Built for the platform team that owns the pipeline
Terraform apply waits for a human on your highest-risk changes.
A deploy flagged Class C (SynOI's highest-risk action tier) dispatches a human-in-the-loop (HITL) approval request before a single resource changes, and doesn't run until someone approves it. Receipt written as a CI artifact; verifiable independently, any time.
What this covers
The Class C gate is the boundary where governance has to be mandatory and the signature has to be portable.
- synoi-terraform (in development) · wraps terraform apply; human approval (HITL) on production workspaces
- GitHub Actions (in development): `synoi/gate@v1` step blocks until approved
- GitLab CI (in development): same gate, native runner support
- Receipt written to synoi-receipt.json as a CI artifact
- 90-day default retention; configurable per tenant
- Exit code 1 on denial: the apply never runs