Build Gatekeeper all the way through: one on/off (later off/drafts/live) setting per module per customer, checked at every place Clara or automation acts, so a switched-off module does nothing and the team takes over.
Status is DERIVED from each row’s own PR, decision and prod-evidence links by
bin/refresh-tracker gatekeeper-build — never typed. Last refreshed
2026-10-01 12:54Z.
Every row opens: when it was added, why it exists, and the links that prove it. Rows waiting on a human carry a Decide → link straight to the answerable question on the decisions page. Statuses are re-derived from live PR, decision and prod-evidence state by bin/refresh-trackers; nothing here is typed by hand, and merged is not shipped until a prod_evidence permalink says the fix was exercised in production.