The interview asks only what the target actually requires. Never-assumable parameters are asked, consequential ones are confirmed, and every silent default is recorded with its justification.
isolated adds a separate runner cluster reached over peering — changes cost and topology
Assumed — safe defaults, each recorded with its reason
6 assumptions
storage_class managed-csi cloud default · changeable later as a config plan
backup_window 02:00–04:00 lowest traffic window for the region
log_retention 14d profile default · compliance floors can raise it
cert_issuer letsencrypt-prod public TLS with auto-renew · offline issuer on air-gap
node_os Ubuntu 22.04 tested with this release's kernel/runtime matrix
registry_mode mirrored clusters never pull from the public internet
"I didn't ask because the defaults were safe" is a checkable claim — the interview record replays non-interactively.
answer both questions and tick the 3 confirmations to continue
Deployment plan
Not yet approved
The plan id is a hash over workspace + resolved config + bundle digest. Apply refuses if anything drifts after approval — and the approval token is single-use.
Interview state
same buckets the agent surface reports
31
resolved from the profile
6
assumed — justification recorded
3
need confirmation
2
must ask — never assumable
Estimated run: ~45 min · 23-task DAG · checkpoint before the first forward-only step · cost estimate appears on the rendered plan.