Renata protected draft pilot planning
Draft Pilot Evidence Package
Purpose
The evidence package organizes planning artifacts, unresolved gates, safety boundaries, staff/privacy questions, technical evidence, and go/no-go requirements before any live draft pilot implementation can begin.
It is planning-only. It creates no protected live routes, no protected API routes, no handlers, no D1 queries, no database reads, no database writes, no active migrations, no drafts, no accounts, no staff decisions, and no live workflows.
Current No-Go Status
Package status
planning-only
Review status
ready-for-staff-privacy-review
Implementation status
not-started
Live pilot decision
no-go
Protected API routes
not-created
Active schema
not-created
Evidence Package Summary
This package is ready for staff/privacy review because it organizes the planning record and unresolved questions. It is not a readiness approval and does not authorize implementation.
| Category | Status | Evidence summary | Unresolved blockers | Staff/privacy questions |
|---|---|---|---|---|
| product-purpose | evidence-packaged | Explains why the draft pilot exists, what pull-up/push-up drafts are meant to address, and what the workflow must not become. | staff/privacy approval is not complete; small pilot scope is not approved; live pilot support procedure is not defined | What resident-support problem should the pilot solve?; What outcomes would make the pilot inappropriate to continue?; How should staff explain that the pilot is not discipline, scoring, or surveillance? |
| access-boundary | evidence-packaged | Documents Cloudflare Access as an outer boundary only and confirms identity claims are not returned, displayed, logged, stored, or mapped to roles. | Cloudflare Access boundary approval is not recorded; identity policy is not approved; protected runtime policy is not approved | Should any app surface ever see identity values?; What proof is required that Cloudflare claims stay outside the app data model? |
| actor-and-role-model | evidence-packaged | Packages pseudonymous actor reference planning and account role mapping planning while keeping live actor storage and role storage absent. | pseudonymous actor policy is not approved; role mapping policy is not approved; actor storage is not implemented; role mapping storage is not implemented | Who can receive a pseudonymous actor reference?; Who can be mapped to a reviewer role?; How should actor references be revoked? |
| draft-content-policy | evidence-packaged | Summarizes pull-up/push-up draft schema planning, treats draft_body as future-sensitive, and confirms draft storage is not active. | draft content policy is not approved; pull-up safety policy is not approved; push-up recognition policy is not approved; retention/deletion policy is not implemented | May any real draft body be stored?; What content must be blocked before storage?; How should pull-ups remain repair-oriented rather than punitive? |
| staff-review-policy | evidence-packaged | Packages review lanes, allowed future outcomes, prohibited outcomes, and reviewer boundaries while keeping staff decisions inactive. | staff review procedure is not approved; reviewer permission policy is not approved; review writes are not implemented; audit implementation is not active | Who may review drafts?; What reviewer permissions are required?; Which staff actions require escalation? |
| morning-sheet-visibility | evidence-packaged | Packages Morning Sheet visibility rules and confirms no live Morning Sheet placement or automatic public visibility exists. | Morning Sheet visibility policy is not approved; subject consent boundary is unresolved; public visibility remains disabled | Is subject notification required?; Is subject consent required before public visibility?; What content should remain private-only? |
| retention-and-deletion | evidence-packaged | Summarizes retention categories, deletion rules, and minimization boundaries while confirming no retention or deletion jobs are active. | retention policy is not approved; deletion policy is not approved; permanent deletion policy is not approved; retention/deletion jobs are not implemented | What is the retention window for drafts?; What is the retention window for private feedback?; What deletion rights should draft authors have? |
| audit-logging | evidence-packaged | Packages minimal audit logging policy planning and confirms no audit writes, audit tables, or audit reconstruction of sensitive content exists. | audit policy is not approved; audit visibility policy is not approved; audit logging writes are not implemented | Who may see audit metadata?; What audit metadata is necessary and minimal?; What audit content must never preserve deleted drafts? |
| schema-and-migration | evidence-packaged | Collects the local-only migration draft and validation harness evidence while confirming no active migrations, D1 tables, SQL execution, or D1 targeting exists. | D1 schema package is not approved; active migration plan is not approved; active D1 schema is not implemented; rollback plan is not approved | Does the draft schema exclude identity and tracking fields?; What evidence is needed before any active migration?; What rollback evidence is required? |
| read-write-runtime | evidence-packaged | Packages read runtime planning, write endpoint design, and staff review write design while confirming no protected routes, APIs, handlers, reads, or writes exist. | protected read route policy is not approved; protected API response policy is not approved; protected write endpoint policy is not approved; protected live routes and API routes are not implemented | What read surfaces are acceptable for the first pilot?; What data must never be returned from an API?; What failure modes must block writes? |
| activation-readiness | evidence-packaged | Consolidates the activation readiness no-go decision and the required evidence before implementation can begin. | readiness remains not-ready-for-live-activation; implementation status remains not-started; live pilot decision remains no-go | What evidence would change the no-go decision?; Who signs off before implementation can begin?; How will staff stop or roll back a pilot? |
Planning Artifact Inventory
Every artifact below is planning evidence. None is implementation-complete.
