Policy Engine FixChain Gates

Sprint: SPRINT_20260110_012_008_POLICY Last Updated: 10-Jan-2026

Overview

FixChain gates are policy predicates that control release promotion based on verified fix status. They integrate FixChain attestations from the binary-level fix verification system into policy decisions, blocking or warning on releases that contain critical vulnerabilities without verified fixes.

Why This Matters

Configuration

YAML Policy Configuration

# stellaops.yaml
Policy:
  Predicates:
    FixChainGate:
      Enabled: true
      DefaultMinConfidence: 0.85
      DefaultGracePeriodDays: 7
      NotifyOnBlock: true
      NotifyOnWarn: true

policies:
  release-gates:
    name: "Release Gate Policy"
    version: "1.0.0"
    description: "Gates for production release promotion"

    gates:
      # Critical vulnerabilities - strict requirements
      - name: "critical-fix-required"
        predicate: fixChainRequired
        parameters:
          severities: ["critical"]
          minConfidence: 0.95
          allowInconclusive: false
          gracePeriodDays: 3
          requireApprovedGoldenSet: true
        action: block
        message: "Critical vulnerabilities require verified fix with 95%+ confidence"

      # High vulnerabilities - moderate requirements
      - name: "high-fix-recommended"
        predicate: fixChainRequired
        parameters:
          severities: ["high"]
          minConfidence: 0.80
          allowInconclusive: true
          gracePeriodDays: 14
          requireApprovedGoldenSet: true
        action: warn
        message: "High vulnerabilities should have verified fix"

      # Exception for specific components
      - name: "vendor-component-exception"
        predicate: componentException
        parameters:
          components:
            - "pkg:deb/debian/vendor-lib@*"
          reason: "Vendor provides attestation separately"
        action: allow

    fallback: block
    auditLog: true

Parameter Reference

Gate Outcomes

K4 Lattice Integration

                    +-----------------+
                    | ReleaseBlocked  |
                    +--------+--------+
                             |
        +--------------------+--------------------+
        |                                          |
        v                                          v
+---------------+                        +---------------+
| FixRequired   |                        | ManualReview  |
| (Critical+    |                        | Required      |
|  Unverified)  |                        |               |
+-------+-------+                        +-------+-------+
        |                                          |
        +--------------------+--------------------+
                             |
                             v
                    +-----------------+
                    | ReleaseAllowed  |
                    +-----------------+

Lattice Rules:
  Critical AND NoFixChain       -> ReleaseBlocked
  Critical AND FixChain(>=0.95) -> ReleaseAllowed
  Critical AND Inconclusive     -> ManualReviewRequired
  High AND NoFixChain           -> ManualReviewRequired
  High AND FixChain(>=0.80)     -> ReleaseAllowed

Usage

Programmatic Evaluation

// Inject the predicate
var predicate = services.GetRequiredService<IFixChainGatePredicate>();

// Create context for a finding
var context = new FixChainGateContext
{
    CveId = "CVE-2024-12345",
    ComponentPurl = "pkg:npm/lodash@4.17.20",
    Severity = "critical",
    CvssScore = 9.8m,
    BinarySha256 = binaryDigest,
    CvePublishedAt = DateTimeOffset.Parse("2024-01-15")
};

// Configure parameters
var parameters = new FixChainGateParameters
{
    Severities = ImmutableArray.Create("critical", "high"),
    MinConfidence = 0.90m,
    AllowInconclusive = false,
    GracePeriodDays = 7,
    RequireApprovedGoldenSet = true
};

// Evaluate
var result = await predicate.EvaluateAsync(context, parameters, ct);

if (!result.Passed)
{
    Console.WriteLine($"Gate blocked: {result.Reason}");
    foreach (var rec in result.Recommendations)
    {
        Console.WriteLine($"  - {rec}");
    }
    foreach (var cmd in result.CliCommands)
    {
        Console.WriteLine($"  $ {cmd}");
    }
}

Batch Evaluation

var batchService = services.GetRequiredService<IFixChainGateBatchService>();

var contexts = findings.Select(f => new FixChainGateContext
{
    CveId = f.CveId,
    ComponentPurl = f.ComponentPurl,
    Severity = f.Severity,
    CvssScore = f.CvssScore
}).ToList();

var batchResult = await batchService.EvaluateBatchAsync(contexts, parameters, ct);

if (!batchResult.AllPassed)
{
    Console.WriteLine($"Blocking issues: {batchResult.BlockingResults.Length}");
    Console.WriteLine($"Warnings: {batchResult.WarningResults.Length}");
}

Policy Gate Registry Integration

// In Startup/Program.cs
services.AddFixChainGate(configuration);

// Register with policy gate registry
var registry = services.BuildServiceProvider()
    .GetRequiredService<IPolicyGateRegistry>();
registry.RegisterFixChainGate();

CLI Usage

Check Gates for an Artifact

stella policy check-gates \
  --artifact sha256:abc123... \
  --policy release-gates \
  --format table

Output:

Release Gate Evaluation: sha256:abc123...
Policy: release-gates

+----------------------------+---------+----------------------------------------+
| Gate                       | Status  | Reason                                 |
+----------------------------+---------+----------------------------------------+
| critical-fix-required      | PASS    | No critical vulnerabilities            |
| high-fix-recommended       | WARN    | 2 findings without verified fix        |
| vendor-component-exception | PASS    | Exception applied                      |
+----------------------------+---------+----------------------------------------+

Warnings (2):
  - CVE-2024-1234 on pkg:npm/lodash@4.17.20: No FixChain attestation
  - CVE-2024-5678 on pkg:npm/axios@0.21.0: Inconclusive verdict

Recommendations:
  - stella scanner golden init --cve CVE-2024-1234 --component lodash
  - stella scanner golden init --cve CVE-2024-5678 --component axios

Overall: ALLOWED (with warnings)

JSON Output

stella policy check-gates \
  --artifact sha256:abc123... \
  --policy release-gates \
  --format json

Metrics

The gate exposes OpenTelemetry metrics:

Troubleshooting

Gate Blocking Unexpectedly

1. Check severity configuration: Ensure the severity matches configured severities

   stella policy show --policy release-gates
   

2. Verify attestation exists: Check if attestation is present

   stella attestor query --cve CVE-2024-XXXX --predicate fixchain
   

3. Check confidence level: Verify confidence meets threshold

   stella scanner golden show --cve CVE-2024-XXXX --verbose
   

4. Review golden set status: Check if golden set is approved

   stella scanner golden status --cve CVE-2024-XXXX
   

Grace Period Issues

• Grace period starts from CVE publication date in the advisory
• If publication date is unknown, grace period doesn’t apply
• Use --grace-period-override for manual override

Inconclusive Verdicts

Inconclusive verdicts typically occur when:

• Binary is stripped and symbols unavailable
• Golden set incomplete or too generic
• Compiler optimizations changed code structure

Resolution:

1. Obtain debug symbols
2. Enhance golden set with more specific targets
3. Consider policy exception with justification

Related Documentation

• FixChain Attestation Predicate
• Golden Set Schema
• Risk Engine FixChain Integration
• Policy Engine Architecture