claude-flow-novice
Version:
Claude Flow Novice - Advanced orchestration platform for multi-agent AI workflows with CFN Loop architecture Includes Local RuVector Accelerator and all CFN skills for complete functionality.
926 lines (760 loc) • 27.9 kB
Markdown
# Skills Database Approval Criteria
## Three-Tier Approval System - Detailed Definitions
**Version:** 2.0.0
**Date:** 2025-11-16
**Status:** Production Ready
**Audience:** Expert reviewers, system administrators, team leads
---
## Table of Contents
1. [Approval Level Definitions](#approval-level-definitions)
2. [Risk Assessment Rubric](#risk-assessment-rubric)
3. [Decision Matrix & Examples](#decision-matrix--examples)
4. [TDD Integration](#tdd-integration)
5. [Escalation Triggers](#escalation-triggers)
6. [Category-Specific Criteria](#category-specific-criteria)
---
## Approval Level Definitions
### Level 1: Auto-Approved
**Purpose:** Instant approval for low-risk, well-tested skills with minimal external dependencies.
**Automatic Criteria (ALL must be met):**
| Criteria | Requirement | Rationale |
|----------|-------------|-----------|
| Risk Score | ≤ 0.30 | Low security/business impact |
| Test Coverage | ≥ 95% | High code quality confidence |
| Cyclomatic Complexity | ≤ 5 | Simple, maintainable logic |
| External Dependencies | 0 | No API/service calls |
| File System Access | Local skill directory only | No cross-directory modifications |
| Security Review | Not required | Low-risk operations only |
| Database Access | Query-only or local SQLite | No production database writes |
| Credential Usage | None | No API keys or secrets |
**Approval Decision:**
- Status: Automatically APPROVED
- Approver: system
- Time to approval: < 5 seconds
- Audit trail: Automatic entry created
**Database Field Values:**
```sql
approval_level = 'auto'
last_approved_by = 'system'
last_approval_date = datetime('now')
```
**Examples of Auto-Approved Skills:**
1. **cfn-coordination-protocol-v1** (coordination)
- Risk: 0.15, Coverage: 98%, Complexity: 3
2. **cfn-test-runner-basic** (testing)
- Risk: 0.20, Coverage: 97%, Complexity: 2
3. **cfn-logging-utility** (foundation)
- Risk: 0.10, Coverage: 99%, Complexity: 1
---
### Level 2: Escalated Review
**Purpose:** Expert review for medium-risk skills or those with specialized infrastructure dependencies.
**Escalation Criteria (ANY trigger escalation):**
| Trigger | Threshold | Rationale |
|---------|-----------|-----------|
| Risk Score | 0.31-0.60 | Medium security/business impact |
| Test Coverage | 80-94% | Good but not excellent coverage |
| Complexity | 6-15 | Moderate logical complexity |
| External Dependencies | 1-3 API/service calls | May require stability verification |
| Security Review | Required | Security-sensitive operations |
| Infrastructure Changes | Docker, Redis, PostgreSQL | Infrastructure expertise required |
| Cross-Team Dependencies | Affects 2+ teams | Coordination and impact analysis needed |
| Database Writes | Production databases | Data integrity verification required |
| Conditional Deployment | Config-dependent paths | Testing complexity increases |
**Escalation Process:**
- Status: Pending escalation
- Duration: 24-48 hour expert review window
- Notified Experts: 2+ security/infrastructure specialists
- Feedback Loop: Expert may request corrections
- Final Decision: Approved, Escalated-to-Human, or Rejected
**Database Field Values:**
```sql
approval_level = 'escalate'
approval_criteria = {
"risk_score": 0.45,
"test_coverage": 0.88,
"requires_security_review": true,
"external_apis": ["redis", "postgres"],
"expert_category": "infrastructure"
}
last_approved_by = 'expert-name@example.com'
last_approval_date = '2025-11-16T14:30:00Z'
```
**Expert Review Responsibilities:**
- Validate risk assessment accuracy
- Confirm test coverage completeness
- Review security implications
- Assess integration impact
- Approve or escalate to human review
- Document reasoning in approval_history
**Examples of Escalated-Review Skills:**
1. **cfn-redis-coordination-v2** (coordination)
- Risk: 0.45, Coverage: 88%, External: Redis
- Expert: Infrastructure specialist
2. **cfn-postgres-connection-pool** (infrastructure)
- Risk: 0.52, Coverage: 85%, Database: PostgreSQL
- Expert: Database architect
3. **cfn-secure-agent-spawning** (security)
