Renata protected draft pilot planning
Protected Draft Pilot Implementation Plan
Purpose
This page translates the Phase 8 planning stack into an ordered future build plan for protected draft pilot routes, data layers, API boundaries, permissions, review workflow, storage gates, retention gates, audit gates, and pilot sequence.
It is planning only. It creates no routes outside this protected preview, no API handlers, no tables, no SQL files, no migrations, no draft storage, no staff decisions, and no live workflows.
Current Readiness Status
Plan status
planning-only
Decision
no-go
Readiness
not-ready-for-live-implementation
Phase 8 planning is consolidated, but no approved identity policy, actor storage, role mapping storage, draft storage, staff review storage, retention/deletion implementation, audit logging implementation, D1 schema, active migrations, write endpoints, or staff/privacy approval exists.
Why Implementation Planning Comes Before Implementation
Future draft collection would touch actor references, role permissions, sensitive draft content, staff review, Morning Sheet visibility, retention/deletion, and audit metadata. Planning the order first keeps live write paths blocked until policy, schema, migration, rollback, privacy, and pilot evidence exists.
Future Implementation Phases
| Phase | Purpose | Status | Risk | Gates required | Prohibited shortcuts |
|---|---|---|---|---|---|
| Phase 9.1 - Draft Pilot Schema Activation Review | Decide whether planned schemas can move toward active migration without activating a migration yet. | future-planned | high | identity policy approved; pseudonymous actor policy approved; D1 schema reviewed; staff/privacy approval complete | active migration; D1 table creation; write endpoint implementation; draft storage |
| Phase 9.2 - Draft Pilot Local Migration Draft | Create a local-only SQL draft for actor refs, role mapping, draft records, review refs, retention markers, and audit metadata. | future-planned | high | schema activation review passed; rollback plan drafted; prohibited field scan defined | active migration; production or preview D1 targeting; wrangler execution; runtime queries |
| Phase 9.3 - Draft Pilot Local Migration Harness | Validate the local-only migration draft without targeting D1. | future-planned | medium | local-only artifact approved; validator rules approved; disposable local target approved | D1 targeting; network calls; package scripts that run SQL; app runtime writes |
| Phase 9.4 - Draft Pilot Protected Read Runtime Plan | Plan protected read-only runtime paths before any write path exists. | future-planned | medium | Cloudflare Access boundary reviewed; read-only runtime boundary approved; identity claim exposure review passed | write handlers; identity return values; role assignment; draft mutation |
| Phase 9.5 - Draft Pilot Write Endpoint Design | Design POST boundaries for future draft intake without implementing handlers. | future-planned | high | draft content policy approved; retention policy approved; audit policy approved; small pilot approved | endpoint implementation; live draft collection; identity storage; AI processing of real drafts |
| Phase 9.6 - Draft Pilot Staff Review Write Design | Design review write boundaries for future staff review without implementing review writes. | future-planned | high | staff review procedure approved; reviewer permission policy approved; audit visibility policy approved | approve/reject controls; staff decision records; automatic decisions; Morning Sheet placement |
| Phase 9.7 - Draft Pilot Activation Readiness | Run a final go/no-go review before any live pilot write path. | future-planned | critical | migration plan approved; rollback plan approved; staff/privacy approval complete; support/incident procedure defined | pilot start without evidence; resident-wide rollout; public placement on day one; tracking or scoring |
Future Route Plan
| Route | Purpose | Type | Role | Sensitivity | Status | Blocked reason |
|---|---|---|---|---|---|---|
/protected/drafts/new | Future draft intake screen for pull-up or push-up drafts. | protected-page | approved-pilot-author | future-sensitive draft content | not-implemented | Draft collection and write paths are not approved. |
/protected/drafts/:id | Future read view for a protected draft record. | protected-page | approved-pilot-participant | future-sensitive draft metadata and content | not-implemented | Draft records and read runtime are not implemented. |
/protected/drafts/:id/review | Future staff review detail view for a draft. | protected-page | approved-reviewer | future-sensitive review metadata | not-implemented | Staff review storage and permissions are not implemented. |
/protected/staff/review-queue | Future staff review queue for drafts requiring review. | protected-page | approved-reviewer | future-sensitive queue metadata | not-implemented | Live review queue behavior is not approved. |
/protected/morning-sheet/candidates | Future staff-only candidate list for Morning Sheet consideration. | protected-page | approved-reviewer | future-sensitive visibility metadata | not-implemented | Morning Sheet placement and candidate workflow are not approved. |
/protected/admin/pilot-status | Future read-only pilot status view for approved operators. | protected-page | approved-operator | pilot operations metadata | not-implemented | Pilot operations model is not approved. |
These routes are future-only and are not created in Phase 9.0.
