Role Set Template Migration Harness Review

Purpose

This page documents the local-only harness scaffold that validates the markdown-wrapped draft artifact and safety boundaries before any future disposable local SQL dry run is considered.

The harness reads local files, prints a validation summary, and exits with a status code. It does not execute SQL, target D1, create tables, create reports, write files, or enable CRUD.

Harness Status

Status

local-only-validation-harness

Active

false

inactive

Executable SQL

false

disabled

SQL Executed

false

not-executed

D1 Targeted

false

not-targeted

Writes Enabled

false

disabled

Harness Script Location

scripts/local/validate-role-set-template-migration-draft.mjs

Local validation only. No package script, wrangler wrapper, runtime endpoint, or migration control is added.

Draft Artifact Location

docs/architecture/migration-drafts/role-set-template-config-draft.sql.md

The draft remains outside the active migrations folder and remains documentation-wrapped.

Validation Checks

draft artifact exists
draft artifact is outside active migrations folder
draft artifact is labeled local-only
draft artifact says do not run
draft artifact contains only allowed role-set template config table names
draft artifact does not contain user/account/resident/staff/identity table names
draft artifact does not contain submission/pullup/pushup/staff-decision table names
draft artifact does not contain attendance/participation/analytics/scoring/ranking/compliance table names
draft artifact does not contain email fields
draft artifact does not contain phone/address fields
draft artifact does not contain medical/legal/trauma/insurance fields
draft artifact does not contain credential-like strings
active migrations folder contains only approved active migrations
no package script executes the draft
no wrangler migration execution script exists
no D1 write endpoint exists for role-set templates

Prohibited Names And Fields

Allowed table names	Prohibited names	Prohibited fields
future_role_set_templates; future_role_definitions; future_role_permission_mappings; future_role_set_template_versions; future_role_set_template_audit_events; future_role_set_template_status_history	users; accounts; residents; staff; identities; submissions; pullups; pushups; staff_decisions; attendance; participation; analytics; scoring; ranking; compliance	email; phone; address; real_name; resident_name; staff_name; medical_details; legal_details; trauma_details; insurance_details; attendance_data; participation_data; participation_analytics; scoring_data; ranking_data; discipline_points; compliance_metrics; submission_content; pullup_content; pushup_content; staff_review_notes; staff_decision

Active Migration Isolation

Folder: migrations/
Approved active migration: 0001_packet_history.sql
Policy: only previously approved active migrations may live in the active migrations folder
Draft boundary: outside-active-migrations-folder

Allowed Outputs

stdout validation summaryprocess exit codetest assertions

Prohibited Outputs

generated SQL execution logs that imply SQL ran
generated database files
generated D1 output
generated table introspection results
generated production/preview reports
generated seed records
generated role-set records
generated audit records

Failure Modes And Stop Conditions

Failure modes	Stop conditions
draft artifact missing; draft artifact appears in active migrations folder; local-only or do-not-run label missing; prohibited table name detected; prohibited sensitive field detected; active migrations folder contains unexpected SQL file; package script executes the draft; wrangler execution wrapper appears; D1 write endpoint appears; harness attempts SQL execution; harness writes files; harness uses network access	any prohibited table appears; any identity field appears; any submission or staff-decision field appears; any tracking, analytics, or scoring field appears; active migrations folder changes unexpectedly; any D1 target appears; any runtime endpoint writes to D1; any SQL execution path appears

Failure modes

Stop conditions

draft artifact missing; draft artifact appears in active migrations folder; local-only or do-not-run label missing; prohibited table name detected; prohibited sensitive field detected; active migrations folder contains unexpected SQL file; package script executes the draft; wrangler execution wrapper appears; D1 write endpoint appears; harness attempts SQL execution; harness writes files; harness uses network access

any prohibited table appears; any identity field appears; any submission or staff-decision field appears; any tracking, analytics, or scoring field appears; active migrations folder changes unexpectedly; any D1 target appears; any runtime endpoint writes to D1; any SQL execution path appears

Activation Blockers

harness output reviewed
harness remains local validation only
separate disposable local SQL dry-run phase approved
production D1 remains excluded
preview D1 remains excluded
active migrations folder change explicitly approved in a later phase
rollback plan reviewed
staff/privacy approval remains required before activation
no write endpoints approved in this phase
no CRUD UI approved in this phase

What Remains Blocked

No SQL execution, D1 targeting, active migration, table creation, runtime D1 query, data-write path, write endpoint, CRUD UI, role-set storage, user assignment, identity storage, submissions, staff decisions, tracking, analytics, scoring, reports, seed records, or production/preview output is active.

Recommended Next Phase

Phase 7.12 - Role Set Template Migration Activation Review, Planning Only

Boundaries: future phase only; no production activation yet; no preview D1 targeting yet; no active migration until explicit approval; no write endpoints; no CRUD UI; no user assignment; no submissions.

future-only