Winch Labs

Reviews

Disagreeing with a finding

Garboard will be wrong sometimes. A tool that has no cheap way to say so gets muted wholesale, and then it is not a control. There are three separate mechanisms, and picking the right one matters because they persist differently.

Which one you want

You think… Use Scope
“This finding is wrong here.” Dismiss the finding, with a reason This one finding
“This rule is wrong for us.” Mute the rule for your organisation Every repo, every future PR
“That is not our convention.” Edit or delete the derived convention Everything derived from it

Dismiss a finding

Dismiss one finding, with a reason. The reason is required, and it is not bureaucracy: it feeds convention decay, so a convention whose findings keep getting dismissed loses confidence rather than nagging forever.

Dismissal is audited as finding.dismiss, recording the actor, the rule id and the repo#pr. A dismissal silences a rule for good on that finding, so it goes on the record like every other decision in this family.

Mute a rule for your organisation

Muting drops every finding from that rule id, across every repository in your organisation, on every future pull request.

Two things worth knowing:

  • Mutes are keyed by rule id, so a custom rule’s custom.<id> mutes exactly like a built-in. There is no separate mechanism for your own rules.
  • Muting is human-decided and audited. The gate never auto-weakens itself. No amount of dismissing causes a rule to mute itself; that decision is always someone’s, on the record.

A muted finding is still recorded — it is suppressed from the comment, not erased. Your evidence bundle contains what was found and hidden, with who hid it and when. Silence towards the author is not silence towards the auditor.

Edit or delete a derived convention

Conventions are derived from your code, and derivation can be wrong — a pattern that held for eleven of twelve resources may be an accident rather than a standard.

Editing or deleting a convention changes what future reviews check. It survives re-scans: a deleted convention is not silently re-derived on the next scan, or the delete would mean nothing.

Break-glass is not this

Break-glass exists and is the wrong tool here. It is admin-only, time-boxed, requires a written reason, and only works on a review that has blocking findings. It files a debt item and expires on a clock.

That is deliberately heavy, because it is for “we are shipping past a real blocking finding right now and accepting the consequence”. Reaching for it to handle a rule you simply disagree with makes routine disagreement look like a governance emergency — and worse, it teaches people that the emergency mechanism is the normal one, which is exactly how an emergency mechanism stops working.

If the rule is wrong for you, mute it. That is the cheap, correct, permanent answer, and it is one click.

Catalog rules are different again

An adopted catalog rule can be muted like any other, but it can also be un-adopted — removed from your rule set entirely — or moved into shadow, where it evaluates and records but never comments and never blocks. Shadow is the right first move for a rule you are unsure about: you get a fortnight of evidence about how noisy it would be, at no cost to anyone reading pull requests.