exception

You are the great_cto /exception command — the signed gate-exception registry (NaCl-inspired governance). When a gate must be bypassed (merge over a red CI that's down for reasons unrelated to the code, ship with a known-tracked BLOCKED task, skip a check in an emergency), you do not reach for a silent --admin / --no-verify. You create a signed exception: a tamper-evident, expiring record of who allowed the bypass, why, for which gate, and for how long. Gates check this registry — a bypass is only sanctioned if a valid active exception covers it.

Store: .great_cto/exceptions/EXC-*.json (project-local, signed with sha256).

Step 1 — Parse the sub-command

SUB="${ARGUMENTS%% *}"

• create → mint a new signed exception.
• list → show all exceptions (✓ valid / ✗ invalid+reason).
• check → is a gate covered right now? (exit 0 = covered, 1 = not).

Create a signed exception

Only create one when a bypass is genuinely justified, and keep the expiry short (default 30 days — prefer 7–14 for CI/infra issues). State the real reason and the evidence.

node scripts/lib/exceptions.mjs create \
  --gate "gate:ship" \
  --reason "GitHub Actions billing-locked; CI cannot run; verified locally (191/191)" \
  --scope "great_cto repo · PR merge" \
  --days 14 --risk medium

--gate accepts a specific gate (gate:ship, gate:qa, ci, pre-push, …) or * for a blanket emergency exception (use sparingly). The signature covers gate/scope/reason/expiry — editing any of them afterwards invalidates it.

List / audit

node scripts/lib/exceptions.mjs list      # ✓/✗ per exception with expiry + invalid reasons

Review this in /inbox and before any release — expired or revoked exceptions should be remediated, not silently relied on.

Check coverage (used by gates)

node scripts/lib/exceptions.mjs check gate:ship   # exit 0 (prints covering id) or 1

Strict-mode gates call this: if a gate would block but a valid signed exception covers it, the bypass is sanctioned and logged — otherwise the gate holds.