Write gates

A write gate is a configuration flag that is off until a human turns it on. Every Droost tool that can change the site or the code checks its gate before acting, and a refusal names the flag it needs. Read-only tools have no gate.

Arming is the operator's act

Gates live in droost.settings. The agent can read them (and will tell you which one it needs) but the MCP surface offers no way to set them: droost_config_set refuses to touch droost.settings by design. Arming happens in the admin form, with Drush, or by answering drush droost:install's question.

The flags

Flag	Arms	Default
`allow_config_write`	`droost_config_set` on existing config objects.	off
`allow_entity_write`	Creating, updating and deleting content entities.	off
`allow_db_write`	Single-statement `INSERT`, `UPDATE`, `DELETE`.	off
`allow_module_ops`	Installing and uninstalling modules, running cron.	off
`allow_scaffold`	`droost_scaffold`, `droost_structure_create`, the display and Views composers: the three build surfaces. Also STDIO-only.	off; `droost:install` asks
`allow_eval`	`droost_eval`, PHP in the bootstrapped site.	off
`allow_destructive`	`droost_generate` (devel_generate) in the `droost_devel` submodule.	off

Two tools are gated by transport rather than by a flag: droost_verify and droost_workflow_run spawn the project's own binaries, so they run only over STDIO from an editor on the same machine.

Arming a gate

bash

drush config:set droost.settings allow_scaffold true -y
drush cr

Gate flags are read live since 2.0.0-alpha3, so arming one mid-session no longer needs an editor reconnect. drush droost:setup:status lists every flag with its state, and /droost:configure walks them from inside the editor.

Why gates are per capability, not one switch

An agent that only needs to read should never be one typo from a delete. Splitting the surface means a site can arm exactly what a piece of work needs (allow_scaffold for a build, allow_entity_write for content seeding) and leave the rest cold. A refusal that names the specific flag also turns a dead end into a decision the human can make in seconds.

Gates and the workflow are different things

Write gates decide whether a tool may act. The workflow's phase gates decide whether a run may advance (phpcs, phpstan, phpunit and the rest), and its wall decides whether custom code may be edited at all outside a run. The vocabulary overlaps because the posture is the same: nothing loosens without a human's recorded decision.