- Risk: 0.48, Coverage: 90%, Security-critical
- Expert: Security architect
---
### Level 3: Human Approval
**Purpose:** Senior expert review for high-risk, complex, or strategically important skills.
**Human Review Criteria (ANY trigger human approval):**
| Trigger | Threshold | Rationale |
|---------|-----------|-----------|
| Risk Score | > 0.60 | High security/business impact |
| Test Coverage | < 80% | Insufficient test coverage |
| Complexity | > 15 | High cyclomatic complexity |
| New Category | First skill in category | Requires strategic decision |
| Revenue Impact | Affects revenue systems | Business-critical decision |
| Multi-System Integration | Changes 3+ major systems | Complex interactions require analysis |
| Compliance/Regulatory | HIPAA, SOC2, GDPR implications | Legal/regulatory decision required |
| Escalation Feedback | Repeated rejections/corrections | Quality gate failures indicate deeper issues |
| Architecture Change | Changes approval system itself | Meta-level decision requires oversight |
**Human Review Process:**
- Status: Pending senior expert decision
- Duration: 3-7 day review window
- Assigned: Senior architect + team lead
- Analysis: Deep code review, impact assessment, risk evaluation
- Final Decision: Approved, Rejected, or Needs-Correction
- Board Review: Optional for strategic decisions
**Database Field Values:**
```sql
approval_level = 'human'
approval_criteria = {
"risk_score": 0.72,
"test_coverage": 0.75,
"complexity": 18,
"affects_systems": ["orchestration", "agent-spawning", "coordination"],
"requires_board_review": true,
"compliance_category": "governance"
}
last_approved_by = 'cto@example.com'
last_approval_date = '2025-11-18T10:00:00Z'
```
**Human Review Responsibilities:**
- Conduct comprehensive code review
- Evaluate business impact and risk
- Assess compliance and regulatory implications
- Determine resource requirements
- Make final approval/rejection decision
- Document strategic rationale
**Examples of Human-Approved Skills:**
1. **cfn-orchestration-v3-enhanced** (orchestration)
- Risk: 0.68, Coverage: 75%, Complexity: 22
- Strategic: Major system redesign
2. **cfn-agent-spawn-secure-v2** (infrastructure)
- Risk: 0.75, Coverage: 78%, Security-critical
- Compliance: GDPR-relevant changes
3. **cfn-event-bus-distributed** (architecture)
- Risk: 0.70, Coverage: 72%, Affects 5+ systems
- Strategic: Changes CFN Loop design
---
## Risk Assessment Rubric
### Component Risk Scoring (0.0 = Safe, 1.0 = Critical Risk)
#### 1. Security Impact (Weight: 35%)
```
0.0 - 0.2: No security implications
Example: Logging utility, test helper
0.2 - 0.4: Low security impact (read-only)
Example: Query tool, metrics reader
0.4 - 0.6: Medium security impact (write access)
Example: Database modifier, config updater
0.6 - 0.8: High security impact (secrets/credentials)
Example: Key manager, auth system
0.8 - 1.0: Critical security impact (breach = data loss)
Example: Encryption system, audit log modifier
```
**Sub-components:**
- Credential Handling: 0=None, 0.3=API keys only, 0.7=Secrets, 1.0=Multi-secret types
- Data Access Scope: 0=Own dir, 0.3=Project, 0.6=Database, 0.9=External systems, 1.0=Critical infrastructure
- Error Handling: 1.0 = Safe, 0.7 = Logs errors, 0.4 = Sometimes logs, 0.0 = Silent failures
#### 2. Complexity Score (Weight: 25%)
```
