Skip to content

engine: migration-safety gate — block destructive DDL from autonomous auto-merge #3

Description

@jg-noncelogic

HIGH. This run auto-merged a DROP COLUMN (passband #1480, flagLegacyAutoDraft) to prod via --squash --auto with zero migration-safety checks. No reviewer prompt detects destructive DDL; no additive-only check; no backup/PITR confirmation. Add: (1) code-reviewer guardrail — any prisma migration with DROP/non-additive ALTER MUST return request_changes ("destructive migration — human sign-off required"); (2) integrator scans migration files for destructive DDL before arming auto-merge and parks for a human. Make it a per-project config knob.


Filed 2026-06-14 from the delivery-train process-safety audit (after the 22-ticket passband run). Engine: .claude/workflows/delivery-train.js. Anchor failure: #1639 — architect committed an ADR, implementer opened no PR, reviewer got "PR #0", ticket dangled with a stranded branch + leftover worktree.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions