Unified quality workspace
Repository to release confidence
Use Connect & discover to register repository metadata and submit a credential-free file manifest. Droplet never executes the repository during discovery and does not persist manifest contents.
Application topology
Detected web, API, backend, mobile, desktop, container and infrastructure components include confidence and source evidence.
Quality Graph
Repository, commit, source, component, suite, gap, execution, evidence and release objects remain addressable and linked.
Test Architect
Large instructions become a governed, reviewable plan. Without a model gateway, Droplet labels the deterministic fallback and its limitations.
Release Confidence
A score never hides missing evidence: uncertainty is explicit and critical blockers override the number.
Service guide
The independent quality gate
A candidate submits a check bundle. Corpus-backed lanes judge it. Droplet appends a signed verdict. If any effective blocking lane is red, the candidate cannot merge. Evidence collectors never approve their own work.
Candidate
A commit, pull request, tag, or release reference accumulating checks and append-only verdicts.
Check
A named result with passed and critical-finding signals, reported into a candidate bundle.
Lane
A versioned, corpus-backed judge with blocking or advisory authority.
Verdict
A signed, content-addressed decision that admits the candidate or returns MERGE BLOCKED.
Candidate lifecycle
Quickstart
First verdict in three steps
The cockpit supplies tenant scope and an Idempotency-Key for governed mutations. Direct callers also provide a bearer token.
- 1
Open
Submit the exact commit, pull request, tag, or release reference on the Candidates tab.
- 2
Report
Add each build, test, acceptance, and vulnerability result to the check-bundle studio.
- 3
Judge
Run Gate. A 200 admits; a 409 MERGE BLOCKED response contains the signed verdict and exact red lanes.
POST /api/ss/droplet/api/v1/candidates
Authorization: Bearer <token>
X-Tenant-Id: acme
Idempotency-Key: candidate-abc123
Content-Type: application/json
{"ref":"git:checkout-api@abc123"}Quality Governance
Quality law enforced by code
Independent authority
Factories and agents may submit evidence, but they hold zero verdict or override authority.
Blocking by default
Any effective blocking red produces a 409 MERGE BLOCKED decision with exact lane reasons.
Release Approver override ceremony
Only a Release Approver (tier 3 human) can waive a red, with approver, reason, future expiry, audit record, and owner page.
Untested cannot block
A lane without proving fire and must-not-fire corpora cannot receive blocking authority.
Precision self-policing
A lane below 90% precision for 14 days is quarantined and demoted to advisory.
History only appends
Verdicts are immutable. Re-judge adds a new verdict and reports drift; it never edits the old one.
19 core operations
API reference
All product calls are tenant scoped. Mutations require an Idempotency-Key. Operational probes are available at /healthz, /readyz, /metrics, and /version.
| Method | Path | Purpose |
|---|---|---|
| GET | /api/v1/source-providers | List source adapters |
| POST | /api/v1/projects | Connect metadata and discover a manifest |
| GET | /api/v1/projects/{id}/quality-graph | Query traceable quality objects |
| POST | /api/v1/projects/{id}/architect | Prepare a governed quality plan |
| POST | /api/v1/projects/{id}/impact | Select tests for changed files |
| POST | /api/v1/projects/{id}/executions | Queue work on an approved runner |
| POST | /api/v1/projects/{id}/releases/evaluate | Calculate release confidence and uncertainty |
| GET | /api/v1/candidates | List tenant candidates |
| POST | /api/v1/candidates | Open a candidate |
| GET | /api/v1/candidates/{id} | Read candidate and check bundle |
| POST | /api/v1/candidates/{id}/checks | Report a check |
| POST | /api/v1/candidates/{id}/gate | Append a signed verdict |
| GET | /api/v1/candidates/{id}/verdicts | Read immutable verdict history |
| POST | /api/v1/candidates/{id}/rejudge | Re-judge and report drift |
| POST | /api/v1/candidates/{id}/override | Run the Release Approver override ceremony |
| POST | /api/v1/candidates/{id}/bypass | Probe and record a bypass attempt |
| GET | /api/v1/lanes | List the lane catalog |
| POST | /api/v1/lanes | Register a corpus-backed lane |
| POST | /api/v1/lanes/sweep | Quarantine imprecise lanes |
Operator recovery
Troubleshooting
409 no compatible runner
No approved healthy runner belongs to the requested pool. Complete enrollment and authorization; do not fake an execution result.
High release uncertainty
Expected evidence is missing. Supply current results for the discovered application surfaces before shipping.
409 from the gate
The candidate is correctly blocked. Read blocking_reds, fix the evidence, then gate or re-judge again.
403 on override
The caller is not a Release Approver (tier 3 human) or carries an automated factory/agent identity. The independence boundary is working.
422 on override
Supply a non-empty reason and a future RFC3339 expiry.
Lane does not block
It is untested or quarantined. Add both corpora and inspect the latest precision sweep.
Service unavailable
Droplet is a mission-critical Tier 0 service: merges must stop until health and readiness recover.
T0 stop-the-line posture
If Droplet cannot produce a trustworthy verdict, the safe state is no merge. Restore the judge before restoring release flow.