Require an Auditable Bypass for Mutating Preflight¶

Status¶

Accepted: A mutating operation may bypass preflight only through an explicit operator decision with a recorded reason. Structural validation remains mandatory.

Context¶

Recovery can require an operation to proceed while a known readiness check is failing. A silent or unqualified bypass removes the distinction between a verified operation and an accepted exception. It also prevents a later review from establishing which guarantee was absent when the mutation began.

Decision¶

apply, deploy, destroy, import, and rebuild require --preflight-bypass-reason whenever --skip-preflight is selected. The reason must be one printable line and is bounded in length.

The run record identifies the command, scope, decision source, reason, time, and resulting guarantee. A bypass records the preflight guarantee as not established. It does not disable contract parsing, input validation, dependency resolution, or later verification and recovery gates.

Consequences¶

Positive¶

Exceptional recovery remains distinguishable from normal execution.
The absent preflight guarantee and the operator decision are reviewable.
Callers cannot represent a bypass as a passed preflight.

Negative¶

Emergency automation must supply a specific reason.
A recorded exception does not make an unsafe operation safe; the operator remains responsible for the decision.

Alternatives considered¶

Permit --skip-preflight without context: rejected because the resulting run cannot explain why its readiness guarantee was absent.
Prohibit every bypass: rejected because controlled recovery can require a known preflight exception.