalized finding and trend signal.

+Quality gates should be core policy decisions over retained posture, not
+extension-specific verdicts. The first gate layer checks latest run status,
+unexpected finding count, and whether the latest trend regressed.
+
 Sources:

 - [OpenSSF Scorecard](https://openssf.org/projects/scorecard/)