# Jieyao Milestonehub Auditable Aw Aaw Sop

> AAW Standard Operating Procedures

- Skill: `tomevault-io/jieyao-milestonehub-auditable-aw-aaw-sop` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/jieyao-milestonehub-auditable-aw-aaw-sop`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/jieyao-milestonehub-auditable-aw-aaw-sop/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/jieyao-milestonehub-auditable-aw-aaw-sop

---


# AAW Standard Operating Procedures

This skill ensures all code changes follow the auditable workflow required by enterprise compliance.

## Core Principle

All code changes MUST follow the auditable workflow:

```
/aaw-plan → /aaw-implement → /aaw-test → /aaw-evidence
```

## Workflow Requirements

### Phase 1: Planning (Required)

Before ANY code change:

1. Start an audit session with `mcp__aawctl__start_session`
2. Read and understand policy with `mcp__aawctl__read_policy`
3. Create a detailed implementation plan
4. Get user approval before proceeding

**Never skip planning.** Even small changes need documentation.

### Phase 2: Implementation (Required)

During code changes:

1. Use `mcp__aawctl__exec` for ALL shell commands
2. Never use direct Bash tool
3. Provide clear `purpose` for each execution
4. Follow scope-specific policies
5. Document any deviations from the plan

### Phase 3: Testing (Required)

After implementation:

1. Run tests via `mcp__aawctl__run_tests`
2. Capture test artifacts via `mcp__aawctl__capture_artifact`
3. Do not proceed if tests fail - report and wait for decision

### Phase 4: Evidence (Required)

After successful testing:

1. Generate evidence bundle via `mcp__aawctl__bundle_evidence`
2. Provide bundle location to user
3. Bundle must be reviewed before deployment

## Policy Hierarchy

```
Global Policy: /aaw.policy.yaml
     ↓
Package Policy: packages/{name}/aaw.policy.yaml
     ↓
(Package policy extends global, can only be MORE restrictive)
```

## Audit ID

Every session has an `audit_id`. This ID:

- Links all actions in a session
- Must be passed between phases
- Is included in the evidence bundle
- Should be referenced in commit messages

## Compliance Checklist

Before marking any task complete, verify:

- [ ] Audit session was started
- [ ] Policy was checked
- [ ] All commands went through aawctl
- [ ] Tests were run and passed
- [ ] Evidence bundle was generated

---
> Converted and distributed by [TomeVault](https://tomevault.io/claim/jieyao-milestonehub) — claim your Tome and manage your conversions.
<!-- tomevault:4.0:skill_md:2026-04-13 -->