Future API Boundary Plan
| Method | Endpoint | Purpose | Role | Status | Prohibited input |
|---|---|---|---|---|---|
POST | /api/protected/drafts | Future draft creation boundary. | approved-pilot-author | not-implemented | email; real names; Cloudflare claims; medical/legal identifiers; attendance data; scoring data |
GET | /api/protected/drafts/:id | Future protected draft read boundary. | approved-pilot-participant | not-implemented | JWT; token; raw Access claims; resident profile details |
PATCH | /api/protected/drafts/:id | Future draft revision boundary before submission. | approved-pilot-author | not-implemented | identity values; staff review notes; scoring data |
POST | /api/protected/drafts/:id/submit | Future draft submission-to-review boundary. | approved-pilot-author | not-implemented | real identity; automatic approval; Morning Sheet placement |
POST | /api/protected/review/:id/decision | Future staff review decision boundary. | approved-reviewer | not-implemented | clinical interpretation; discipline automation; scoring/ranking data |
POST | /api/protected/morning-sheet/:id/mark-eligible | Future eligibility marker for staff-only Morning Sheet consideration. | approved-reviewer | not-implemented | automatic public placement; real names; public identity exposure |
POST | /api/protected/drafts/:id/delete | Future deletion request or deletion marker boundary. | approved-pilot-author-or-reviewer | not-implemented | sensitive content copied to audit logs; identity values; hidden staff misconduct |
No endpoints, write handlers, or runtime API behavior are created in this phase.
Future Data Layer Plan
| Area | Purpose | Sensitivity | Schema gate | Retention gate | Audit gate | Status |
|---|---|---|---|---|---|---|
| actor refs | Future opaque pseudonymous actor references. | identity-adjacent metadata | actor reference schema reviewed | actor retention policy approved | actor audit policy approved | not-implemented |
| account role mappings | Future scoped actor-to-role mappings. | permission metadata | account role mapping schema reviewed | role mapping retention policy approved | role mapping audit policy approved | not-implemented |
| draft records | Future pull-up/push-up draft metadata and content. | future-sensitive content | draft storage schema reviewed | draft retention policy approved | draft audit policy approved | not-implemented |
| draft subject refs | Future pseudonymous subject references for drafts. | identity-adjacent metadata | subject ref schema reviewed | subject ref retention policy approved | subject ref audit policy approved | not-implemented |
| draft status history | Future draft lifecycle transitions. | workflow metadata | status history schema reviewed | status retention policy approved | status audit policy approved | not-implemented |
| staff review refs | Future staff review lane and reviewer reference metadata. | review metadata | staff review schema reviewed | review retention policy approved | review audit policy approved | not-implemented |
| Morning Sheet visibility refs | Future staff-only eligibility and visibility metadata. | visibility metadata | visibility schema reviewed | visibility retention policy approved | visibility audit policy approved | not-implemented |
| retention/deletion markers | Future minimal markers for retention and deletion state. | policy metadata | retention marker schema reviewed | deletion policy approved | deletion audit policy approved | not-implemented |
| audit metadata | Future minimal event metadata separated from sensitive content. | minimal audit metadata | audit schema reviewed | audit retention policy approved | audit visibility policy approved | not-implemented |
Minimum Safe Pilot Architecture
- Cloudflare Access protected route family
- pseudonymous actor refs
- no real names in app UI
- small approved pilot group
- draft collection limited to pull-up/push-up only
- staff review required before visibility
- Morning Sheet placement disabled at first or staff-only preview
- no AI processing of real drafts
- short retention window
- minimal audit metadata
- deletion/rollback plan
- incident escalation path
- staff/privacy approval recorded
- future-only architecture
- not active in Phase 9.0
Blocked Capabilities
live account creationaccount storageidentity captureidentity storagelive actor mappingactor storagelive role assignmentlive draft collectionlive submissionslive staff review decisionsstaff decisionslive Morning Sheet placementMorning Sheet placementexportsAI review of real submissionsretention/deletion jobsaudit writesdatabase writesactive migrationsattendance trackingparticipation trackingparticipation analyticsscoring/ranking/compliance metricsresident performance dashboardsstaff surveillance dashboards
Required Evidence Before Implementation
- Cloudflare Access boundary approved
- identity policy approved
- pseudonymous actor policy approved
- account role mapping policy approved
- draft content policy approved
- pull-up safety policy approved
- push-up recognition policy approved
- staff review procedure approved
- reviewer permission policy approved
- Morning Sheet visibility policy approved
- retention policy approved
- deletion policy approved
- audit policy approved
- audit visibility policy approved
- escalation policy approved
- AI-use policy resolved
- D1 schema reviewed
- migration plan approved
- rollback plan approved
- staff/privacy approval complete
- small pilot group approved
- support/incident procedure defined
Recommended Next Phase
Phase 9.1 - Draft Pilot Schema Activation Review
The next safe step is reviewing whether planned schemas can move toward migration drafting while keeping active migrations, write endpoints, accounts, actor storage, draft storage, staff decisions, Morning Sheet placement, tracking, analytics, and scoring blocked.
Boundaries: no active migration; no executable SQL files; no D1 targeting; no write endpoints; no live draft collection; no accounts; no actor storage; no role assignment; no staff decisions; no Morning Sheet placement; no database writes; no tracking; no analytics; no scoring.
recommended-next