Enforcement ladder
Four rungs a repository climbs on recorded evidence. Rolling blocking enforcement to hundreds of repositories in one step is not achievable; leaving everything advisory means nobody can state a guarantee about any of them.
The rungs
| Rung | Blocks on | Evidence to reach it |
|---|---|---|
observe | Nothing. | Nothing — this is where a repository starts. |
warn | Nothing. | 5 reviewed pull requests. |
block-blocker | A BLOCKER finding. | 100% seed BLOCKER recall, zero false positives on the clean corpus, 60% acted-on rate, 20 pull requests. |
block-high | A BLOCKER or a HIGH. | 100% seed recall, zero false positives, 80% acted-on rate, 50 pull requests. |
observe— Findings are produced, commented and recorded. Observe is not 'off'; it is 'measured and not yet enforced'.warn— The check is visible in the merge box rather than buried in a log. Costs nobody a merge, so it asks only that the reviewer is actually running.block-blocker— The first rung that can stop a merge, and the first that needs proof the reviewer both catches real defects and stays quiet on correct code.block-high— Blocking on HIGH means blocking on judgement calls, so the bar for people actually agreeing with the findings is materially higher.
Promotion is evidence-gated self-service
A repository promotes itself when the recorded evidence supports it. It cannot promote on assertion, and it cannot skip a rung — the rung it would skip is where the evidence for the next one is gathered. A refusal names the specific blocker rather than saying no:
$ npx redlinegate init --rung block-blocker enforcement stays at warn — cannot move to block-blocker: seed BLOCKER recall is 80% and 100% is required — a reviewer that misses known defects must not be given a veto
Demotion never needs evidence
The safe direction never needs permission. A repository whose gate is misfiring at 3am must be able to step back without waiting for anyone — and a ladder that made that hard would be switched off entirely rather than stepped down.
Per repository, with a per-market floor
Markets have different regulators and different appetites, so the rung is a repository's own. A market may raise its minimum; it may not push a repository below the rung it has already reached. A repository under its market's floor is reported as out of policy rather than as drift — a different person has to act, so it gets different words.
What the ladder does not govern
The security floor is not on it. Dependency review and the diff secret scan block at every rung, including observe. The ladder decides how strictly a repository's own standards are enforced; it never decides whether the organisation's security minimum applies to it.
Reading it across the estate
The dashboard reports how much of the estate is enforcing rather than watching — the question the ladder exists to answer, and one no per-repository view can show. When the register cannot be read the figure is absent, not zero: zero blocking repositories and an unreadable register look nothing alike to whoever has to act on the number. See Telemetry for where the evidence comes from.