Audit lifecycle

Admission and queueing

Audit creation requires workspace access, an authorized source, and an idempotency key. Each source may have at most one active or queued audit. Different sources can be queued together, and each workspace runs one audit at a time in submission order. A duplicate request returns a typed conflict that identifies the existing audit.

After onboarding, open Audit runs and choose Start an audit to select a repository, branch, and profile. Run all queues every enabled, non-archived repository on its default branch in one action. Repositories with an active or queued audit are skipped. The queue continues after you leave the page.

The scheduler uses global scanner capacity and runner health to expose queue position. Queue state is persisted; it is not inferred from a browser connection.

Stage contract

Live events

Authenticated SSE emits monotonic events for queue position, stage transitions, scanner status, reviewed artifacts, warnings, retries, and terminal state. Clients reconnect with the last received event identifier and deduplicate by event ID.

queue.updated
audit.stage.started
scanner.log
agent.artifact.completed
usage.updated
audit.coverage_gap.created
audit.completed

Cancellation and retry

Cancellation stops new activities, requests cooperative termination of active work, and preserves evidence already committed. Retry creates or resumes only an allowed failed boundary; it does not silently overwrite the prior attempt or duplicate work.