Safe Changes

POST /api/v1/change/simulations accepts a named workspace, request text, and optional relative file list. Without files, Akritas asks the model for bounded lexical discovery queries and constructs the snapshot itself.

Successful preview returns the structured result, host diff, validator evidence, warnings, and-when changes exist-a pending approval. Preview never changes source files.

Apply calls POST /api/v1/change/simulations/{approval-id}/apply with {"confirm":true}. The capability expires after 30 minutes and is removed on first use. Akritas rejects changed originals, appeared create targets, traversal, symlink escape, and protected secret filenames.

The server-wide -response-language setting also controls model-generated analysis, checks, risks, rollback guidance, and clarification questions in a change preview. Fixed result headings and host validator output remain English. The standalone command accepts the same option:

./bin/akritas simulate-change \
  -root testdata/ops-change/nftables \
  -request REQUEST.md \
  -file pillar/prod/nftables.sls \
  -response-language de \
  -print-prompt