claude-flow-novice 2.18.5 → 2.18.7

package/.claude/skills-database/APPROVAL_CRITERIA.md

@@ -0,0 +1,925 @@
+# Skills Database Approval Criteria
+## Three-Tier Approval System - Detailed Definitions
+
+**Version:** 2.0.0
+**Date:** 2025-11-16
+**Status:** Production Ready
+**Audience:** Expert reviewers, system administrators, team leads
+
+---
+
+## Table of Contents
+
+1. [Approval Level Definitions](#approval-level-definitions)
+2. [Risk Assessment Rubric](#risk-assessment-rubric)
+3. [Decision Matrix & Examples](#decision-matrix--examples)
+4. [TDD Integration](#tdd-integration)
+5. [Escalation Triggers](#escalation-triggers)
+6. [Category-Specific Criteria](#category-specific-criteria)
+
+---
+
+## Approval Level Definitions
+
+### Level 1: Auto-Approved
+
+**Purpose:** Instant approval for low-risk, well-tested skills with minimal external dependencies.
+
+**Automatic Criteria (ALL must be met):**
+
+| Criteria | Requirement | Rationale |
+|----------|-------------|-----------|
+| Risk Score | ≤ 0.30 | Low security/business impact |
+| Test Coverage | ≥ 95% | High code quality confidence |
+| Cyclomatic Complexity | ≤ 5 | Simple, maintainable logic |
+| External Dependencies | 0 | No API/service calls |
+| File System Access | Local skill directory only | No cross-directory modifications |
+| Security Review | Not required | Low-risk operations only |
+| Database Access | Query-only or local SQLite | No production database writes |
+| Credential Usage | None | No API keys or secrets |
+
+**Approval Decision:**
+- Status: Automatically APPROVED
+- Approver: system
+- Time to approval: < 5 seconds
+- Audit trail: Automatic entry created
+
+**Database Field Values:**
+```sql
+approval_level = 'auto'
+last_approved_by = 'system'
+last_approval_date = datetime('now')
+```
+
+**Examples of Auto-Approved Skills:**
+1. **cfn-coordination-protocol-v1** (coordination)
+   - Risk: 0.15, Coverage: 98%, Complexity: 3
+
+2. **cfn-test-runner-basic** (testing)
+   - Risk: 0.20, Coverage: 97%, Complexity: 2
+
+3. **cfn-logging-utility** (foundation)
+   - Risk: 0.10, Coverage: 99%, Complexity: 1
+
+---
+
+### Level 2: Escalated Review
+
+**Purpose:** Expert review for medium-risk skills or those with specialized infrastructure dependencies.
+
+**Escalation Criteria (ANY trigger escalation):**
+
+| Trigger | Threshold | Rationale |
+|---------|-----------|-----------|
+| Risk Score | 0.31-0.60 | Medium security/business impact |
+| Test Coverage | 80-94% | Good but not excellent coverage |
+| Complexity | 6-15 | Moderate logical complexity |
+| External Dependencies | 1-3 API/service calls | May require stability verification |
+| Security Review | Required | Security-sensitive operations |
+| Infrastructure Changes | Docker, Redis, PostgreSQL | Infrastructure expertise required |
+| Cross-Team Dependencies | Affects 2+ teams | Coordination and impact analysis needed |
+| Database Writes | Production databases | Data integrity verification required |
+| Conditional Deployment | Config-dependent paths | Testing complexity increases |
+
+**Escalation Process:**
+- Status: Pending escalation
+- Duration: 24-48 hour expert review window
+- Notified Experts: 2+ security/infrastructure specialists
+- Feedback Loop: Expert may request corrections
+- Final Decision: Approved, Escalated-to-Human, or Rejected
+
+**Database Field Values:**
+```sql
+approval_level = 'escalate'
+approval_criteria = {
+  "risk_score": 0.45,
+  "test_coverage": 0.88,
+  "requires_security_review": true,
+  "external_apis": ["redis", "postgres"],
+  "expert_category": "infrastructure"
+}
+last_approved_by = 'expert-name@example.com'
+last_approval_date = '2025-11-16T14:30:00Z'
+```
+
+**Expert Review Responsibilities:**
+- Validate risk assessment accuracy
+- Confirm test coverage completeness
+- Review security implications
+- Assess integration impact
+- Approve or escalate to human review
+- Document reasoning in approval_history
+
+**Examples of Escalated-Review Skills:**
+1. **cfn-redis-coordination-v2** (coordination)
+   - Risk: 0.45, Coverage: 88%, External: Redis
+   - Expert: Infrastructure specialist
+
+2. **cfn-postgres-connection-pool** (infrastructure)
+   - Risk: 0.52, Coverage: 85%, Database: PostgreSQL
+   - Expert: Database architect
+
+3. **cfn-secure-agent-spawning** (security)
+   - Risk: 0.48, Coverage: 90%, Security-critical
+   - Expert: Security architect
+
+---
+
+### Level 3: Human Approval
+
+**Purpose:** Senior expert review for high-risk, complex, or strategically important skills.
