Plain-language guide to Droplet terminology

Designated human authority permitted to authorize overrides or releases.

A senior human reviewer with explicit governance authority to approve releases or grant time-bound policy overrides that waive blocking quality checks. Automated identities (such as CI runners, factories, and agents) can never hold this role or grant overrides, preserving human accountability.

Sixteen non-negotiable architectural and operational release criteria enforced by code.

The set of 16 codified, automated governance rules enforced by Droplet Sentinel. These cover structural independence (evidence collectors cannot approve their own work), tested lane requirements, precision floors, immutable signed verdict trails, and guarded override ceremonies.

Honest badges indicating whether data is live from the API or a simulated preview.

A provenance badge displayed on every cockpit panel showing whether the displayed information is verified live data from the Droplet API service or sample preview data for pending integrations. The UI never presents simulated or fixture data as if it were live.

Audited procedure for temporarily waiving a blocking check.

The guarded mechanism by which a Release Approver temporarily lifts a blocking check that prevented a candidate from merging. Every override requires an explicit business justification, a future expiry timestamp, triggers an immediate notification to the on-call release lead, and records an immutable audit entry.

A code artifact submitted to the gate for judgment.

A specific commit hash, pull request number, tag, or release reference submitted to Droplet Sentinel. As automated checks (builds, unit tests, linters, security scans) execute, their results are assembled into a tenant-scoped candidate record awaiting evaluation.

A signed, immutable, content-addressed merge decision.

A cryptographic decision document issued by Droplet Sentinel that either admits the candidate or returns MERGE BLOCKED with exact red lane reasons. Verdicts cite the precise lane versions evaluated, are content-addressed by their SHA-256 hash, and are never edited after issuance.

A versioned, corpus-backed policy rule with blocking or advisory authority.

A quality judge that evaluates candidate check bundles against specific release criteria. Lanes can have Blocking severity (failing checks block merge) or Advisory severity (failing checks warn without blocking).

Lanes must prove their accuracy with test corpora before gaining blocking authority.

A core safety rule ensuring that no policy rule can block developer workflow without proving its validity. A lane declared blocking must provide both a 'must-fire' corpus (known failures it must catch) and a 'must-not-fire' corpus (clean cases where it must remain silent). Untested lanes fail open as advisory.

Noisy or flaky rules are automatically demoted to protect release flow.

A self-policing mechanism that tracks false-fire rates (blocking findings that human approvers frequently override). If a blocking lane's precision drops below 90% over a 14-day sustained window, it is automatically demoted to advisory status until repaired and re-registered with fresh corpora.

Past decisions are never modified; re-evaluation records drift.

The invariant that historical verdicts cannot be modified or deleted. When code changes or policies update, re-judging a candidate appends a fresh verdict to the ledger and calculates decision drift, enabling comprehensive audit time travel.

Evidence collectors cannot approve their own work.

A structural separation-of-duties guarantee enforced in code. Automated agents, build runners, and factory identities are permitted to submit test evidence, but they possess zero verdict or override authority. The judge is strictly independent of the artifact being evaluated.

Mapping application topology and endpoints directly from source code without running it.

A core architectural invariant of Droplet. Code repositories are analyzed statically through AST parsing and manifest inspection without building, running, or executing customer code inside the control plane. Customer code is never executed and raw repository contents are never persisted.

A semantic map of application routes, endpoints, entities, and workflows.

A structured representation of an application's topology discovered directly from source code without executing it. The graph maps routes, API endpoints, data models, authentication roles, and business workflows to calculate coverage gaps and targeted test plans.

Tenant-scoped, confidential verification export for compliance.

A downloadable JSON bundle containing candidate check postures, verdict content hashes, and override records. Verdict private signing keys and master secrets are strictly redacted to maintain tenant security.

Calibrated release readiness measurement derived from real evidence.

A dual-metric release recommendation. The confidence score reflects verified green checks against discovered application surfaces, while the uncertainty score increases whenever expected evidence is absent or stale. Missing data never implies safety.

Operational reliability and SLO classifications.

System tiers defining uptime commitments and operational postures. Tier 0 represents mission-critical infrastructure (such as Droplet Sentinel with 99.99% availability requirement where failure blocks all merges). Tier 3 represents human governance roles.

Security monitor detecting unauthorized merges around the gate.

An active monitoring capability that verifies downstream source control branch protection. If a merge occurs without a valid, signed verdict from Droplet Sentinel, a high-severity security incident event is immediately logged and dispatched to security operations.