Read diffs and verdicts
Understand what changed, why it matters, and what the model cannot establish.
Read the infrastructure diff
Request a diff at any point to compare the rebuilt branch with its original baseline.
emfirge_branch_diff({ branch_id: "<branch_id>" })
| Fields | What they describe |
|---|---|
| added_nodes / removed_nodes / modified_nodes | Resource changes |
| added_edges / removed_edges | Relationship changes |
| added_findings / removed_findings | Changes in native checks |
| newly_internet_reachable / no_longer_internet_reachable | Modeled reachability changes |
| score_before / score_after / score_delta | Score comparison; higher is safer |
Interpret the verdict
The combined verdict is native-rules-only by default; Checkov, Trivy, and cloudsplaining are disabled unless EMFIRGE_RUN_SCANNERS=1. When enabled, the verdict compares native checks with available scanner results and includes provisioned-cost notes. It is advisory; the backend does not stop an external AWS apply.
| Result | Current decision rule |
|---|---|
| pass | No new findings, new internet reachability, or detected privilege escalation trigger the other states. |
| warn | New findings, new reachability, or introduced privilege escalation need review. |
| block | A new critical/high finding is on a newly reachable resource or indicates privilege escalation; also used for introduced escalating roles that are internet-reachable. |
Read coverage alongside the result
Check scanner_available: false means optional scanner results were not available, not that the scanner found nothing. Read cost_unknown_notes even when a numeric cost delta is present.
The current combined-verdict response does not include a universal confidence field. Confidence tiers on graph findings and roadmap commitments should not be treated as fields guaranteed on every tool response.
A pass is a statement about the checks that ran. Missing scanner coverage, unknown prices, and unmodeled application dependencies still need review.