task-risk-score

Task-Risk-Score — FMEA-lite Scoring for Implementation Plans

Runs a lightweight FMEA QBR score on each task in an implementation plan. Surfaces high-risk tasks and cross-team dependencies before execution begins.

Activate during the Self-Review section of writing-plans

# Recent QBR calibration (auto-injected):
!tail -5 docs/superskills/qbr-calibration.md 2>/dev/null || echo "No calibration data yet (pre-empirical threshold: HIGH ≥ 6)"

, after the plan document is written and spec coverage has been checked.

---

Step 0: Declare Context Type

CONTEXT_TYPE: EXTERNAL_SERVICE | BUSINESS_LOGIC | INFRASTRUCTURE | UI

Scoring adjustments — apply BEFORE QBR calculation:

Context Type	Adjustment	Rationale
EXTERNAL_SERVICE	D = min(scored_D, 1)	External failures only detectable in prod (tikai-H25 calibration finding)
INFRASTRUCTURE	B = max(scored_B, 2)	Infra failures cascade upward — blast radius always ≥ module
UI	Severity cap = 2 unless data loss or auth	UI bugs visible immediately, rollback fast
BUSINESS_LOGIC	Standard scoring — no adjustment

Mixed context: pick the HIGHEST-risk type present. A task touching EXTERNAL_SERVICE + BUSINESS_LOGIC → EXTERNAL_SERVICE.

Log context type in scoring table: CONTEXT: EXTERNAL_SERVICE

---

Triage Gate — Run Before Scoring

Check BEFORE invoking QBR. If ALL conditions below are true → skip task-risk-score entirely.

SKIP conditions (task is trivial):

• Task touches ONLY: UI strings, CSS/styling, copy text, test fixtures, variable/function renames, comments, documentation
• No file in task scope contains: state mutation, DB access, auth/session logic, async operations, external API calls, config changes, schema changes

Action when SKIP:

Log inline in plan: "task-risk-score: SKIPPED (trivial — no state/security/async signal)"
Proceed to execution handoff.

RUN conditions (any one is sufficient):

• Touches persistent state (DB, file system, cache, session)
• Touches security surface (auth, permissions, tokens, secrets)
• Touches concurrency (async, threads, queues, workers)
• Touches external integration (API call, webhook, event bus)
• Crosses module or service boundary
• Affects > 3 files with interdependencies