dev-workflow

A tiered code review workflow classifies coding tasks as XS, M, or L to apply the correct ceremony level, requiring RFC gating for M/L tasks and multi-agent reviews before merging. This prevents risky or inconsistent code changes by scaling process overhead to task size.

Requiring RFC approval before coding involves locking the implementation plan in a markdown file detailing the problem, options, chosen approach, risks, and verification steps. This gating mechanism ensures all major and large tasks are peer-reviewed and explicitly approved before development begins.

This development workflow explicitly excludes product and project management content like Notion, Jira, or Confluence text and hypotheses. It strictly applies to coding tasks across scripts, applications, MCP servers, and SaaS work to enforce technical quality and security controls.

Smoke tests are mandatory even for XS tier tasks to catch refactor breakage quickly, alongside guided test selection for unit, integration, or E2E coverage. This ensures every code change, regardless of size, passes basic functional validation before undergoing final review.

A security review is required for L tier tasks and any code changes impacting authentication or data-handling logic. This multi-agent review process applies incremental security levels S1 through S3, scaling scanning and threat-model expectations as the project matures.

Logging blameless incidents and tracking Definition of Done requires appending post-mortem entries to an incident log file and completing a pre-report checklist. This keeps changes consistent, auditable, and focused on process improvement rather than individual fault.