0 - 3: Low - Single function, linear flow
Example: Echo utility, simple wrapper
4 - 7: Medium - Multiple branches, some state
Example: Routing logic, multi-step process
8 - 12: Medium-High - Complex state, recursion
Example: Tree traversal, backtracking
13 - 20: High - Multiple interactions, edge cases
Example: Consensus algorithm, orchestrator
21+: Critical - Meta-complexity
Example: Complete CFN Loop redesign
```
**Normalize to 0.0-1.0:** complexity_score / 20 (capped at 1.0)
#### 3. Test Coverage (Weight: 20%)
```
< 50%: 0.9 risk (insufficient confidence)
50-70%: 0.7 risk
70-80%: 0.5 risk
80-95%: 0.2 risk
95%+: 0.0 risk (high confidence)
```
Adjusted by test quality:
- 100% line coverage + edge cases = 0.0
- 95% coverage without edge cases = 0.1
- Coverage < 80% + no critical path testing = 0.9
#### 4. External Dependencies (Weight: 15%)
```
0 dependencies: 0.0 risk
1 stable dependency: 0.2 risk
2-3 dependencies: 0.4 risk
4+ dependencies: 0.6 risk
Unstable/beta deps: +0.3 risk multiplier
Undocumented deps: +0.2 risk multiplier
```
**Examples:**
- No external calls = 0.0
- Queries local SQLite = 0.1 (low risk)
- Calls Redis cluster = 0.3 (stable, documented)
- Calls 3 microservices + custom API = 0.7 (high coupling)
#### 5. Business Criticality (Weight: 5%)
```
Non-critical (testing, docs): 0.0 risk
Standard tools (utilities, helpers): 0.1 risk
Important (frequently used): 0.3 risk
Critical (affects multiple teams): 0.5 risk
Revenue-impacting (payment system): 0.8 risk
Core infrastructure (can break system): 1.0 risk
```
### Aggregate Risk Formula
```
Aggregate Risk = (
Security_Impact × 0.35 +
Complexity_Score × 0.25 +
Test_Coverage_Risk × 0.20 +
External_Deps_Risk × 0.15 +
Business_Criticality × 0.05
)
```
**Example Calculation:**
**Skill: cfn-redis-coordination-v2**
| Component | Score | Weight | Contribution |
|-----------|-------|--------|--------------|
| Security Impact | 0.35 | 0.35 | 0.1225 |
| Complexity (12/20) | 0.60 | 0.25 | 0.1500 |
| Test Coverage (88%) | 0.20 | 0.20 | 0.0400 |
| External Deps (Redis) | 0.30 | 0.15 | 0.0450 |
| Business Critical | 0.30 | 0.05 | 0.0150 |
| **Total Risk** | | | **0.3725** |
**Decision:** Escalation (0.31-0.60 range)
**Example Calculation:**
**Skill: cfn-agent-spawn-secure-v2**
| Component | Score | Weight | Contribution |
|-----------|-------|--------|--------------|
| Security Impact | 0.75 | 0.35 | 0.2625 |
| Complexity (18/20) | 0.90 | 0.25 | 0.2250 |
| Test Coverage (78%) | 0.50 | 0.20 | 0.1000 |
| External Deps (3 APIs) | 0.40 | 0.15 | 0.0600 |
| Business Critical | 0.80 | 0.05 | 0.0400 |
| **Total Risk** | | | **0.6875** |
**Decision:** Human Approval (> 0.60)
---
## Decision Matrix & Examples
### Complete Decision Tree
```
START: New Skill Submission
│
├─ Risk Score > 0.60?
│ ├─ YES → HUMAN APPROVAL (Rule 1)
│ └─ NO → Continue
│
├─ Test Coverage < 80%?
│ ├─ YES → HUMAN APPROVAL (Rule 2)
│ └─ NO → Continue
│
├─ Complexity > 15?
│ ├─ YES → HUMAN APPROVAL (Rule 3)
│ └─ NO → Continue
│
├─ Risk Score 0.31-0.60?
│ ├─ YES → ESCALATED REVIEW (Rule 4)
│ └─ NO → Continue
│
├─ Test Coverage 80-94%?
│ ├─ YES → Check Dependencies
│ │ ├─ External Deps? → ESCALATED REVIEW (Rule 5)
│ │ └─ No Deps → AUTO APPROVAL
│ └─ NO → Continue
│
├─ Complexity 6-15?
│ ├─ YES → ESCALATED REVIEW (Rule 6)
│ └─ NO → Continue
│
└─ All Criteria Met?
