Launch gate
When the GitHub App is installed, Invince posts a check run on pull requests: Ready / Fix first / Do not launch. GitLab and Bitbucket connections do not post merge-request checks. Use Before you deploy on the last completed scan instead.
Before you deploy
The Before you deploy page applies the same rules to the last completed scan, without waiting for a pull request. It is not a preview of uncommitted files.
What can say Fix first
- Open security findings with file evidence
- Documentation drift (facts the docs were generated from moved)
- Secrets found in the checkout (see CI secret gate)
- The stored project live URL, if you authorized live checks, returning 5xx or not answering
- Same-origin homepage CSS/JS on that live URL returning 404 or 5xx. Invince does not guess hashed preview filenames from the PR diff
- A GitHub Deployments environment_url for this SHA, if GitHub has one, returning 5xx. Not a guessed Vercel hostname
- An owner-run k6 summary with zero HTTP requests (inconclusive). Invince did not fire those VUs
- An owner-run eval set that failed expected vs actual. Invince did not call a model
What can say Do not launch
- Open critical findings
- An owner-run k6 summary that failed thresholds or recorded HTTP failures. Missing load is not this.
Require the Invince launch-gate check in GitHub branch protection. Without that, merge is not blocked.
An unfinished scan stays in progress, not a completed neutral check.
A passing gate means the checks we ran did not fail. It is not a penetration test.
See Launch QA for the evidence board that includes CLI uploads and owner-run k6 summaries.