Exit codes

The codes are defined in cmd/exit_codes.go and treated as a contract: changing what one means is a breaking change.

Code	Name	Meaning	Produced by
0	ExitOK	Succeeded. Findings without a gate still exit 0.	Every command
1	ExitFailure	The command failed, or a gate breached	Every command: --fail-on and the superseded gate flags, gha <posture> --fail-on, jail and scan --jail breaches, auth verify failures, upload and gha upload failures, unknown flags and bad flag values
2	ExitUsage	A local argument or configuration error before any work	jail only (bad duration, unwritable artefact path, no credentials). Usage errors in every other command exit 1.
3	ExitIndeterminate	The gate ran but could not decide: the backend state it needs is stale or missing. Not a pass and not a breach.	jail and scan --jail, when no rule breached but at least one could not be evaluated against current scan coverage
70		The language server panicked; a crash note was written	vulnetix lsp

A breach outranks an undecided rule: when one rule breaches and another cannot be evaluated, the exit is 1, not 3.

Messages

Every non-zero exit prints Error: <message> on stderr, except where the command has already printed its verdict: a quality-gate breach from scan, a licence severity breach, and a jail verdict. jail usage errors keep the Error: prefix.

In a pipeline

set +e
vulnetix scan --fail-on high --jail
code=$?
set -e
case "$code" in
  0) echo "passed" ;;
  1) echo "policy breached or the scan failed"; exit 1 ;;
  3) echo "jail could not decide: check that the required scans ran"; exit 1 ;;
  *) echo "unexpected exit $code"; exit "$code" ;;
esac

GitHub Actions: continue-on-error: true on the step, then read steps.<id>.outcome. GitLab CI: allow_failure: { exit_codes: [3] } lets an undecided jail gate warn instead of failing the job.