FINAL GREEN ≠ SAFE JOURNEY

Production HEALTHY9/9 lifecycle evidenceDISPLAY-ONLY
01 · What failed?

The final state recovers green, so final-state CI can miss the unsafe transition.

02 · What did MergeFuzz learn?

Independent oracle VALID · learned from execution, not declared input.

03 · What happens next?

Release waves, not guesswork.

04 · How much was checked?

Preregistered held-out evidence.

MF-21 tests safety decisions. MF-22 tests search efficiency.

Failure replay

Why ordinary green checks miss the bug

MF-21 · Safety benchmark

False-safe authorization

UNKNOWN is separate from SAFE.

MF-22 · Search efficiency

Fewer experiments without hiding the loss

Lifecycle evidence

All nine DevSecOps stages are represented

Evidence identity

Trace it back to GitLab

Decision boundary

The console cannot promote anything.

Limits

Claims we deliberately do not make