{
  "slug": "helmfile-doctor-analyzes-diffs-and-gates-high-risk-changes-e9e7e5c74346",
  "title": "helmfile doctor analyzes diffs and gates high-risk changes",
  "tools": [
    "helmfile"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-06-22T23:06:01.000Z",
  "announced_at": "2026-06-22T23:06:01.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "Before applying planned changes, run `helmfile doctor` to review the diff; use `--output json` for a structured report. High-risk findings exit 2 unless `--force` is passed.",
    "examples": [
      "export HELMFILE_LLM_API_KEY=\"<api-key>\"\nexport HELMFILE_LLM_MODEL=\"<model-id>\"\nhelmfile doctor --output json",
      "helmfile doctor --force --output json",
      "helmfile doctor"
    ],
    "gotchas": [
      "Version: v1.6.0",
      "--output <format>: Doctor report format; `json` emits structured JSON. Default is text.",
      "--force: Skip the exit-2 gate when a high-severity risk is found.",
      "--context <N>: Diff context lines; doctor defaults to 3.",
      "llm.baseURL: OpenAI-compatible endpoint base URL; defaults to `https://api.openai.com/v1`.",
      "llm.apiKey (required): API key; required to enable LLM analysis.",
      "llm.model (required): Model identifier; required to enable LLM analysis.",
      "llm.timeout: Per-request timeout; default 60s.",
      "llm.maxTokens: Maximum completion tokens; default 4096.",
      "--llm-base-url <URL>: Set the OpenAI-compatible endpoint URL.",
      "--llm-api-key <key>: Set the LLM API key.",
      "--llm-model <id>: Set the model identifier.",
      "--llm-timeout <duration>: Set per-request timeout; Go duration format.",
      "--llm-max-tokens <N>: Set completion token cap.",
      "--diff-output <format>: Set helm-diff plugin output format; `--output` is reserved for doctor report format.",
      "--show-secrets: Ignored by doctor; secrets remain redacted.",
      "--suppress-secrets: Drop Secret resource structure from the diff.",
      "Prerequisite: LLM analysis requires `apiKey` and `model`; `baseURL` is optional. The endpoint must speak OpenAI Chat Completions protocol.",
      "Prerequisite: `helmfile diff` requires helm-diff plugin v2.9.0+1 or greater.",
      "The endpoint must be OpenAI-compatible and support Chat Completions.",
      "The default `--context` value is 3.",
      "A high risk exits with code 2 unless `--force` is passed; other errors exit with code 1.",
      "An LLM call failure degrades to exit code 0.",
      "Secrets are always redacted before any byte leaves the process; `--show-secrets` is silently ignored.",
      "Without LLM configuration, doctor degrades to a plain `helmfile diff` with `--show-secrets` forced off.",
      "Most `helmfile diff` flags are accepted for parity."
    ]
  },
  "why_it_matters": "Review planned Helmfile changes in a CI pipeline before applying them.",
  "sources": [
    "https://github.com/helmfile/helmfile/releases/tag/v1.6.0",
    "https://github.com/helmfile/helmfile/blob/v1.6.0/docs/cli.md"
  ],
  "rank": 0.95043,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v2+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "wave1-20261014",
    "verdict_id": "wave1-20261014:wave1-20261014-4aeed1379b88f2da-0:gate",
    "evidence_hash": "5735e019c2f2f36acdd35b054331f1dab4afbcdbd678c2b6c5c37aa6ab891be3"
  },
  "review": {
    "draft_hash": "67d305a879797e7508758560bc94db0bb9513ec51831e0cbf85a71d3afcc538e",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T00:00:00.000Z",
    "decision": "wave1-20261014:gate",
    "reason": "3 of 3 judge runs approved with p_yes >= 0.9 (mean 0.95 >= 0.9; 2 needed) and Jev gave 0.77 (>= 0.6 needed)."
  }
}