| Artifact | Route | Planning status | Implementation status | Safety contribution | Remaining blocker |
|---|---|---|---|---|---|
| Account Workflow Gate Review | /protected-preview/account-workflow-gate-review/ | planning-complete | not-implemented | establishes account and workflow gates before any live account or draft workflow | identity, actor, role, draft, review, retention, audit, and privacy gates are unresolved |
| Cloudflare Access Claim Boundary Review | /protected-preview/access-claim-boundary/ | planning-complete | not-implemented | keeps Access claims outside returned, stored, logged, or role-mapped data | identity policy and protected runtime approval are missing |
| Actor Reference Schema Planning | /protected-preview/actor-reference-schema/ | planning-complete | not-implemented | plans pseudonymous actor refs without actor storage | pseudonymous actor policy and storage approval are missing |
| Account Role Mapping Schema Planning | /protected-preview/account-role-mapping-schema/ | planning-complete | not-implemented | plans role mappings without live role assignment | role mapping policy, actor refs, and audit policy are missing |
| Pull-Up / Push-Up Draft Schema Planning | /protected-preview/pullup-pushup-draft-schema/ | planning-complete | not-implemented | plans future draft fields while treating draft_body as future-sensitive | draft content, retention/deletion, and privacy approvals are missing |
| Staff Review Procedure Planning | /protected-preview/staff-review-procedure/ | planning-complete | not-implemented | defines review lanes and prohibited outcomes before staff decisions | reviewer permissions, review storage, and audit implementation are missing |
| Morning Sheet Visibility Policy Planning | /protected-preview/morning-sheet-visibility-policy/ | planning-complete | not-implemented | keeps Morning Sheet visibility gated and non-automatic | visibility approval, consent boundary, and review implementation are missing |
| Retention and Deletion Policy Planning | /protected-preview/retention-deletion-policy/ | planning-complete | not-implemented | defines minimization, retention, and deletion boundaries before storage | retention/deletion policy approval and implementation are missing |
| Audit Logging Policy Planning | /protected-preview/audit-logging-policy/ | planning-complete | not-implemented | plans minimal audit metadata without sensitive content by default | audit policy, audit visibility, and audit implementation are missing |
| Draft Pilot Architecture Package | /protected-preview/draft-pilot-architecture-package/ | planning-complete | not-implemented | maps implementation dependencies while keeping pilot no-go | evidence and approvals are missing |
| Draft Pilot Implementation Plan | /protected-preview/draft-pilot-implementation-plan/ | planning-complete | not-implemented | orders future phases without creating routes, APIs, writes, or schemas | schema activation and policy gates are unresolved |
| Draft Pilot Schema Activation Review | /protected-preview/draft-pilot-schema-activation-review/ | planning-complete | not-implemented | keeps schema activation do-not-activate | active migration evidence and staff/privacy approval are missing |
| Draft Pilot Local Migration Draft | /protected-preview/draft-pilot-local-migration-draft/ | planning-complete | not-implemented | keeps draft SQL quarantined outside active migrations | active migration review and approval are missing |
| Draft Pilot Local Migration Harness | /protected-preview/draft-pilot-local-migration-harness/ | planning-complete | not-implemented | validates local-only draft labels and prohibited names without SQL execution | validation is local-only and does not activate schema |
| Draft Pilot Read Runtime Plan | /protected-preview/draft-pilot-read-runtime-plan/ | planning-complete | not-implemented | plans read visibility before protected read routes or APIs exist | active schema and protected read policy are missing |
| Draft Pilot Write Endpoint Design | /protected-preview/draft-pilot-write-endpoint-design/ | planning-complete | not-implemented | plans write boundaries without API route files or handlers | protected read runtime, retention, audit, and write policy are missing |
| Draft Pilot Staff Review Write Design | /protected-preview/draft-pilot-staff-review-write-design/ | planning-complete | not-implemented | plans staff review write boundaries without staff decisions | reviewer permissions, audit, retention, and privacy approvals are missing |
| Draft Pilot Activation Readiness Review | /protected-preview/draft-pilot-activation-readiness/ | planning-complete | not-implemented | confirms live activation remains no-go | implementation evidence and approvals are missing |
Technical Safety Evidence
- active migrations still exclude draft pilot schema activation
- draft pilot migration artifact is local-only and outside active migrations
- local migration harness validates labels, allowed table names, prohibited names, prohibited fields, and active migration isolation
- future read surfaces are metadata only and not implemented
- future write endpoints are metadata only and not implemented
- src/pages/protected and src/pages/api/protected must remain absent until explicitly approved
- no D1 reads, D1 writes, database handlers, or API route files are part of this package
Privacy Safety Evidence
- no email, name, Cloudflare claim, JWT, token, group claim, or raw identity header is returned, stored, displayed, logged, or mapped to roles
- draft_body remains future-sensitive and blocked from live storage until approval
