Break-glass

Sometimes you need to ship past a blocking finding. A gate with no governed escape hatch gets ripped out during the first incident, so there is one — built to be usable at 3am and impossible to use quietly.

What it requires

• Admin or owner. Not every member.
• A written reason. Required, not optional.
• Blocking findings. It refuses on a review that has none. There is nothing to override.

What it does

The check flips to neutral, with attribution — who did it and why. It files a debt item, and it expires on a clock: 72 hours by default, 168 hours (one week) maximum.

What it does not do

It never hides the findings. They stay in the comment, in the record and in the evidence bundle. Break-glass changes the merge status, not the truth. Anyone reading that pull request afterwards sees exactly what was overridden.

Scoped waivers

A waiver can name one rule rather than the whole review. The check then recomputes from the findings that survive — so it stays failed if something else is still blocking.

This is the difference between “we accept this one noisy rule right now” and “turn the gate off for this pull request”, and before it existed only the second was possible. A waiver naming a rule that is not actually blocking the review is refused, with the error naming the rules that are: a waiver for a non-blocking rule would sit in the debt list unresolvable forever, describing a decision nobody made.

You can attach a ticket_url. It is a field rather than a link pasted into the reason, because free text cannot be counted or noticed to be missing — and “how much of our debt has no ticket behind it” is the question that says whether the trail is real.

Expiry reminders

A waiver within 24 hours of lapsing, still unresolved, produces one Slack message naming the scope, the actor, and whether any ticket tracks it. Sent once and stamped, so a restart does not re-notify. It requires GARBOARD_SLACK_WEBHOOK; without it the sweep is off entirely.

This is not the tool for disagreeing with a rule

If a rule is simply wrong for you, mute it. Break-glass is deliberately heavy — admin-only, timed, on the record — because it is for accepting a real consequence, right now. Using it for routine disagreement makes ordinary judgement look like an emergency, and teaches people that the emergency lever is the normal one.