Verdict-mix donut

The verdict-mix donut sits in the top row of the org overview (/admin/ui/orgs/<slug>), next to the 7-day stacked trend. It’s a single 120 × 120 SVG ring plus a three-row legend, and it answers one question at a glance: of every install decision Upwarden made for this org in the last 7 days, how were they split between SAFE, BLOCKED, and QUARANTINED?

What you see

Three coloured arcs around the ring:

• SAFE — green (var(--accent)). The install was permitted to the package manager.
• BLOCKED — red (var(--danger)). The install was 403’d; the build failed.
• QUARANTINED — yellow (var(--warn)). The verdict is pending a scanner result; the install is held.

The legend underneath repeats each label with its percentage of the 7-day total. Percentages render with <0.1% for any non-zero slice below 0.1% — a tiny BLOCKED slice still surfaces in the legend rather than rounding to 0%.

If the org has zero decisions in the 7-day window, the ring renders as a flat grey track and every legend row shows 0%. That’s the shape an empty tenant takes on day one and isn’t an error.

When it appears

Always. The donut is part of the fixed overview reading order — KPIs first, trend + donut next. It renders on every tier; there is no upgrade gate.

What to do based on what you see

• SAFE dominant (>95%) — the steady state. Most orgs run here once their dependencies are settled. Nothing to act on.
• BLOCKED slice growing — pivot to the audit log filtered to decision=BLOCKED and read the recent rows. If the block-source mix bar below shows mostly osv / ghsa, the blocks are real advisories landing in the feed; if it shows mostly fingerprint or size-jump, the pre-scan layer is doing its job on a build-tool transitive.
• QUARANTINED slice present at all — the verdicts-and-the-scanner model explains it; the live verdict is waiting on a scanner callback. A persistent yellow slice means a scanner backlog or a BYOS endpoint that isn’t acknowledging. Cross-check the troubleshooting page.
• Donut flat / all-zero on a tenant you know is active — your CI isn’t hitting the proxy. Check the registry URL in your install commands; the Quickstart covers the one-line CI snippet.

The donut is a leading indicator: it telegraphs a shift in posture before the audit log feels noisy.