Renata protected draft pilot planning
Draft Pilot Staff Review Write Design
Purpose
This page defines future reviewer actions, lane transitions, revision requests, safety blocks, private holds, escalation, Morning Sheet eligibility marking, request and response boundaries, validation rules, role gates, audit requirements, and prohibited behaviors for a possible future pull-up/push-up draft pilot.
It is planning-only. It creates no protected API routes, no protected live routes, no review endpoints, no staff decisions, no database reads, no database writes, no drafts, no accounts, and no live workflows.
Current Staff Review Write Boundary
Design status
planning-only
Staff review write status
not-implemented
Go / no-go
no-go
Review endpoints
not-created
Staff decisions
not-created
Database writes
not-implemented
Why Staff Review Write Design Comes Before Review Writes
Staff review writes would change sensitive review lane, revision, visibility, retention, deletion, and audit state. They must be designed before any endpoint file, handler, protected API route, D1 query, review record, or staff decision exists.
Future review write behavior remains blocked until reviewer permission, actor, role mapping, draft visibility, staff review, Morning Sheet visibility, retention, deletion, audit, escalation, AI-use, rollback, incident, schema, and staff/privacy gates are approved.
Future Staff Review Write Actions
These actions are future-only metadata. No lane moves, staff decisions, approvals, rejections, review records, or Morning Sheet placement happen in this phase.
| Future action | Purpose | Role | Status | Reason blocked |
|---|---|---|---|---|
request_revision | future staff action requesting safer language or clearer accountability/recognition | approved staff reviewer | not-implemented | reviewer permissions, draft storage, review write policy, retention policy, audit policy, and staff/privacy approval are not active |
hold_private | future staff action keeping a draft private and out of public Morning Sheet consideration | approved staff reviewer | not-implemented | private feedback policy, retention policy, reviewer permission policy, and audit policy are not active |
block_public_reading | future staff action blocking public reading due to privacy/safety risk | approved staff reviewer | not-implemented | safety block policy, visibility policy, retention/deletion policy, and audit policy are not active |
escalate_to_staff_policy | future staff action routing the draft to policy/escalation handling | approved staff reviewer | not-implemented | escalation policy, reviewer permission policy, incident policy, and audit policy are not active |
mark_eligible_for_morning_sheet_consideration | future staff action marking a draft as eligible for consideration, not automatic placement | approved staff reviewer or program admin under policy | not-implemented | Morning Sheet visibility policy, staff/privacy approval, and placement boundary policy are not active |
archive_without_public_use | future staff action archiving a draft without public use under approved retention policy | approved staff reviewer under retention policy | not-implemented | archive policy, retention/deletion policy, and audit policy are not active |
delete_under_retention_policy | future staff action requesting deletion under approved retention/deletion policy | approved staff reviewer under deletion policy | not-implemented | deletion policy, permanent deletion policy, rollback/incident policy, and audit policy are not active |
Future Staff Review Write Endpoints
These endpoint contracts are future-only metadata. No endpoint files are created, no handlers are created, no runtime API behavior is added, and no D1 reads or writes occur.
| Future endpoint | Purpose | Role | Status | Reason blocked |
|---|---|---|---|---|
POST /api/protected/review/:id/request-revision | future request revision endpoint | approved staff reviewer | not-implemented | no endpoint files, handlers, D1 reads, D1 writes, review records, or audit writes exist |
POST /api/protected/review/:id/hold-private | future hold-private endpoint | approved staff reviewer | not-implemented | private hold policy, retention/deletion policy, and audit write policy are not active |
POST /api/protected/review/:id/block-public-reading | future block public reading endpoint | approved staff reviewer | not-implemented | safety block policy, Morning Sheet visibility policy, review writes, and audit writes are not implemented |
POST /api/protected/review/:id/escalate | future escalation endpoint | approved staff reviewer | not-implemented | escalation policy, incident policy, reviewer permission policy, and audit writes are not active |
POST /api/protected/review/:id/mark-morning-sheet-eligible | future Morning Sheet eligibility marking endpoint | approved staff reviewer or program admin under policy | not-implemented | eligibility policy, visibility policy, and staff/privacy approval are not active |
POST /api/protected/review/:id/archive | future archive without public use endpoint | approved staff reviewer under retention policy | not-implemented | archive policy, retention/deletion policy, and audit policy are not active |
POST /api/protected/review/:id/delete-under-policy | future delete under retention policy endpoint | approved staff reviewer under deletion policy | not-implemented | deletion policy, rollback/incident policy, and audit policy are not active |
Request Safety Boundaries
Allowed future request categories
- draft ref
- reviewer actor ref
- review lane transition
- revision reason code
- safety block reason code
- private hold reason code