├─ YES → AUTO APPROVAL
└─ NO → ESCALATED REVIEW (Fallback)
```
### 25+ Real-World Examples
#### AUTO-APPROVED SKILLS (Risk ≤ 0.30)
**1. cfn-logging-utility**
- Category: foundation
- Risk: 0.12 (safe logging operations)
- Coverage: 99% (comprehensive tests)
- Complexity: 1 (single function)
- Dependencies: 0
- Decision: AUTO
- Reason: Safe utility with excellent coverage
**2. cfn-test-runner-basic**
- Category: testing
- Risk: 0.18 (test execution, no side effects)
- Coverage: 97% (edge cases covered)
- Complexity: 3 (linear flow)
- Dependencies: 0
- Decision: AUTO
- Reason: Simple tool with high confidence
**3. cfn-coordination-protocol-v1**
- Category: coordination
- Risk: 0.15 (no external calls)
- Coverage: 98% (comprehensive blocking tests)
- Complexity: 4 (limited state)
- Dependencies: 0 (signal-based only)
- Decision: AUTO
- Reason: Pure coordination logic, well-tested
**4. cfn-echo-wrapper**
- Category: foundation
- Risk: 0.08 (shell wrapper)
- Coverage: 95% (basic tests)
- Complexity: 2 (passthrough)
- Dependencies: 0
- Decision: AUTO
- Reason: Minimal risk wrapper
**5. cfn-json-parser**
- Category: utilities
- Risk: 0.22 (JSON parsing)
- Coverage: 96% (malformed input tests)
- Complexity: 3 (regex patterns)
- Dependencies: 0 (standard jq)
- Decision: AUTO
- Reason: Well-established tool with safe operations
#### ESCALATED-REVIEW SKILLS (Risk 0.31-0.60)
**6. cfn-redis-coordination-v2**
- Category: coordination
- Risk: 0.37 (Redis connection risk)
- Coverage: 88% (good but not excellent)
- Complexity: 7 (Redis protocol handling)
- Dependencies: Redis cluster
- Trigger: Medium risk + external dependency
- Decision: ESCALATE
- Expert: Infrastructure specialist
- Review SLA: 48 hours
**7. cfn-postgres-connection-pool**
- Category: infrastructure
- Risk: 0.42 (database connection management)
- Coverage: 85% (connection timeout edge cases)
- Complexity: 9 (state machine)
- Dependencies: PostgreSQL server
- Trigger: Database writes + medium complexity
- Decision: ESCALATE
- Expert: Database architect
- Review SLA: 48 hours
**8. cfn-secure-agent-spawning**
- Category: security
- Risk: 0.48 (security-critical operation)
- Coverage: 90% (attack vector testing)
- Complexity: 8 (validation logic)
- Dependencies: 2 (crypto libraries)
- Trigger: Security-sensitive operations
- Decision: ESCALATE
- Expert: Security architect
- Review SLA: 48 hours
**9. cfn-event-bus-local**
- Category: infrastructure
- Risk: 0.35 (local event routing)
- Coverage: 82% (message loss scenarios)
- Complexity: 10 (event queueing)
- Dependencies: 1 (bash arrays)
- Trigger: Medium complexity + external dependency
- Decision: ESCALATE
- Expert: Architecture specialist
- Review SLA: 48 hours
**10. cfn-agent-selector-v2**
- Category: coordination
- Risk: 0.41 (agent selection logic)
- Coverage: 87% (preference handling)
- Complexity: 8 (multi-factor scoring)
- Dependencies: 0
- Trigger: Medium risk + complexity
- Decision: ESCALATE
- Expert: Orchestration specialist
- Review SLA: 48 hours
#### HUMAN-APPROVED SKILLS (Risk > 0.60)
**11. cfn-orchestration-v3-enhanced**
- Category: orchestration
- Risk: 0.68 (orchestrator redesign)
- Coverage: 75% (below threshold)
- Complexity: 22 (high: state machines, timeouts)
- Dependencies: 5 (Redis, databases, APIs)
- Triggers: Risk > 0.60, Coverage < 80%, Complexity > 15
- Decision: HUMAN
- Assigned: CTO + Architecture Lead
- Review SLA: 7 days
- Board Review: YES (strategic change)
**12. cfn-agent-spawn-secure-v2**
- Category: infrastructure
- Risk: 0.75 (security-critical: process creation)
- Coverage: 78% (below threshold)
- Complexity: 14 (near-threshold: process groups)
- Dependencies: 3 (os, signal handlers, crypto)
- Triggers: Risk > 0.60, Coverage < 80%
- Decision: HUMAN
- Assigned: Security Architect + CTO
