HIGH. This run auto-merged a DROP COLUMN (passband #1480, flagLegacyAutoDraft) to prod via --squash --auto with zero migration-safety checks. No reviewer prompt detects destructive DDL; no additive-only check; no backup/PITR confirmation. Add: (1) code-reviewer guardrail — any prisma migration with DROP/non-additive ALTER MUST return request_changes ("destructive migration — human sign-off required"); (2) integrator scans migration files for destructive DDL before arming auto-merge and parks for a human. Make it a per-project config knob.
Filed 2026-06-14 from the delivery-train process-safety audit (after the 22-ticket passband run). Engine: .claude/workflows/delivery-train.js. Anchor failure: #1639 — architect committed an ADR, implementer opened no PR, reviewer got "PR #0", ticket dangled with a stranded branch + leftover worktree.
HIGH. This run auto-merged a
DROP COLUMN(passband #1480, flagLegacyAutoDraft) to prod via--squash --autowith zero migration-safety checks. No reviewer prompt detects destructive DDL; no additive-only check; no backup/PITR confirmation. Add: (1) code-reviewer guardrail — any prisma migration withDROP/non-additiveALTERMUST returnrequest_changes("destructive migration — human sign-off required"); (2) integrator scans migration files for destructive DDL before arming auto-merge and parks for a human. Make it a per-project config knob.Filed 2026-06-14 from the delivery-train process-safety audit (after the 22-ticket passband run). Engine:
.claude/workflows/delivery-train.js. Anchor failure: #1639 — architect committed an ADR, implementer opened no PR, reviewer got "PR #0", ticket dangled with a stranded branch + leftover worktree.