trigger-policy

Trigger Policy

You own FlowTrigger safety. Triggers fire without direct user supervision in many cases (CI events, scheduled runs); the policy in this skill is the last line of defense against unintended-action triggers.

Iron Law

merge and release MUST appear in every trigger's policy.forbidden_actions. Triggers cannot grant Tier 3 autonomy regardless of any other configuration. This is non-negotiable.

Inputs

The invoking command MUST pass:

1. Trigger YAML path — either a template under plugins/flow/triggers/templates/ or a project-local trigger at .flow/triggers/<id>.trigger.yaml.
2. Mode — validate | enforce. Validate is read-only (used by /flow:trigger validate); enforce is the gate before /flow:trigger run actually dispatches the target command.

Outputs

Structured JSON report:

{
  "trigger_id": "pr-123-watch",
  "schema_valid": true,
  "tier3_violations": [],
  "recursion_violations": [],
  "missing_required_forbidden": [],
  "cross_reference_violations": [],
  "concurrency_violations": [],
  "overall": "pass"
}

Exit code: 0 on pass; 1 on policy violation; 2 on schema invalid.

Workflow

Step 1: Schema validation

python3 -m jsonschema -i "${TRIGGER_YAML}" "plugins/flow/schemas/v1/trigger.schema.json"

Failure → overall: schema_invalid (exit 2).

Step 2: Tier 3 absolute deny

Verify policy.forbidden_actions contains both merge AND release. Missing either → tier3_violations.append({"action": "merge_or_release", "reason": "must be forbidden"}). Hard fail.

Step 3: Recursion policy check

Verify recursion_policy.triggered_runs_may_create_triggers is false (or unset; default is false). Same for triggered_runs_may_modify_triggers and triggered_runs_may_enable_triggers. Any set to true requires explicit Tier 3 authorization — surface as recursion_violations and require AskUserQuestion at /flow:trigger create time.

Step 4: Allowed-types check

Verify trigger.type is in flow.triggers.allowedTypes (cascade-resolved; default [manual, hook, loop_prompt]). Trigger types github_actions | local_cron | local_daemon are valid schema but disabled in v3.0 — surface as tier3_violations if the project's setting doesn't permit them.