- Review SLA: 7 days
- Board Review: YES (security implications)
**13. cfn-event-bus-distributed**
- Category: architecture
- Risk: 0.70 (distributed system complexity)
- Coverage: 72% (below threshold)
- Complexity: 24 (very high: consensus, replication)
- Dependencies: 4 (Redis, PostgreSQL, gRPC, custom)
- Triggers: Risk > 0.60, Coverage < 80%, Complexity > 15, Multi-system integration
- Decision: HUMAN
- Assigned: Principal Architect + CTO
- Review SLA: 7 days
- Board Review: YES (affects all systems)
**14. cfn-approval-system-redesign**
- Category: governance
- Risk: 0.82 (affects approval process itself)
- Coverage: 70% (below threshold)
- Complexity: 26 (meta-complexity)
- Dependencies: 6+ (database, notifications, validators)
- Triggers: Risk > 0.60, Coverage < 80%, Architecture change, Revenue impact
- Decision: HUMAN
- Assigned: CTO + All Tech Leads
- Review SLA: 14 days
- Board Review: YES (governance change)
**15. cfn-compliance-audit-system**
- Category: governance
- Risk: 0.80 (regulatory compliance)
- Coverage: 68% (below threshold)
- Complexity: 20 (compliance rules engine)
- Dependencies: 5 (audit log, database, notification)
- Triggers: Risk > 0.60, Coverage < 80%, Compliance implications
- Decision: HUMAN
- Assigned: Compliance Officer + CTO
- Review SLA: 14 days
- Board Review: YES (legal/compliance)
### Category-Specific Patterns
**Coordination Skills:**
- Auto: Risk ≤ 0.25, No external calls, Coverage ≥ 95%
- Escalate: Risk 0.26-0.50, Redis/local services, Coverage ≥ 85%
- Human: Risk > 0.50, Multi-system, Coverage < 80%
**Infrastructure Skills:**
- Auto: Simple utilities, No database access, Coverage ≥ 95%
- Escalate: Docker/Kubernetes changes, PostgreSQL queries, Coverage ≥ 80%
- Human: Distributed system changes, Schema changes, Coverage < 80%
**Security Skills:**
- Auto: Validation logic, No credential handling, Coverage ≥ 95%
- Escalate: Encryption wrappers, API key management, Coverage ≥ 85%
- Human: Auth system changes, Compliance changes, Coverage < 90%
**Testing Skills:**
- Auto: Test runners, Assertions, Coverage ≥ 90%
- Escalate: Custom test frameworks, CI/CD integration, Coverage ≥ 80%
- Human: Credential injection in tests, Agent mocking systems, Coverage < 80%
**Foundation Skills:**
- Auto: Logging, Echo wrappers, Config readers, Coverage ≥ 95%
- Escalate: Complex utilities, Multiple dependencies, Coverage ≥ 90%
- Human: Core utilities affecting other skills, Coverage < 85%
---
## TDD Integration
### Test Coverage Requirements by Approval Level
#### Auto-Approval
- Minimum coverage: **95%**
- Test pass rate: **100%** (no failures allowed)
- Coverage must include:
- Happy path (main functionality)
- Error cases (invalid input)
- Edge cases (boundary conditions)
- Timeout scenarios (if applicable)
- Coverage gaps allowed: None
- Report format: Line coverage + branch coverage
#### Escalated Review
- Minimum coverage: **80%**
- Test pass rate: **98%+** (max 1 failure per 50 tests)
- Coverage must include:
- Core functionality paths
- Major error cases
- Common edge cases
- Integration points
- Coverage gaps allowed: < 20% for non-critical paths
- Expert validates coverage adequacy during review
#### Human Approval
- Minimum coverage: **None** (can be < 50%)
- Test pass rate: No minimum
- Coverage quality evaluated by:
- Test comprehensiveness
- Critical path coverage
- Maintainability of tests
- Test documentation
- Human reviewer determines adequacy
- Plan for test improvement may be required
### Test Execution Integration
**Before Approval Submission:**
```bash
# Run test suite and capture results
./test.sh > test_results.json 2>&1
# Extract coverage metrics
coverage_pct=$(grep 'coverage:' test_results.json | awk '{print $2}')
# Determine approval level based on coverage + risk
if [[ $(echo "$coverage_pct >= 0.95" | bc) -eq 1 ]]; then
