Skip to main content

Dry-run and kill switch

Effective dry-run is resolved from deployment configuration and durable database settings.

effective dry-run = force_dry_run OR (unlocked UI override, otherwise deployment dry-run)

If effective dry-run is true, no destination write client is resolved for Apply.

Deployment defaults​

  • RECONCILE_DRY_RUN defaults to true.
  • RECONCILE_DRY_RUN_UI_OVERRIDE defaults to false.
  • The Helm chart uses the same safe defaults.
  • The standalone evaluation stack unlocks the UI override so write paths can be exercised locally.

One-way kill switch​

An administrator can force dry-run from Infrastructure. The force_dry_run setting is persisted in PostgreSQL and always wins, including over an unlocked UI override.

Recovery is an explicit database operation in production

The force row survives a pod restart and redeployment. When the UI override is locked, the console cannot clear it. After resolving the incident, a database administrator must deliberately remove the force_dry_run setting row through the approved change process.

Safe enablement sequence​

  1. Leave deployment dry-run true and the UI override locked.
  2. Complete a clean observation and review all proposals.
  3. Back up PostgreSQL.
  4. Change deployment dry-run only through a reviewed deployment change.
  5. Watch the next reconcile and audit log.
  6. Use the one-way kill switch immediately if mutation must stop.