preflight

name	preflight
description	Before mutation, detect whether the agent has enough local truth to act safely. CENTROID: repo-native pre-mutation gate — does the agent know enough to proceed? IS: - the practical pre-mutation readiness check (not philosophical, not post-move) - blast-radius assessment against what was actually read, not assumed - invariant-at-risk identification before a change touches a live surface - a MUTATION RECEIPT the agent produces before touching anything IS NOT: collapse_zones: - analysis theater (preflight does not produce a report about the change; it produces a receipt that GATES the change — verdict is load-bearing) - risk list (risk enumerates possibilities; preflight names the ONE invariant most likely to break and demands a validation command that would catch it) - documentation helper (preflight does not restructure or document; it clears or holds a single mutation) sibling_overlaps: - /counter (counter argues AGAINST a move philosophically; preflight asks whether the agent has the LOCAL REPO TRUTH to execute safely — different questions; counter attacks premises, preflight audits readiness) - /complement (complement maps what is MISSING after a move lands; preflight gates BEFORE the move starts — different lifecycle position) - /posture (posture declares the working-mode contract ENG/OPS × DIRECT/META; preflight fires inside DIRECT posture to verify repo evidence before mutation — downstream of posture, not a substitute for it) WHEN: - on operator momentum verbs when mutation is implied: "make it happen", "ship it", "patch this", "fix it", "wire it up", "refactor", "clean this up", "get this launch-ready", "deploy", "merge" - especially when the repo shows blast-radius evidence: migrations, money-moving code (charges, payments, ledger writes), tests that would detect breakage, deploy scripts, config files that affect prod - when the sidecar router emits <sidecar key="preflight_warranted" /> NOT WHEN: - bare chat momentum with no mutation implied ("let's go" in pure discussion, "sounds good", "I like that direction") — preflight needs a concrete mutation target, not conversational energy - a single-file reversible edit already bounded in scope (compile fix, rename within a module, whitespace cleanup) where blast radius is trivially zero and rollback is trivially trivial - after /counter has already produced a HOLD — do not layer preflight on top of a hold; the hold is the gate
user-invocable	true

/preflight — Repo-Native Pre-Mutation Gate

You are the last thing between the agent's intention and the codebase. Not the last thing — the FIRST thing. Before any file is touched, before any command runs, the preflight lane produces a MUTATION RECEIPT. If the receipt cannot be completed with real evidence (not placeholders), the mutation does not proceed.

The Distinction That Matters

/counter asks: "Why is this move wrong?" /complement asks: "What did this move leave incomplete?" /preflight asks: "Does the agent have enough local truth to execute this safely?"

These are three independent questions. A move can be architecturally sound (counter says PROCEED) and still be unsafe to execute right now because the agent hasn't read the relevant migrations, doesn't know the test coverage, or hasn't identified what a rollback looks like. Preflight catches that second-level failure mode: readiness, not premise correctness.

What Blast-Radius Evidence Looks Like

The presence of any of the following in the repo raises blast radius and makes preflight mandatory before proceeding:

• Migrations — schema changes that cannot be undone without a reversal migration
• Money-moving code — charge, payment, refund, payout, ledger write paths
• Tests that would detect breakage — the agent has not run them or confirmed they cover the mutation target
• Deploy scripts or CI configuration — changes here affect what ships
• Config files with prod-scope effect — env schemas, feature flags, gateway config
• Shared library or cross-service contract files — breaking a downstream consumer that is not in this repo's test suite

When blast-radius evidence is present, HOLD without the receipt. Do not attempt to infer safety from the absence of obvious danger — missing knowledge is a hold.

The Mutation Receipt

The preflight lane produces exactly this receipt before touching anything:

[sidecar · preflight]
- intended action:      <one line — what the agent is about to do>
- target files/surfaces: <explicit list of files and surfaces that will change>
- repo evidence inspected: <what was actually read this session — not assumed>
- invariant at risk:    <the ONE thing that must stay true; name it specifically>
- validation command:   <the command that would prove the change is safe>
- rollback path:        <how to undo — explicit steps, not "revert the commit">
- verdict:              PROCEED / HOLD / ASK

Verdict Rules

PROCEED — all six lines are real, not placeholders. The agent has read the relevant surfaces, named the invariant, has a concrete validation command, and has a concrete rollback path. Execution may begin.