Reference
Check results and statuses
Updated
On this page
The titles Zof gives its Zof / Control check on GitHub, and the decisions and statuses in Releases. A state Zof can't read never shows as authorized.
| On the Quality gates tab | Check title on GitHub | GitHub shows |
|---|---|---|
| Ready to ship | RELEASE AUTHORIZED | success |
| Waiting for approval | AWAITING APPROVAL | action required |
| Needs evidence | RELEASE BLOCKED: evidence missing | failure |
| Blocked | RELEASE DENIED | failure |
| Being checked | Evaluating: waiting for system context | in progress |
Check titles on GitHub
The title of the Zof / Control check is Zof's result for the pull request's latest commit.
| Title | GitHub shows | What it means | What to do |
|---|---|---|---|
| "RELEASE AUTHORIZED" | success | Every required check passed on this commit. | Nothing. The pull request can merge. |
| "AWAITING APPROVAL" | action required | The evidence is in, but a required approval is missing. | An approver approves on GitHub. See Approve a change. |
| "RELEASE BLOCKED: evidence missing" | failure | Evidence is missing, not enough or out of date, or Zof couldn't read an input. | Read "Why" and "To unblock" on the check. |
| "RELEASE DENIED" | failure | A required check failed, verification contradicts a required check, or an approver requested changes. A result Zof doesn't recognise also shows as denied. | Read "Why" and "To unblock" on the check. |
| "RELEASE BLOCKED: internal consistency check failed" | failure | Zof's records for this commit disagree, so it refused to show the commit as authorized. | Click Re-evaluate on the check. If it stays, email support@zofai.com. |
Each reason under "Why" is listed in Reason codes. For how to read the whole check, see Find out why a pull request is blocked.
Evaluating states
While Zof waits, the check is in progress and has no result yet.
| Title | What it means | What to do |
|---|---|---|
| "Evaluating: waiting for system context" | Zof hasn't got the System Graph's facts about this commit yet. | Nothing. The check updates once Zof decides. |
| "Evaluating: waiting for verification" | Zof has the facts and waits for Verification's results. The check shows the time it fails if nothing arrives: 30 minutes after it started waiting. A new request for verification restarts the wait, but never past 90 minutes after Zof got the facts. | Nothing, unless the time passes. Then the check shows Zof's result, usually "RELEASE BLOCKED: evidence missing". |
Zof shows "Evaluating: waiting for verification" only when nothing blocks the change except what Verification's results will settle, such as missing evidence or an approval that waits for it. If anything else blocks the change, the check shows its result at once.
Notes on the check
- "Not enforced: developers can merge this PR despite this result" at the top of a check means GitHub doesn't require the check on that branch. Zof's result still stands. See Enforcement statuses.
Zof / Reviewis a different check, added when a code review is posted. It is always neutral and never blocks a merge.
Status in Releases
Releases lists the open pull requests. Each one shows one status word and one line saying what stands in its way, and the pull requests that need a person come first. A repository's Releases link opens the list on that repository alone, shown as a Repository chip; remove the chip to see every repository. The word is Zof's decision, in the same six words Home uses:
| Status | What it means |
|---|---|
| Blocked | The release is denied, Zof allowed it and its check finished without going green, or only a person can clear what holds it, such as unmapped files. |
| Couldn't check | Zof couldn't read the decision, or a required check couldn't test the code (the pull request's page says which), so the pull request can't ship. |
| Needs evidence | A required check has no usable result for the latest commit: it's missing, not enough, out of date or can't be read. |
| Waiting for approval | A person still has to approve the change. |
| Being checked | Zof hasn't decided yet, or it allowed the change and the GitHub check hasn't finished. |
| Ready to ship | Zof authorized the latest commit and its GitHub check is green. |
Home, the Now panel and search count by Zof's decision alone: a check that couldn't run, or a hold only a person can clear, counts as Needs evidence there.
Approve in GitHub shows only on a pull request waiting for approval. Not reported on a row means Zof didn't send a reason or a time. It never means nothing is wrong. A change opened in Zof rather than from a pull request has no status word and reads No release decision. Decision unavailable means Zof couldn't read the decision.
