MR Sentinel

Audit log · ← dashboard

sgharlow/governance-demo-app!11

Verdict
block
Score
3.0 / 10
Rubric
v2
Commit
35ab181a
Scored
2026-05-19 05:11:47 UTC

Rule outcomes (15)

RuleCategoryOutcomeSeverityControlsEvidence
error-budget-impact-declaredoperationalfailwarningSOC2-CC4.1The MR description does not declare the expected error-budget impact for this database migration.
rollback-documented-for-migrationsoperationalfailerrorSOC2-CC7.5, ISO-27001-A.14.2.2The migration file `migrations/versions/002_add_encounters.py` contains an `upgrade()` function but is missing the corresponding `downgrade()` function to define the rollback path.
contract-has-spec-linkcontract_specpasswarningCDPD-§3, ISO-27001-A.14.2.1MR description includes 'Closes #142' linking to a spec issue.
integration-boundaries-explicitcontract_specpasswarningCDPD-§6, ISO-27001-A.14.2.5The database migration file explicitly defines the schema for new tables `encounters` and `encounter_icd10_codes`, serving as the contract.
no-commented-out-codequalitypassinfoSOC2-CC8.1No blocks of commented-out code (3+ consecutive lines) were found in the diff.
no-secrets-in-diffsecuritypassblockerSOC2-CC6.1, ISO-27001-A.9.4.3, OWASP-ASVS-V2No secret patterns (API keys, tokens, private keys, connection strings with passwords) were detected in the diff.
no-skipped-tests-introducedqualitypasserrorSOC2-CC8.1The diff does not contain any test files or introduce skipped tests.
spec-implementation-matchcontract_specpasserrorCDPD-§7MR description states 'adds the encounter + ICD-10 schema' and the diff creates `encounters` and `encounter_icd10_codes` tables as described.
acceptance-criteria-testablecontract_specskipwarningCDPD-§5, SOC2-CC8.1MR diff contains only a database migration; no application-level tests are present to evaluate against acceptance criteria.
auth-on-new-public-endpointssecurityskipblockerSOC2-CC6.1, OWASP-ASVS-V1This MR introduces database schema changes, not new public endpoints or handlers.
changed-method-coveragequalityskiperrorSOC2-CC8.1, ISO-27001-A.14.2.8The diff introduces a new database migration file and does not modify existing application methods or include new tests.
dependency-advisory-checksecurityskipblockerSOC2-CC7.1, ISO-27001-A.12.6.1, NIST-SA-11The diff does not add or upgrade project dependencies; it is a database migration file.
kill-switch-pathcontract_specskipwarningCDPD-§9, SOC2-CC7.5This MR introduces database schema changes, not direct user-facing behavior. Rollback for migrations is covered by `rollback-documented-for-migrations`.
mutation-resilience-critical-pathsqualityskipwarningSOC2-CC8.1No information provided regarding `critical_path` labels or mutation test results for the changed files.
observability-on-new-endpointsoperationalskipwarningSOC2-CC7.2, ISO-27001-A.12.4.1This MR introduces database schema changes, not new HTTP/gRPC endpoints.

Audit log (2)

WhenActorActionDetails
2026-05-19 05:11:49 UTCmr-sentinelskip_duplicate{"sha": "35ab181a", "reason": "already_evaluated", "rubric_version": "v2"}
2026-05-19 05:11:48 UTCmr-sentinelevaluate{"score": 3.0, "note_id": 3361770671, "verdict": "block", "tool_calls": 8, "rubric_source": "project_override", "comment_crea