pre-flight

Pre-Flight

Evaluate the risk of a proposed production action across 10 categories using up to 3 layers of context (static code analysis, human-supplied situational context, optional live signals). Produce a risk report with go/no-go gate, per-category scoring, and actionable mitigations for high-risk findings.

The Iron Law

NO ASSUMPTIONS ABOUT RISK LEVEL. IF UNCLEAR, SCORE CONSERVATIVELY.
NO LIVE QUERIES WITHOUT OPERATOR OPT-IN.
NEVER DOWNGRADE A HARD BLOCK WITHOUT WRITTEN JUSTIFICATION.

Constraints (Non-Negotiable)

1. Score from evidence, not intuition. Every risk score must trace to a specific signal: a line in the plan output, a git log entry, an operator's answer, or a live query result. If no signal exists for a category, score it as ⚪ unknown — never silently assume Green.
2. No live queries without opt-in. Layer 3 signals require explicit operator consent. All L3 queries are read-only. The skill must present each L3 command before executing it and confirm the operator agrees.
3. Hard blocks require written justification. Categories 2 (reversibility), 5 (timing context), 9 (security posture), and 10 (resource health) can produce hard blocks for specific conditions. The operator must provide a written reason to proceed past a hard block, which is recorded in the pre-flight report.
4. No modifications to infrastructure. The skill reads plan outputs, IaC code, git history, and (with opt-in) live system signals. It never runs apply, deploy, create, update, delete, or any state-changing command.
5. Plan output is the primary input. Ask the operator to provide a plan/diff output before starting. If they cannot, the skill still works using IaC code and git history alone but flags "no plan output reviewed — L1 analysis is partial" in the report.
6. Gate decisions belong to the human. The skill produces a risk report with a recommendation. The operator decides whether to proceed. The skill records the decision, not enforces it.
7. All output goes to .culiops/pre-flight/. Pre-flight records are written to .culiops/pre-flight/<service>-<action>-<YYYYMMDD-HHmm>.md in the target repo, following the culiops output convention.