Under the reason, a row shows the System Graph's risk for that change, for example Medium risk · Changes 1 service · reaches 2 services: how critical a service it changes or reaches, by the service's tier. It is a fact about your architecture, not a release decision, and it never changes a pull request's status. Within a status, higher risk comes first. Risk unknown means the graph couldn't rate that change yet, for example because it hasn't analyzed the commit or can't place a changed file in a service; it is never shown as low.
Only the newest open pull requests are rated. A line under the list says so when the ranking doesn't cover them all, for example "Rated the newest 10 of 14 open changes". If the ranking can't be read, that line says so with Retry, and the list still shows.
Once there are more than ten open pull requests, a filter by status shows above the list. Closed and merged, under the list, opens the pull requests closed in the last 30 days. Each one says what happened to it and the last decision Zof made, for example Merged and "Last decision: Blocked". The word is the one the pull request's page gives, so a change held because its tests couldn't run reads "Last decision: Couldn't check" in both places. Closed pull requests never count as open.
Cards and Table, above the list, show the same pull requests as cards or as rows. A card has the same status word, reason, risk and time as its row, and opens the same page. Table is the default. Zof remembers your choice in this browser. The page's link carries the view only once you pick one on this visit (or open a link that already has one), so copy the link after choosing if the person you share it with should see the same view. Closed and merged uses the same view, and the status filter and the Repository chip work in both. With no open pull requests, the switch shows inside Closed and merged once you open it.
The pull request's page has the rest: its risk, its checks and its AI review. AI review findings are advisory and never change the status or the decision.
Decisions in Releases
Open a pull request in Releases to see its page. If the page can't be read, for example for a change opened in Zof rather than from a pull request, it says so and offers Retry and Quality gates. The card at the top shows one word, then the first reason and any others, and when Zof decided. Below that are the risk, Impacts, tests and AI review (advisory); a fact Zof wasn't sent reads Not reported, never 0. Once the pull request is merged or closed, the word is Merged or Closed and the line gives the last decision, such as "Last decision before the merge: Ready to ship."; Fix, Verify and Re-evaluate are off. Impacts comes from the System Graph for the commit Zof decided on: the services it changes, then the services it reaches, up to three and then how many more. It says Unknown when the graph hasn't analyzed that commit, can't be reached, or can't place some changed files in a service, and says No services only when the graph says the commit touches and reaches no service. View impact map, under it, opens that commit's impact on Topology; see Explore the topology workspace.
| Word | Colour | When |
|---|---|---|
| Ready to ship | Green | Zof allowed the latest commit and the Zof / Control check is green. |
| Blocked | Red | Zof denied the release, or allowed it and its check finished without going green. The line after it gives the decision's first reason that blocks, such as "A required check failed: unit tests.". Reasons that never block on their own (advisory_rule_unmet, tags_unknown, all_requirements_satisfied) are skipped. With no blocking reason, it says "Blocked by policy". See Reason codes. |
| Blocked | Amber | Nothing is on its way: files need mapping to a service, a release policy needs publishing, or a requirement can't be verified as written. The line after it says which. |
| Needs evidence | Amber | The release needs evidence, such as a test result, or an input Zof couldn't read, and it hasn't come in yet. |
| Waiting for approval | Amber | The release needs an approval. |
| Being checked | Amber | Zof has no decision for this commit yet ("Not decided yet"), including when its decision was made on an older commit. Also when its check hasn't finished, or the page couldn't confirm an allowed release, say after a failed refresh. |
| Couldn't check | Grey | A required check started or tried to, and couldn't test the code. The line after it says which and why. |
| Couldn't check | Grey | The decision can't be read, it has no verdict, or its verdict is one the page doesn't know (a limit or a canary, say). Its reasons aren't shown. |
On the Quality gates tab, a gate's word is Passed, Approved, Issues found, Needs evidence, Being checked, Waiting for approval or Couldn't check. Its result says what happened.
A remediation plan's Fix pull request panel shows the same word and the same line as its Zof decision.
On the pull request's Gates tab, each gate has the same word as on the Quality gates tab, and Evidence opens its drawer. Open the full gates view, under the list, opens the change's Quality gates tab, and its Readiness tab stays on that view. While something needs a person, the Gates tab has a dot: red when the pull request is blocked, amber while it waits or couldn't be checked. The trail above both, Releases › PR #, leads back to the pull request's page. The banner uses the same word and line as the pull request's page, with the same colours. With Ready to ship, the banner says Release authorized for the commit.
