Give a new rule a grace period

Raising the bar across a lot of services is rarely one change. You write the stricter rule, then spend three weeks bringing things up to it. Until now that meant either stopping every deploy in the meantime or leaving the rule out and hoping.

A grace period gives the rule a date. Before it, a failure reports and goes to the owner. After it, the rule stops deploys like any other.

rule "traffic is encrypted" {
  when     resource is "load balancer"
  require  tls is at least "1.3"
  grace    30 days
}

What owners see

Anything inside a grace period shows on the coverage report in its own state — not passing, not stopping — with the date it starts to bite. The weekly summary counts them separately, so you can watch the number go down.