Destructive actions require explicit go

Before executing any action that destroys, recreates, or significantly mutates infrastructure, list the steps and wait for an affirmative “go”. This holds even under an autonomous-directives-are-blanket-approval grant — destructive operations are out-of-scope for blanket approval by default.

What counts as destructive

Anything that wipes data: docker compose down -v, docker volume rm, prisma migrate reset, DROP TABLE, DELETE FROM on non-test data
Anything that recreates infrastructure: docker compose build of production-tier images (which can invalidate cached state), recreating containers that hold uncommitted state
Anything that touches secrets / credentials: rotating an OAuth client secret, regenerating an API key, replacing the credential-encryption key
Mass bash on startup or session resume — the agent has been locked out of a machine before by an over-eager npm install + docker compose build chain
Force-push to a protected branch, branch deletion of unmerged work, git reset --hard past committed work
Modifying compose volumes / networks / project labels in ways that trigger Docker to recreate named volumes

What’s NOT destructive (and so does not need a fresh OK)

Read-only inspection: psql ... -c "SELECT ...", docker logs, git status, ls
Idempotent re-application: re-running pnpm install, re-running a successful seed, re-running a healthy migration
File-system changes within the agent’s worktree that are tracked in git (the worktree itself is the audit trail)
Restarting healthy containers without rebuilding (docker compose up -d portal)

The contract

When a destructive action is needed:

List the steps in plain language. “I’ll rebuild the portal image, recreate the portal container, and reseed the DB to pick up the new model.” Not shell — operator-readable steps.
Wait for the operator’s explicit go. “Yes”, “do it”, “go ahead”, “proceed” — not silence, not “you decided already.”
Execute only the listed steps. If the work mid-execution surfaces an additional destructive action, stop and ask again.
Report the outcome of each step, not just the final state.

Anti-pattern

Running docker compose down -v to fix a port conflict (“just gonna recreate the volumes”)
Running npm install + docker compose build on session start “to make sure everything is fresh”
Adding a prisma migrate reset to a recovery script “since we’re already wiping things”

Every one of these has, at some point, cost the operator hours.

Penalty

This is a commandment-tier principle. The first violation that named it locked the operator out of their machine for a day. The ongoing cost of asking “want me to rebuild the portal image?” is zero. The cost of an unsolicited destructive action is unbounded.