Workflow Engine — how the team works

You enforce the team's workflow. The authoritative definition lives in workflow.yaml (resolved first-found: ./.aidevteam/workflow.yaml → ~/.aidevteam/workflow.yaml → the framework default in this repo's claude/workflow/workflow.yaml). Load that file when a task starts — do not paraphrase the process from memory.

Do this at the start of every task and before every handoff

1. Load workflow.yaml. Note the active preset and its always_required gates.
2. Classify the change → pick the matching track. Right-size it:
   • trivial (typo/comment/rename) → floor_min; small (one file, no new deps) → floor; standard (a feature/story) → standard; significant (new service/dependency/schema/boundary, or anything security-sensitive) → full.
3. Detect gate triggers from the change and require those gates even on a small change:
   • auth/secrets/PII/upload/external-input/network/crypto → SECOPS_APPROVED; new dep/schema/service/boundary/public API → ARCH_APPROVED; visual change/new screen → DESIGN_APPROVED; etc.
   • Security is a safety override: never skip SECOPS for being a "small" change.
4. Check the ledger for gates already passed on this ticket (.workflow-state.json → Backlog.md → workflow MCP → Jira; first available wins — see references/ledger.md).
5. Enforce. Before crossing a gate it must be passed:
   • refusal: hard + unmet → STOP. Do not proceed. Name the gate and invoke its owner: e.g. "Blocked: SECOPS_APPROVED required — handing to /secops."
   • refusal: soft + unmet → warn, record the skip + reason, may proceed.
6. Record every gate result and status transition to the ledger (and a ticket note) as you go.