# Risk-based workflow automation record

## Status

- Status: active
- Current phase: independent review
- Next safe action: review the pinned policy diff and four bounded scenarios.

## Request and scope

- Request: reduce routine human interaction and redundant testing, especially for replaceable pre-production data.
- In scope: develop-workflow skill and references/template; code-review skill; ADR and historical pointers; validation evidence and existing TODO alignment.
- Out of scope: extension runtime/config changes, global instructions, database access, archived engines, checkpoint format changes, replacement of outstanding twelve-scenario/three-pilot validation.

## Git identity

- Source branch: main
- Base commit: 284fdd638d1f2c790290491e0cfe2802880cec25
- Feature branch: feature/workflow-automation
- Worktree: /home/jb/code/harness-tools/.worktrees/workflow-automation
- Omitted source changes: none; source checkout clean.

## Acceptance criteria

- [ ] Routine work proceeds from a recorded plan without an approval pause; substantive choices and protected actions remain gated.
- [ ] Disposable-data policy requires named authorized targets, identity checks, scope and reproducible reset/reseed; pre-production alone grants nothing.
- [ ] Focused tests and review precede one final full verification boundary; valid evidence can be reused and invalidated evidence is rerun.
- [ ] One non-author reviewer covers standards and specification; targeted fixes do not force fresh full reviews.
- [ ] Records remain recoverable with existing heading contract; no initial/per-gate/closure commit ceremony is mandatory.
- [ ] UI direction, real interface validation, worktree isolation, honest results and safe integration remain intact.
- [ ] No new extension, dependency, runtime behavior or user-level policy change.

## Approved implementation plan and gates

- Plan/specification source: user-approved /tmp/pi-present/develop-workflow-automation-review.md and the acceptance criteria above.
- Exact plan: revise workflow and supporting references, consolidate review policy in code-review, retain checkpoint heading schema, add ADR 0008 and supersession pointers, run focused checks and scenario walkthroughs, obtain one independent review, run final full suite/static checks, commit and integrate locally.
- Plan approval: user said "approved, let's proceed and implement this plan." on 07OCT2026. This explicitly authorizes the risk-based policy and its use for this revision; no redundant re-approval requested.
- UI classification and direction approval: documentation-only skill behavior; no product UI change.
- Risk decisions and scope: no database/environment declared disposable by this change; no dependency, security-posture, production, publishing or deployment changes. Existing external native-hooks default config directory is absent; no installed policy inferred or modified.

## Ownership

- Parent agent owns all edits under skills/develop/develop-workflow/, skills/develop/code-review/SKILL.md, docs/adr/0008-risk-based-development-workflow-07OCT2026.md, supersession pointers in ADR 0006 and the accepted workflow plan, docs/todos.md, and this record.
- Independent reviewer owns no files and cannot remediate. No mutating child assignments.

## Verification matrix

| Surface | Command or method | Exit code | Outcome |
| --- | --- | --- | --- |
| Checkpoint compatibility | node --test skills/develop/develop-workflow/tests/checkpoint-record.test.mjs | 0 | 13/13 passed; existing schema retained |
| Policy consistency | Node validateRecord on template/record, Python local-link validation, git diff --check | 0 | Both heading contracts valid; 18 links across 9 policy files resolve; whitespace clean. No prose snapshot tests added. |
| Scenarios | routine feature, disposable/protected data, targeted review fix/shared-code change, non-trivial UI | pending | Bounded policy walkthroughs, not full execution pilots |
| Final repository suite | bun run test | pending | Run after review fixes |
| Final static check | bun run typecheck | pending | Run at final boundary |

## Review

- Base and product HEAD: pending
- Clean status and tree hash: pending
- Commit list: pending
- Exact diff command: git diff --binary --full-index --find-renames <base>...<product-head> --
- SHA-256: pending
- Mutator identities: parent agent only
- Reviewer identity, digest confirmation, standards and specification verdicts: pending
- Findings and remediation: pending
- Before/after reviewer Git evidence: pending

## Integration and rollback

- Synchronization and re-verification: git fetch origin completed with exit 0; origin/main and source main both remain 284fdd638d1f2c790290491e0cfe2802880cec25. No rebase delta.
- Fast-forward result: pending
- Product and evidence commits: pending
- Reachability and cleanup: pending
- Rollback strategy: revert the focused policy commit; no data or runtime migration.

## Checkpoints and blockers

- Last committed valid checkpoint: none yet; initial durable record written before product edits; batch commits per approved policy.
- Blockers: none
- Exact next safe action: obtain independent review and scenario walkthroughs; then run final full suite and typecheck.