Exemptions
Merging with a failing process check is sometimes the right call. Doing it without a record is not — so an exemption names who accepted what, why, and until when.
Why a label was not enough
redline-exempt used to be a bare label. It downgraded the process checks to warnings and recorded nothing, which left the estate unable to answer the two questions that actually matter about an exemption: is anyone still standing behind it, and was it ever meant to be permanent. An exemption nobody has to justify and nobody revisits is not an exemption — it is an opt-out with a friendlier name.
What the gate reads
The label still marks the pull request. The reason lives in a block in its body, which redline exempt parses and the gate acts on. The pull request template carries the section already, empty, for you to fill in or delete.
## Redline exemption
- reason: the upstream fix lands in v4 and we are pinned to v3 until the migration
- until: 2026-11-30
- scope: checklist- reason — at least 20 characters. “Needed for release” tells a reader in three months nothing they can act on.
- until — a date, at most 90 days out. Longer than that is a standards change, not an exemption; raise it in the Redline source repo.
- scope — which checks it covers. Omit it to cover both process checks, which is what the bare label meant implicitly.
What it can never do
An exemption touches the process checks only — the checklist and the ADR requirement. It has never been able to waive dependency review or the diff secret scan, and it still cannot. That boundary is load-bearing: it is what makes the security floor a floor rather than a default.
How it arrives
This is a behaviour change for every onboarded repository, so it ships behind a grace. The gate's exemption-enforcement input defaults to warn: a label with no valid block is accepted and told what is missing. A repository moves to require one standards version later — so nobody's open pull request is failed by a rule that did not exist when they opened it.
Redline exempts itself the same way
A sync pull request carries a real exemption block rather than being a special case in the gate — one rule for everyone is worth more than a convenience for the tool that wrote the rule. Its exemption expires after 30 days, which means a sync pull request nobody merges starts failing its own gate. That is exactly what should happen to a standards change a repository is quietly refusing.
What gets measured
The collector records the parsed exemption per pull request, so standing exemptions trend on the dashboard. A team routing around the gate shows up as the same scope recurring across pull requests — which is the guardrail the programme asks for, and one a per-pull-request view can never show. An expired exemption drops out of that count: it is history, not a standing problem.