- escalation reason code
- Morning Sheet eligibility reason code
- retention/deletion policy reference
- minimal audit reason code
Prohibited request categories
- real names
- emails
- phone numbers
- addresses
- room numbers
- case numbers
- Cloudflare Access claims
- JWTs
- tokens
- raw identity headers
- resident profile data
- staff profile data
- diagnosis details
- medication details
- legal case details
- insurance details
- trauma details unless explicitly approved under future policy
- attendance data
- participation data
- participation analytics
- scoring/ranking/compliance metrics
- AI-generated staff decisions
- automatic approval requests
- automatic rejection requests
- automatic Morning Sheet placement requests
- freeform staff gossip
- clinical interpretation
- discipline recommendations
Response Safety Boundaries
Allowed future response categories
- success/failure status
- draft ref
- review lane status
- visibility status
- revision request status
- escalation status
- retention/deletion status
- minimal audit event ref
- safe validation messages
Prohibited response categories
- real identity
- Cloudflare claims
- hidden staff notes
- private feedback not visible to requester
- other residents' drafts
- staff-only review data unless requester is authorized
- scoring/ranking/participation/compliance data
- clinical interpretation
- discipline recommendation
- emails
- JWTs
- tokens
- raw identity headers
Reviewer Permission And Actor Gates
| Reviewer permission gate | Actor / identity boundary | Draft visibility gate |
|---|---|---|
| reviewer has approved pseudonymous actor ref | reviewer actor ref is pseudonymous and conceptual until actor storage is approved | draft exists under approved storage policy |
| reviewer has approved staff reviewer role mapping | draft author and subject actor refs remain pseudonymous only | draft is in a reviewable status |
| reviewer has approved workflow scope | no Cloudflare Access email, name, group, JWT, token, or raw header is accepted or returned | reviewer may see only categories approved by draft visibility policy |
| reviewer can only act within approved staff review policy | no real user, resident, or staff profile is linked in this phase | subject visibility remains blocked until staff/privacy policy approves it |
| reviewer cannot expose identity claims | identity mapping remains blocked | private feedback and hidden staff notes are not returned unless future policy explicitly allows them |
| reviewer cannot convert review data into tracking, scoring, discipline, or clinical interpretation | no additional actor boundary | no additional visibility gate |
Validation Rules
- protected access boundary
- approved reviewer actor ref
- approved staff reviewer role mapping
- approved workflow scope
- draft exists under approved storage policy
- draft is in a reviewable status
- action is allowed from current lane/status
- content safety policy is satisfied
- identity/sensitive field rejection
- Morning Sheet visibility dependency
- retention/deletion policy
- audit policy
- escalation policy
- rollback/incident policy
- no AI-generated decision unless future AI-use policy explicitly approves it
Failure Modes
missing reviewer actor refinvalid reviewer actor refreviewer lacks future permissiondraft not founddraft not reviewableinvalid lane transitionprohibited identity contentprohibited sensitive contentunsafe pull-up languageunsafe push-up languageMorning Sheet policy missingretention policy missingaudit policy missingescalation policy missingattempted automatic approvalattempted automatic rejectionattempted automatic Morning Sheet placementattempted AI-generated staff decisionrequester not authorized
Required Gates Before Implementation
- Cloudflare Access boundary approved
- identity policy approved
- pseudonymous actor policy approved
- account role mapping policy approved
- draft content policy approved
- staff review procedure approved
- reviewer permission policy approved
- staff review write policy approved
- Morning Sheet visibility policy approved
- retention policy approved
- deletion policy approved
- audit policy approved
- escalation policy approved
- rollback/incident policy approved
- AI-use policy resolved
- D1 schema activated under approved migration
- protected API route policy approved
- staff/privacy approval complete
- small pilot group approved
Blocked Capabilities
protected API routesprotected live routesreview endpointsreview writesstaff decisionsstaff approval recordsstaff rejection recordsreview decision recordsPOST handlersPATCH handlersDELETE handlersD1 queriesdatabase readsdatabase writesactive migrationsexecutable SQL fileslive review queue behaviorlive draft collectionlive submissionsdraft storageaccount storageactor storageidentity capturerole assignmentMorning Sheet placementretention/deletion jobsaudit logging writesattendance trackingparticipation trackingparticipation analyticsscoring/ranking/compliance metrics
Recommended Next Phase
Phase 9.7 - Draft Pilot Activation Readiness
After staff review write design, the next safe planning step is an activation readiness review that still creates no review endpoints, decisions, protected API routes, database reads, database writes, draft storage, Morning Sheet placement, tracking, analytics, or scoring.
Boundaries: no protected API routes; no protected live routes; no review endpoints; no review writes; no staff decisions; no D1 queries; no database reads; no database writes; no active migrations; no draft storage; no account storage; no actor storage; no identity capture; no Morning Sheet placement; no tracking; no analytics; no scoring.
recommended-next