When is a clean result not enough to call a release complete?
Coverage describes evidence delivery
Coverage records the analyzers configured for a run, their outcomes, and the evidence domains that were actually delivered. Zero findings from completed required analysis differs from required analysis that never ran.
Read analyzer outcomes precisely
completed: the analyzer ran; in managed CI it must also be observed to satisfy a requirement.not_applicable: the analyzer ran its applicability check and the target does not need that analysis.skipped: the analyzer did not run; the reason determines whether policy accepts it.failed: the analyzer attempted to run but did not deliver trustworthy coverage.
Why missing SCA produces INCOMPLETE
SCA is one of the security inputs. In the example release, policy requires SCA, but no required dependency evidence was delivered. The amber coverage path therefore reaches INCOMPLETE. It does not create a synthetic finding and does not change SEC-001.
What do I do with this?
Use the Coverage reference for exact engine states and reasons, then the Analyzer Registry to identify the evidence source. Require coverage explains --fail-on-coverage-gap and --require-analyzers; exact flags remain in the scan reference.