01
The four verdicts
- regressed — at least one new open finding the baseline didn't have OR overall_risk dropped past the threshold. Investigate before merging.
- improved — at least one baseline finding is now remediated AND no regressions. Celebrate.
- stable — finding set unchanged, scores within tolerance. The PR didn't move the security posture.
02
Score deltas vs. finding deltas
- Finding deltas (new / resolved / persistent) drive the verdict's binary fail/pass logic.
- Score deltas (overall_risk, detection, exposure, readiness) carry direction (better / worse / neutral) and magnitude — useful for trend reporting even when no findings changed.
- A scenarios array trim (e.g. diff-selected just LLM01) marks dropped findings as 'carried forward' instead of 'resolved' — so an old finding that wasn't re-tested doesn't fake an improvement.