/exception

description: "Signed gate-exception registry — replace ad-hoc --admin / --no-verify bypasses with an auditable, signed, expiring record (who · why · gate · scope · expiry). Create / list / check exceptions."
argument-hint: "create --gate <g> --reason \"<why>\" [--scope S] [--days N] [--risk low|medium|high] | list | check <gate>"
user-invocable: true
allowed-tools: Read, Bash
model: haiku

<!-- great_cto-managed -->

You are the great_cto `/exception` command — the **signed gate-exception registry** (NaCl-inspired governance). When a gate must be bypassed (merge over a red CI that's down for reasons unrelated to the code, ship with a known-tracked BLOCKED task, skip a check in an emergency), you do **not** reach for a silent `--admin` / `--no-verify`. You create a **signed exception**: a tamper-evident, expiring record of who allowed the bypass, why, for which gate, and for how long. Gates check this registry — a bypass is only sanctioned if a valid active exception covers it.

Store: `.great_cto/exceptions/EXC-*.json` (project-local, signed with sha256).

Step 1 — Parse the sub-command

SUB="${ARGUMENTS%% *}"

• `create` → mint a new signed exception.
• `list` → show all exceptions (✓ valid / ✗ invalid+reason).
• `check` → is a gate covered right now? (exit 0 = covered, 1 = not).

Create a signed exception

Only create one when a bypass is genuinely justified, and keep the expiry **short** (default 30 days — prefer 7–14 for CI/infra issues). State the real reason and the evidence.

node scripts/lib/exceptions.mjs create \
  --gate "gate:ship" \
  --reason "GitHub Actions billing-locked; CI cannot run; verified locally (191/191)" \
  --scope "great_cto repo · PR merge" \
  --days 14 --risk medium

`--gate` accepts a specific gate (`gate:ship`, `gate:qa`, `ci`, `pre-push`, …) or `*` for a blanket emergency exception (use sparingly). The signature covers gate/scope/reason/expiry — editing any of them afterwards invalidates it.

List / audit

node scripts/lib/exceptions.mjs list      # ✓/✗ per exception with expiry + invalid reasons

Review this in `/inbox` and before any release — expired or revoked exceptions should be remediated, not silently relied on.

Check coverage (used by gates)

node scripts/lib/exceptions.mjs check gate:ship   # exit 0 (prints covering id) or 1

Strict-mode gates call this: if a gate would block but a valid signed exception covers it, the bypass is sanctioned **and logged** — otherwise the gate holds.

Revoking

To revoke before expiry, set `"status": "revoked"` in the JSON file (the signature stays valid but `verify` then reports it invalid). Never delete the file — keep the audit trail.

Notes

• An exception is a **deliberate, signed, expiring** override — not a way to make red things

green. The work it covers must still be tracked and remediated (see gap-closure waves).

• Prefer fixing the gate over excepting it. Exceptions are for *external* blockers (a

billing-locked CI, a third-party outage), not for shipping broken code.