Jieyao Milestonehub Auditable Aw Aaw Sop

AAW Standard Operating Procedures

This skill ensures all code changes follow the auditable workflow required by enterprise compliance.

Core Principle

All code changes MUST follow the auditable workflow:

/aaw-plan → /aaw-implement → /aaw-test → /aaw-evidence

Workflow Requirements

Phase 1: Planning (Required)

Before ANY code change:

1. Start an audit session with mcp__aawctl__start_session
2. Read and understand policy with mcp__aawctl__read_policy
3. Create a detailed implementation plan
4. Get user approval before proceeding

Never skip planning. Even small changes need documentation.

Phase 2: Implementation (Required)

During code changes:

1. Use mcp__aawctl__exec for ALL shell commands
2. Never use direct Bash tool
3. Provide clear purpose for each execution
4. Follow scope-specific policies
5. Document any deviations from the plan

Phase 3: Testing (Required)

After implementation:

1. Run tests via mcp__aawctl__run_tests
2. Capture test artifacts via mcp__aawctl__capture_artifact
3. Do not proceed if tests fail - report and wait for decision

Phase 4: Evidence (Required)

After successful testing:

1. Generate evidence bundle via mcp__aawctl__bundle_evidence
2. Provide bundle location to user
3. Bundle must be reviewed before deployment

Policy Hierarchy

Global Policy: /aaw.policy.yaml
     ↓
Package Policy: packages/{name}/aaw.policy.yaml
     ↓
(Package policy extends global, can only be MORE restrictive)

Audit ID

Every session has an audit_id. This ID:

• Links all actions in a session
• Must be passed between phases
• Is included in the evidence bundle
• Should be referenced in commit messages

Compliance Checklist

Before marking any task complete, verify:

• Audit session was started
• Policy was checked
• All commands went through aawctl
• Tests were run and passed
• Evidence bundle was generated

Converted and distributed by TomeVault — claim your Tome and manage your conversions.