Home puts each open pull request in exactly one group, by Zof's call:
| Group | Calls in it |
|---|---|
| Blocked | Denied, and allowed with a check that finished without going green |
| Couldn't check | Decision unreadable and Unknown — treated as blocked |
| Needs evidence | Needs evidence |
| Waiting for approval | Awaiting approval |
| Being checked | Not decided yet, and allowed with the GitHub check still running |
| Ready to ship | Release authorized |
The status card's tiles, Security posture and the Gate issues list in the side panel all count these same groups, so they always agree. Only Ready to ship is clear: the card never says nothing is waiting while a pull request is still being checked. When Zof has more open pull requests than it counts in one read, the counts are a minimum, for example 500+. If the counts can't be read, Home says so and tries again; it never shows them as 0. Repository enforcement describes whether GitHub blocks merges; it is separate from a change's decision.
go
Decision: Release authorized, shown as Ready to ship, then "Release authorized" followed by "for" and the first 7 characters of the commit.
Zof allowed this commit, and the Zof / Control check on GitHub is green.
Some older decisions don't record a result for each check. For those, the banner, the pull request's page and a fix pull request's panel say "Authorized by policy decision", followed by the time and "without per-check results". The banner and the panel also give the decision's id. While the release can't ship yet (say its check isn't green), they say "Allowed by policy decision" instead. Once that check has finished without going green, the row on the Releases list says Blocked, with "Check failed" as its reason, or "Check failed:" and the check's name when the check has one. None of them ever says the checks passed, and the gates stay Needs evidence, because Zof recorded no result for them. The row on the Releases list says "Authorized without per-check results".
What to do: Nothing. The pull request can merge.
unreadable
Decision: Decision unreadable, shown as Couldn't check
Zof has a decision for this commit, but its stored record couldn't be read. Zof never shows it as authorized.
What to do: Open the Zof / Control check on GitHub to see the result. If it stays, email support@zofai.com.
not_decided
Decision: Not decided yet, shown as Being checked
Zof hasn't decided on the latest commit yet, usually because it is waiting for the System Graph. The check on GitHub says "Evaluating: waiting for system context".
What to do: Wait. The banner changes once Zof decides. If it stays, click Re-evaluate on the check.
denied
Decision: Denied, shown as Blocked
At least one reason denies the change, for example a failed required check or an approver's "Request changes" review. The check says "RELEASE DENIED".
What to do: Fix what the check's "To unblock" list names, then push a new commit. An approver's "Request changes" review lasts until that reviewer approves the commit, the review is dismissed, or a new commit is pushed.
awaiting_approval
Decision: Awaiting approval, shown as Waiting for approval
The evidence is in, but a required approval is missing, or a person has to take over an agent's change. The check says "AWAITING APPROVAL".
What to do: An approver for the change's owner approves the latest commit on GitHub. See Approve a change. If Zof couldn't confirm a reviewer's team membership, the check says "A reviewer's teams are unresolved; retrying." Zof retries about once a minute. See approver_authority_unavailable.
needs_evidence
Decision: Needs evidence
Evidence a rule needs is missing, not enough or out of date, or Zof couldn't read an input it needs. The check says "RELEASE BLOCKED: evidence missing". While Zof waits for Verification, the check may still say "Evaluating: waiting for verification".
What to do: Read the check's "To unblock" list. When the cause is an input Zof couldn't get, Zof decides again when that input arrives. It also tries again by itself for two causes: a policy version mismatch, and Verification not answering. For anything else, the list says "Re-evaluate once the input is available": click Re-evaluate on the check once the input is back. If no policy is live, nothing clears it until an admin publishes one. See Change your release policy.
allowed_check_pending
Decision: Allowed — GitHub check not green yet, shown as Being checked, or Blocked once the check has finished without going green
Zof allowed this commit, but the Zof / Control check on GitHub isn't green yet. It may not be published yet.
What to do: Wait a moment and reload. If it stays, open the check on GitHub. If it says "RELEASE BLOCKED: internal consistency check failed", email support@zofai.com.
unknown
Decision: Unknown — treated as blocked, shown as Couldn't check
The console couldn't read the decision as one of the states above, for example because data is missing or the result is one it doesn't know. Zof fails closed: the pull request can't ship.
What to do: Open the Zof / Control check on GitHub to see the result. If it stays, email support@zofai.com.