Why does severity not determine the outcome by itself?
Severity, confidence, and policy have different roles
- Severity estimates the impact if the condition is real.
- Confidence expresses how strongly the available evidence supports the claim.
- Finding policy maps those inputs and evidence signals to
BLOCK,WARN, orINFO. - Release policy combines finding dispositions and coverage into the release decision.
The default confidence gate
With --fail-on HIGH, a finding at or above the threshold blocks only when its confidence band and evidence support the claim. LOW warns; MEDIUM requires an independent signal; HIGH requires an independent or self-evident signal. Evidence remains visible when a finding is held at WARN.
Policy changes are explicit
--enforce-confidence=false restores the legacy severity-only gate. Fendix marks findings that block only because of that relaxation as a policy override. In .fendix.yaml, scan.enforce_confidence can set the repository default; an explicit CLI flag still wins.
What do I do with this?
Follow Configure release policy for a reviewable .fendix.yaml, then use the configuration reference and scan reference for the exact contract.