approval_level="auto"
elif [[ $(echo "$coverage_pct >= 0.80" | bc) -eq 1 ]]; then
approval_level="escalate"
else
approval_level="human"
fi
```
**Recording Test Results in Database:**
```sql
-- Insert into approval_history
INSERT INTO approval_history (
skill_id,
version,
approval_level,
approver,
decision,
test_results
) VALUES (
1,
'2.1.0',
'escalate',
'system',
'escalated',
json_object(
'pass_count', 45,
'fail_count', 0,
'pass_rate', 1.0,
'coverage_pct', 88,
'test_duration_sec', 12.4
)
);
```
---
## Escalation Triggers
### Automatic Escalation Rules
**Rule 1: Security Sensitivity**
- Any skill handling credentials/secrets
- Any skill modifying audit trails
- Any skill changing access controls
- Result: ESCALATE or HUMAN (auto-escalate to expert)
**Rule 2: External Service Dependencies**
- Redis/Memcached connections
- PostgreSQL/MySQL database access
- AWS/cloud provider API calls
- Third-party API integrations
- Result: ESCALATE (expert review required)
**Rule 3: Test Coverage Below Threshold**
- Coverage 50-79%: ESCALATE
- Coverage < 50%: HUMAN
- Result: Expert determines if acceptable for use case
**Rule 4: Complexity Threshold**
- Cyclomatic complexity 6-15: ESCALATE
- Cyclomatic complexity > 15: HUMAN
- Result: Expert validates that complexity is justified
**Rule 5: Cross-Team Dependencies**
- Any skill used by 3+ teams
- Any skill in critical path for multiple systems
- Any skill affecting deployment pipeline
- Result: ESCALATE or HUMAN (impact analysis required)
**Rule 6: Production Environment Changes**
- Database schema modifications
- Infrastructure configuration changes
- Log level/retention policy changes
- Result: HUMAN (requires coordination)
---
## Category-Specific Criteria
### Coordination Skills
**Purpose:** Enable multi-agent orchestration and synchronization
**Auto-Approval Criteria:**
- Risk ≤ 0.25
- Coverage ≥ 95%
- Complexity ≤ 5
- Only signal-based communication (no API calls)
- No database access
**Example:** `cfn-coordination-protocol-v1` - Pure signal-based blocking mechanism
**Escalation Criteria:**
- Risk 0.26-0.50
- Coverage ≥ 85%
- Uses Redis/local coordination services
- Single system integration
**Example:** `cfn-redis-coordination-v2` - Redis-backed coordination with state management
**Human Approval Criteria:**
- Risk > 0.50
- Coverage < 80%
- Multi-system orchestration
- Changes to CFN Loop semantics
**Example:** `cfn-orchestration-v3-enhanced` - Redesigned orchestration system
### Infrastructure Skills
**Purpose:** Manage system resources, deployment, and operations
**Auto-Approval Criteria:**
- Risk ≤ 0.30
- Coverage ≥ 95%
- Complexity ≤ 5
- No database schema changes
- No credential handling
**Example:** `cfn-docker-helper` - Docker command wrapper
**Escalation Criteria:**
- Risk 0.31-0.60
- Coverage ≥ 80%
- Kubernetes/Docker changes
- Database query (read-only)
- Environment configuration
**Example:** `cfn-postgres-connection-pool` - Connection management
**Human Approval Criteria:**
- Risk > 0.60
- Coverage < 80%
- Database schema changes
- Distributed system changes
- Compliance implications
**Example:** `cfn-event-bus-distributed` - Distributed messaging system
### Security Skills
**Purpose:** Handle authentication, authorization, and secure operations
**Auto-Approval Criteria:**
- Risk ≤ 0.25
- Coverage ≥ 95%
- Complexity ≤ 5
- Validation/sanitization logic only
- No credential creation/storage
**Example:** `cfn-input-validator` - Safe input validation
**Escalation Criteria:**
- Risk 0.31-0.60
- Coverage ≥ 85%
- Encryption wrappers
- API key management (read-only)
- Permission checking
**Example:** `cfn-secure-agent-spawning` - Secure process creation
**Human Approval Criteria:**
- Risk > 0.60
- Coverage < 80%
- Credential storage/generation
