Settings

What's real here: the PR-gate policy is the actual sovra-policy.json the CI gate reads. The tracker profile is saved in this browser only, to prefill Publish. Roles are read live from the enforcement layer.

PR-gate / compliance policy

Your tenant's own gate policy, stored server-side . The CLI's sovra gate reads a local sovra-policy.json; export this one there to use the same rules in CI.

Score floors (0 = no minimum)

Min sovereignty

Min resilience

Min build hygiene

Min license

Min confidence

Max US registry distribution %

Forbidden signals

Flags that fail the gate outright

Jurisdictions forbidden for runtime components

Fail on any new flag vs. the last snapshot, even if existing ones are accepted debt (baseline gate)

… and fail if a dependency newly enters one of these jurisdictions

License policy

Forbidden license classes (reach-aware — build-only copyleft doesn't trip these)

Forbidden SPDX ids (comma-separated)

Fail on any unresolved license-compatibility conflict Fail on unresolved (unknown) licenses — noisy on real trees, opt-in Require a known copyright holder for every notice-required dependency

Tracker integration profile

Saved in this browser's local storage only — never sent to Sovra's server except when you click Publish tickets on a scan. Prefills the Publish panel so you stop retyping it.

Tracker

Repo (owner/repo)

Token

Roles & access read-only

Live from the enforcement layer (governance.ROLES) — not a separate ACL to drift out of sync. Explicit-actor forms elsewhere ask you to pick one of these; the server re-checks it on every call regardless of what the form allowed you to select.

Role	Scope	May invoke