emfirge_branch_verdict
Evaluate an isolated infrastructure branch across the documented consequence lenses, including security findings and proposed changes.
Parameters
branch_id: string · required
{ "branch_id": "branch_456" }
Returns
The response is JSON shaped for the operation. The fields and semantics are described below.
{
"verdict": "warn", "native_added": [], "native_removed": [], "scanner_added": [], "scanner_removed": [],
"score_before": 72, "score_after": 70, "score_delta": -2, "newly_internet_reachable": [], "no_longer_internet_reachable": [],
"scanner_available": false, "scanner_status": { "checkov": "disabled", "trivy": "disabled", "cloudsplaining": "disabled" },
"coverage_warnings": ["borrowed scanners are disabled on this verdict (native rules only) — this verdict is NOT full coverage"],
"cost_delta_monthly_usd": 12.5, "cost_unknown_notes": [], "introduces_privilege_escalation": false,
"limits_introduced": [], "limits_resolved": [], "summary": "verdict=warn; ..."
}
Validation, behavior, and limits
verdict is block, warn, or pass. The response reports native_added, native_removed, scanner_added, scanner_removed, score_before, score_after, score_delta, newly_internet_reachable, no_longer_internet_reachable, cost_delta_monthly_usd, cost_unknown_notes, introduces_privilege_escalation, limits_introduced, limits_resolved, and summary.
scanner_status gives each borrowed scanner’s outcome, scanner_available says whether any scanner ran, and coverage_warnings explains missing or disabled lenses. Non-empty warnings mean degraded coverage and the result must not be presented as complete coverage or a safety guarantee.
block flags a modeled blocking risk; warn flags a modeled concern; pass means no modeled blocking or warning condition was found by the available analysis. None guarantees safe deployment or application behavior.