Resolution verification
Understand how Sonar verifies pending scope-resolution items before acceptance or review.
Resolution verification checks pending scope-resolution items against their source scope before Sonar auto-accepts, excludes, or leaves them for human review.
Responsibility
Verification answers one bounded question: does this proposed item fit this existing scope and its instructions? It does not run a network scan, create scope policy, or prove that a target is secure.
Flow
Outcomes
| Verdict | Inventory effect |
|---|---|
| Valid | Auto-accept the item, record the reason and verification time, and materialize it. |
| Invalid | Keep the item pending for human review and record the failed reason. |
| Pre-filter rejected | Auto-exclude a domain or wildcard whose required TLD check fails. |
| API error | Keep the item pending; retry transient failures and stop automatic retries after the configured budget. |
Rate-limit and quota errors remain retryable instead of consuming the normal malformed/error retry budget immediately.
Concurrency and consistency
Verification workers claim bounded batches with FOR UPDATE SKIP LOCKED. The row locks remain held
through the item updates, so multiple worker instances do not process the same item concurrently.
After a batch, Sonar refreshes the parent resolution's pending count and overall review state.
Limits
- Verification evaluates a resolution item against supplied scope context; it does not validate every possible external fact about that asset.
- An invalid verdict is not silently deleted. It remains reviewable unless a deterministic prefilter excludes it.
- A provider error is an execution failure, not a negative scope conclusion.