- Auth system changes
- Compliance/regulatory implications
**Example:** `cfn-compliance-audit-system` - Regulatory compliance system
### Testing Skills
**Purpose:** Enable reliable test execution and validation
**Auto-Approval Criteria:**
- Risk ≤ 0.25
- Coverage ≥ 95%
- Complexity ≤ 5
- No test side effects
- No credential injection
**Example:** `cfn-test-runner` - Basic test execution wrapper
**Escalation Criteria:**
- Risk 0.31-0.60
- Coverage ≥ 80%
- Custom test framework
- Integration with CI/CD
- Mock object generation
**Example:** `cfn-mock-agent-system` - Agent mocking framework
**Human Approval Criteria:**
- Risk > 0.60
- Coverage < 80%
- Credential injection in tests
- Test database population
- Compliance test requirements
**Example:** `cfn-compliance-test-suite` - Regulatory testing
### Foundation Skills
**Purpose:** Bootstrap system with core utilities
**Auto-Approval Criteria:**
- Risk ≤ 0.20 (most restrictive)
- Coverage ≥ 95%
- Complexity ≤ 5
- No external dependencies
- No state modification
**Example:** `cfn-logging-utility` - Safe logging wrapper
**Escalation Criteria:**
- Risk 0.21-0.45
- Coverage ≥ 90%
- Limited external dependencies
- Used by multiple skills
**Example:** `cfn-json-parser` - JSON parsing utility
**Human Approval Criteria:**
- Risk > 0.45
- Coverage < 80%
- Core infrastructure change
- Affects skill loading
- System bootstrap changes
**Example:** `cfn-skill-registry-v2` - Skills database initialization
---
## Approval Criteria Database Schema
### Storing Approval Criteria
```sql
-- Define criteria for auto-approved coordination skills
INSERT INTO approval_criteria_templates (
approval_level,
category,
criteria_json,
description,
enabled
) VALUES (
'auto',
'coordination',
json_object(
'risk_score_max', 0.3,
'test_coverage_min', 0.95,
'complexity_max', 'low',
'external_dependencies', false,
'requires_security_review', false,
'cyclomatic_complexity_max', 5,
'allowed_file_system_access', 'skill_directory_only'
),
'Auto-approve simple coordination skills with high test coverage and no external dependencies',
1
);
-- Define criteria for escalated infrastructure skills
INSERT INTO approval_criteria_templates (
approval_level,
category,
criteria_json,
description,
enabled
) VALUES (
'escalate',
'infrastructure',
json_object(
'risk_score_min', 0.31,
'risk_score_max', 0.6,
'test_coverage_min', 0.80,
'complexity_min', 'medium',
'complexity_max', 'high',
'allowed_external_services', ['redis', 'postgres', 'docker'],
'requires_security_review', true,
'requires_infrastructure_review', true,
'expert_email', 'infrastructure@example.com'
),
'Escalated review for medium-risk infrastructure changes',
1
);
```
### Querying for Approval Level
```sql
-- Determine approval level for a new skill
SELECT
s.id,
s.name,
s.category,
CASE
WHEN s.test_coverage >= 0.95
AND json_extract(s.approval_criteria, '$.risk_score') <= 0.30
AND json_extract(s.approval_criteria, '$.complexity_score') <= 5
THEN 'auto'
WHEN s.test_coverage >= 0.80
AND json_extract(s.approval_criteria, '$.risk_score') <= 0.60
THEN 'escalate'
ELSE 'human'
END as recommended_approval_level
FROM skills s
WHERE s.status = 'active'
ORDER BY s.created_at DESC;
```
---
## Summary
The three-tier approval system ensures:
1. **Efficiency:** 80%+ of skills auto-approved in < 5 seconds
2. **Quality:** Risk-based routing ensures appropriate review levels
3. **Scalability:** Human experts review only high-risk skills
4. **Compliance:** Complete audit trail of all decisions
5. **Flexibility:** Category-specific criteria for domain expertise
6. **Continuous Improvement:** TDD integration drives test coverage
By following these detailed criteria and rubrics, expert reviewers can consistently make informed approval decisions that balance speed, quality, and risk management.