Quarantine
What happens to rules that do not pass, and how their fate is decided.
The idea
What passes the tests is published automatically. What does not pass goes to quarantine and a person decides: approve its deployment, delete it or keep it. On the next daily run the pipeline reads that decision and acts: publishes the rule, removes it or leaves it in quarantine. Approving never skips the technical checks: the rule is validated again.
Drawing the diagram…
stateDiagram-v2 [*] --> PENDING: pipeline submits a quarantined file PENDING --> UNDER_REVIEW: reviewer holds it PENDING --> APPROVED_PENDING_VALIDATION: approve UNDER_REVIEW --> APPROVED_PENDING_VALIDATION: approve PENDING --> REJECTED: delete UNDER_REVIEW --> REJECTED: delete APPROVED_PENDING_VALIDATION --> REJECTED: delete APPROVED_PENDING_VALIDATION --> UNDER_REVIEW: hold, takes the approval back APPROVED_PENDING_VALIDATION --> RELEASED: publish.yml after the checks pass again APPROVED_PENDING_VALIDATION --> PENDING: revalidation failed RELEASED --> PENDING: revalidation failed later REJECTED --> [*]
Diagram description
States stored by the private service. A quarantined candidate enters as PENDING. A reviewer can mark it UNDER_REVIEW, approve it (APPROVED_PENDING_VALIDATION) or reject it. Only publish.yml moves an approved rule to RELEASED, after the technical checks passed again; if revalidation fails it goes back to PENDING. REJECTED is final for that content.
Mermaid code
stateDiagram-v2
[*] --> PENDING: pipeline submits a quarantined file
PENDING --> UNDER_REVIEW: reviewer holds it
PENDING --> APPROVED_PENDING_VALIDATION: approve
UNDER_REVIEW --> APPROVED_PENDING_VALIDATION: approve
PENDING --> REJECTED: delete
UNDER_REVIEW --> REJECTED: delete
APPROVED_PENDING_VALIDATION --> REJECTED: delete
APPROVED_PENDING_VALIDATION --> UNDER_REVIEW: hold, takes the approval back
APPROVED_PENDING_VALIDATION --> RELEASED: publish.yml after the checks pass again
APPROVED_PENDING_VALIDATION --> PENDING: revalidation failed
RELEASED --> PENDING: revalidation failed later
REJECTED --> [*]| State | Meaning |
|---|---|
| PENDING | Entered quarantine; waiting for review. |
| UNDER_REVIEW | A person marked it as under review. |
| APPROVED_PENDING_VALIDATION | Approved; publish.yml still has to validate it again. |
| REJECTED | Deleted; that content does not come back. An edited version is a new linked candidate. |
| RELEASED | Published in a release. |
What goes public
Details of quarantined or rejected rules (names, findings, content) travel only to the private service. Public artifacts, the log and the site carry counts only. A file that is not in the manifest appears nowhere public.
CURRENT Persistence and panel: implemented and tested locally; the service is not deployed in production (see Private panel). Until it is, quarantine is computed on every run and there is no human decision to read.