Findings answer whether delivered evidence identified a security condition. Coverage answers whether the required evidence sources ran and fulfilled policy.
Raw scanner states
Coverage contract v1 records exactly three scanner_status states. An ok entry means the analyzer completed; finding count and evidence records remain separate, so ok does not distinguish zero findings from one or more findings.
Derived lifecycle classes
| Class | Meaning | Engine gap | Satisfies --require-analyzers |
|---|---|---|---|
| ok | The analyzer ran to completion. It may legitimately produce zero findings. | No | Yes |
| not_applicable | The requested input does not need this analyzer, or the relevant files were unchanged. | No | Yes |
| disabled | Configuration intentionally kept the analyzer from running. | No | No |
| unavailable | The analyzer was configured to run but a required dependency was missing. This is an engine coverage gap. | Yes | No |
| unsupported | The target shape is outside the analyzer's supported contract and is recorded as a limitation. | No | No |
| failed | The analyzer started or was required but did not deliver trustworthy completion. This is an engine coverage gap. | Yes | No |
| unknown | A legacy or invalid state/reason pairing cannot be classified safely. | No | No |
Closed reason registry
A skipped state uses a skip reason; a failed state uses a failure reason. Consumers must not infer a class from free-form detail.
| Reason | Raw state | Class | Engine gap |
|---|---|---|---|
| not_applicable | skipped | not_applicable | No |
| diff_unchanged | skipped | not_applicable | No |
| disabled_by_flag | skipped | disabled | No |
| disabled_offline | skipped | disabled | No |
| dependency_missing | skipped | unavailable | Yes |
| unsupported_target | skipped | unsupported | No |
| network_error | failed | failed | Yes |
| timeout | failed | failed | Yes |
| execution_error | failed | failed | Yes |
| malformed_output | failed | failed | Yes |
| truncated_output | failed | failed | Yes |
| input_error | failed | failed | Yes |
| no_endpoints | failed | failed | Yes |
Required coverage
The engine's configured_complete becomes false for the unavailable and failed classes. An explicit --require-analyzers contract is stricter: only ok and not_applicable satisfy a named requirement. Disabled, unsupported, missing, or unrecorded analyzers become required gaps.
Why the release is INCOMPLETE
| Input | Observed fact | Decision effect |
|---|---|---|
| SAST | Available evidence supports a HIGH finding with WARN disposition. | WARN |
| DAST | The required live evidence source completed. | Coverage delivered |
| SCA | Policy requires dependency evidence, but the required analyzer did not deliver it. | INCOMPLETE |
The WARN finding does not make the release INCOMPLETE. Missing required SCA coverage does. Fendix does not turn that gap into a vulnerability finding.
Related documentation
Coverage concept · Analyzer Registry · Require coverage · scan coverage flags