Feature
Repair is optional. Proof is not.
Off, monitor, recommend, approval required, safe autopilot. Write access is never default. Every action is audited.
Modes
OFF does nothing. MONITOR watches. RECOMMEND proposes. APPROVAL REQUIRED waits. SAFE AUTOPILOT may execute narrow, capped, dry-run-then-verify actions. Launch default is OFF / RECOMMEND.
What never auto-runs
Large refunds, payout disputes, large price edits, accounting write-offs, financial transfers. Kill switches exist globally, per tenant and per connector.