reversible-by-default-confirm-consequentiallisted

# Reversible by Default, Durable Human Approval for Consequential Acts Build the system so it cannot harm anything it does not own: read-only and reversible on every external system by default, with each consequential or outward-facing action paused for an authorized human's approval. The pause must be durable — persisted before you wait — so a stopped run survives restarts. ## When to use Apply whenever an agent or automation can reach a system you do not fully control: ticketing, wikis, repos, email, payment APIs, production data, customer-facing surfaces. Apply the moment a workflow's output could become public, mutate shared state, or be hard to undo. Red-flag thoughts that mean STOP and apply this skill: - "It's just a small write, I'll add a flag to disable it later." - "The model's draft looks good enough to publish automatically." - "I'll hold the approval step in memory — the run won't last long enough to restart." - "We say it's read-only; we don't need a test proving it." - "Let the agent post it and we'll review afterward if something looks off." - "It's just a tag push / a merge — the automation it triggers is a separate concern." ## The rule 1. **Make read-only an architectural invariant, not a flag.** Confine the only write side-effect to your own artifact store (your DB, your bucket, your output dir). External adapters expose read operations only; there is no code path that mutates an external system, so there is nothing to "turn off." 2. **Pin the inva