Aaw Sop

---
name: aaw-sop
description: Enforces AAW standard operating procedures. Use this when working on any code changes that need to be auditable. Ensures proper workflow: plan -> implement -> test -> evidence.
allowed-tools:
  - mcp__aawctl__start_session
  - mcp__aawctl__exec
  - mcp__aawctl__read_policy
  - mcp__aawctl__run_tests
  - mcp__aawctl__capture_artifact
  - mcp__aawctl__bundle_evidence
  - Read
  - Glob
  - Grep
  - Edit
---

# AAW Standard Operating Procedures

This skill ensures all code changes follow the auditable workflow required by enterprise compliance.

## Core Principle

All code changes MUST follow the auditable workflow:

```
/aaw-plan → /aaw-implement → /aaw-test → /aaw-evidence
```

## Workflow Requirements

### Phase 1: Planning (Required)

Before ANY code change:

1. Start an audit session with `mcp__aawctl__start_session`
2. Read and understand policy with `mcp__aawctl__read_policy`
3. Create a detailed implementation plan
4. Get user approval before proceeding

**Never skip planning.** Even small changes need documentation.

### Phase 2: Implementation (Required)

During code changes:

1. Use `mcp__aawctl__exec` for ALL shell commands
2. Never use direct Bash tool
3. Provide clear `purpose` for each execution
4. Follow scope-specific policies
5. Document any deviations from the plan

### Phase 3: Testing (Required)

After implementation:

1. Run tests via `mcp__aawctl__run_tests`
2. Capture test artifacts via `mcp__aawctl__capture_artifact`
3. Do not proceed if tests fail - report and wait for decision

### Phase 4: Evidence (Required)

After successful testing:

1. Generate evidence bundle via `mcp__aawctl__bundle_evidence`
2. Provide bundle location to user
3. Bundle must be reviewed before deployment

## Policy Hierarchy

```
Global Policy: /aaw.policy.yaml
     ↓
Package Policy: packages/{name}/aaw.policy.yaml
     ↓
(Package policy extends global, can only be MORE restrictive)
```

## Audit ID

Every session has an `audit_id`. This ID:

- Links all actions in a session
- Must be passed between phases
- Is included in the evidence bundle
- Should be referenced in commit messages

## Compliance Checklist

Before marking any task complete, verify:

- [ ] Audit session was started
- [ ] Policy was checked
- [ ] All commands went through aawctl
- [ ] Tests were run and passed
- [ ] Evidence bundle was generated