Problem
deploy-validate.yml (observed at v0.12.1) exits 1 when any SC-11 readiness-scorecard check evaluates to not_applicable. Per the SC-11 contract, not_applicable is a valid terminal state for route_owner_authmode_declared, stateful_policy_declared, and raw_manifests_guarded and must not fail the gate.
Additionally, no_raw_secrets and npm_signatures_verified evaluated to fail on every fresh service adoption (observed identically on the auth-api, agents-api, and agent-runtime onboardings — consistent across stacks, so likely evaluation logic rather than genuine findings).
Impact
Deploy-preview/validate is informational (Pipeline Complete remains the merge gate), so onboarding was not blocked — but the scorecard is red on every new service, which trains operators to ignore it.
Fix
- Treat
not_applicable as passing for the three checks that define it.
- Investigate why
no_raw_secrets and npm_signatures_verified fail on all new adoptions: evaluation bug vs a real precondition every service is missing. If the latter, the failure message must name the concrete missing item.
Acceptance
A fresh service adoption using the repo-template platform-deploy templates produces a green scorecard when routes/stateful/raw-manifests genuinely do not apply, and any remaining red check names a concrete missing item.
Problem
deploy-validate.yml(observed at v0.12.1) exits 1 when any SC-11 readiness-scorecard check evaluates tonot_applicable. Per the SC-11 contract,not_applicableis a valid terminal state forroute_owner_authmode_declared,stateful_policy_declared, andraw_manifests_guardedand must not fail the gate.Additionally,
no_raw_secretsandnpm_signatures_verifiedevaluated to fail on every fresh service adoption (observed identically on the auth-api, agents-api, and agent-runtime onboardings — consistent across stacks, so likely evaluation logic rather than genuine findings).Impact
Deploy-preview/validate is informational (Pipeline Complete remains the merge gate), so onboarding was not blocked — but the scorecard is red on every new service, which trains operators to ignore it.
Fix
not_applicableas passing for the three checks that define it.no_raw_secretsandnpm_signatures_verifiedfail on all new adoptions: evaluation bug vs a real precondition every service is missing. If the latter, the failure message must name the concrete missing item.Acceptance
A fresh service adoption using the repo-template platform-deploy templates produces a green scorecard when routes/stateful/raw-manifests genuinely do not apply, and any remaining red check names a concrete missing item.