How Verity turns four scanners into one verdict

Every tool in Verity's engine is excellent alone and incompatible together. Playwright reports test failures. axe-core reports rule violations with DOM selectors. ZAP reports security alerts with risk scores. Semgrep reports pattern matches with severity levels. Four output schemas, four severity vocabularies, four opinions about what matters.

The normalization layer

Verity's core is a findings pipeline: every scanner's raw output is converted into one canonical finding shape — discipline, rule, location, evidence, severity, and a stable fingerprint. The fingerprint is the important part: it's a hash of the rule plus a normalized location, so the same issue reported across two runs is recognized as the same issue, not a new one.

• Functional failures carry a trace and a replayable Playwright script
• Accessibility violations carry the offending selector and the WCAG criterion
• Security alerts carry the request/response pair that triggered them
• Static-analysis hits carry the matched pattern and the diff hunk that introduced them

One verdict, with reasons

The gate policy is a plain-text config in the repo — which disciplines block, which warn, what severity crosses the line. When Verity fails a build it prints exactly which findings breached the policy and what would need to change, because a red X with no explanation just teaches teams to bypass the gate.

Fingerprinting also powers the baseline: adopt Verity on a ten-year-old codebase and the existing 4,000 findings become a frozen baseline instead of a wall of red. Only regressions — new fingerprints — block. Debt is visible, tracked, and paid down deliberately, not all at once as a precondition for using the tool.