- actor refs, subject refs, and reviewer refs remain conceptual until actor storage is approved
- no resident profiles, staff profiles, medical details, legal details, trauma details, or clinical claims are introduced
- attendance tracking, participation tracking, participation analytics, scoring, ranking, discipline points, compliance metrics, and resident performance metrics remain excluded
Staff Workflow Evidence
- staff review exists to prevent shaming, unsafe disclosure, retaliation, coercion, gossip, and public harm
- allowed future outcomes remain planning-only and do not create approvals or rejections
- Morning Sheet eligibility is not automatic and does not place drafts publicly
- private-only outcomes remain available as a future policy concept
- escalation, incident, rollback, and support procedures are required before any live pilot
Unresolved Decisions
who may submit pull-upswho may submit push-upswho may be the subject of a pull-upwho may be the subject of a push-upwhether subject notification is requiredwhether subject consent is required before public visibilitywho may review draftswhat reviewer role permissions are requiredwhat content must be blockedwhat content may remain private-onlywhat content may be considered for Morning Sheet visibilitywhether any real draft content may be storedretention window for draftsretention window for private feedbackretention window for blocked draftsdeletion rights and procedureaudit visibilityAI-use policyescalation policyincident/support procedurepilot group size and compositionrollback procedure
Required Approvals
Approvals
- staff workflow approval
- privacy approval
- identity policy approval
- pseudonymous actor policy approval
- role mapping policy approval
- draft content policy approval
- pull-up safety policy approval
- push-up recognition policy approval
- staff review procedure approval
- reviewer permission policy approval
- Morning Sheet visibility policy approval
- retention policy approval
- deletion policy approval
- audit policy approval
- escalation policy approval
- AI-use policy decision
- technical schema review
- migration review
- rollback plan approval
- small pilot approval
Technical gates
- D1 schema package reviewed
- local migration validation passed
- active migration plan approved
- protected read route policy approved
- protected API response policy approved
- protected write endpoint policy approved
- protected live route approval complete
- protected API route approval complete
- rollback plan approved
Policy gates
- identity policy approved
- pseudonymous actor policy approved
- role mapping policy approved
- draft content policy approved
- staff review procedure approved
- Morning Sheet visibility policy approved
- retention policy approved
- deletion policy approved
- audit policy approved
- AI-use policy resolved
- staff/privacy approval complete
- small pilot group approved
Prohibited shortcuts
- building forms before approval
- creating API routes before schema and policy gates
- storing identity before identity policy
- storing draft bodies before retention/deletion approval
- allowing staff decisions before audit policy
- allowing public Morning Sheet placement before visibility policy
- AI review of real drafts
- resident-wide launch
- exports
- tracking participation
- scoring/ranking/compliance metrics
- clinical claims
Staff/Privacy Review Questions
- What evidence is sufficient for staff/privacy approval?
- Which unresolved decisions block even a small pilot?
- What content must be rejected before storage?
- What content can be held private without public visibility?
- What retention windows are acceptable for draft content, private feedback, and blocked content?
- What audit metadata is necessary without becoming surveillance?
- What incident procedure stops the pilot if harm appears?
- What proof is required before moving from evidence review to a decision record?
What Remains Blocked
no live draft collectionno live submissionsno account storageno actor storageno identity captureno role assignmentno staff decisionsno Morning Sheet placementno database readsno database writesno protected live routesno protected API routesno active migrationsno attendance trackingno participation trackingno participation analyticsno scoring/ranking/compliance metricsno draft storageno staff review storageno review writesno write endpointsno read endpointsno D1 queriesno retention/deletion jobsno audit logging writesno OpenAI submission processingno user admin CRUDno role admin CRUDno workflow admin CRUDno billingno lead captureno sensitive storage
Next Planning Phase
Phase 10.21 — Staff/Privacy Review Packet Handoff Freeze, Planning Only
The staff/privacy review packet path now includes evidence, summary, decision template, walkthrough, export planning, PDF layout planning, print style planning, manual assembly, visual QA, staff handoff notes, dry-run checklist, debrief template, evidence gap register, and evidence gap review sequence. The next planning phase may freeze packet route order, review status, and handoff instructions as a no-go review artifact while keeping approvals, decisions, protected APIs, protected live routes, reads, writes, storage, and workflow activation blocked.
Boundaries: no export generation; no download artifacts; no live pilot; no protected live routes; no protected API routes; no database reads; no database writes; no active migrations; no draft storage; no account storage; no actor storage; no identity capture; no staff decisions; no Morning Sheet placement; no tracking; no analytics; no scoring.
recommended-next