+
+**Human Review Criteria (ANY trigger human approval):**
+
+| Trigger | Threshold | Rationale |
+|---------|-----------|-----------|
+| Risk Score | > 0.60 | High security/business impact |
+| Test Coverage | < 80% | Insufficient test coverage |
+| Complexity | > 15 | High cyclomatic complexity |
+| New Category | First skill in category | Requires strategic decision |
+| Revenue Impact | Affects revenue systems | Business-critical decision |
+| Multi-System Integration | Changes 3+ major systems | Complex interactions require analysis |
+| Compliance/Regulatory | HIPAA, SOC2, GDPR implications | Legal/regulatory decision required |
+| Escalation Feedback | Repeated rejections/corrections | Quality gate failures indicate deeper issues |
+| Architecture Change | Changes approval system itself | Meta-level decision requires oversight |
+
+**Human Review Process:**
+- Status: Pending senior expert decision
+- Duration: 3-7 day review window
+- Assigned: Senior architect + team lead
+- Analysis: Deep code review, impact assessment, risk evaluation
+- Final Decision: Approved, Rejected, or Needs-Correction
+- Board Review: Optional for strategic decisions
+
+**Database Field Values:**
+```sql
+approval_level = 'human'
+approval_criteria = {
+  "risk_score": 0.72,
+  "test_coverage": 0.75,
+  "complexity": 18,
+  "affects_systems": ["orchestration", "agent-spawning", "coordination"],
+  "requires_board_review": true,
+  "compliance_category": "governance"
+}
+last_approved_by = 'cto@example.com'
+last_approval_date = '2025-11-18T10:00:00Z'
+```
+
+**Human Review Responsibilities:**
+- Conduct comprehensive code review
+- Evaluate business impact and risk
+- Assess compliance and regulatory implications
+- Determine resource requirements
+- Make final approval/rejection decision
+- Document strategic rationale
+
+**Examples of Human-Approved Skills:**
+1. **cfn-orchestration-v3-enhanced** (orchestration)
+   - Risk: 0.68, Coverage: 75%, Complexity: 22
+   - Strategic: Major system redesign
+
+2. **cfn-agent-spawn-secure-v2** (infrastructure)
+   - Risk: 0.75, Coverage: 78%, Security-critical
+   - Compliance: GDPR-relevant changes
+
+3. **cfn-event-bus-distributed** (architecture)
+   - Risk: 0.70, Coverage: 72%, Affects 5+ systems
+   - Strategic: Changes CFN Loop design
+
+---
+
+## Risk Assessment Rubric
+
+### Component Risk Scoring (0.0 = Safe, 1.0 = Critical Risk)
+
+#### 1. Security Impact (Weight: 35%)
+```
+0.0 - 0.2:   No security implications
+              Example: Logging utility, test helper
+
+0.2 - 0.4:   Low security impact (read-only)
+              Example: Query tool, metrics reader
+
+0.4 - 0.6:   Medium security impact (write access)
+              Example: Database modifier, config updater
+
+0.6 - 0.8:   High security impact (secrets/credentials)
+              Example: Key manager, auth system
+
+0.8 - 1.0:   Critical security impact (breach = data loss)
+              Example: Encryption system, audit log modifier
+```
+
+**Sub-components:**
+- Credential Handling: 0=None, 0.3=API keys only, 0.7=Secrets, 1.0=Multi-secret types
+- Data Access Scope: 0=Own dir, 0.3=Project, 0.6=Database, 0.9=External systems, 1.0=Critical infrastructure
+- Error Handling: 1.0 = Safe, 0.7 = Logs errors, 0.4 = Sometimes logs, 0.0 = Silent failures
+
+#### 2. Complexity Score (Weight: 25%)
+```
+0 - 3:       Low - Single function, linear flow
+             Example: Echo utility, simple wrapper
+
+4 - 7:       Medium - Multiple branches, some state
+             Example: Routing logic, multi-step process
+
+8 - 12:      Medium-High - Complex state, recursion
+             Example: Tree traversal, backtracking
+
+13 - 20:     High - Multiple interactions, edge cases
+             Example: Consensus algorithm, orchestrator
+
+21+:         Critical - Meta-complexity
+             Example: Complete CFN Loop redesign
+```
+
+**Normalize to 0.0-1.0:** complexity_score / 20 (capped at 1.0)
+
+#### 3. Test Coverage (Weight: 20%)
+```
+< 50%:       0.9 risk (insufficient confidence)
+50-70%:      0.7 risk
+70-80%:      0.5 risk
+80-95%:      0.2 risk
+95%+:        0.0 risk (high confidence)
+```
+
+Adjusted by test quality:
+- 100% line coverage + edge cases = 0.0
+- 95% coverage without edge cases = 0.1
+- Coverage < 80% + no critical path testing = 0.9
+
+#### 4. External Dependencies (Weight: 15%)
+```
+0 dependencies:        0.0 risk
+1 stable dependency:   0.2 risk
+2-3 dependencies:      0.4 risk
+4+ dependencies:       0.6 risk
+Unstable/beta deps:    +0.3 risk multiplier
+Undocumented deps:     +0.2 risk multiplier
+```
+
+**Examples:**
+- No external calls = 0.0
+- Queries local SQLite = 0.1 (low risk)
+- Calls Redis cluster = 0.3 (stable, documented)
+- Calls 3 microservices + custom API = 0.7 (high coupling)
+
+#### 5. Business Criticality (Weight: 5%)
+```
+Non-critical (testing, docs):           0.0 risk
+Standard tools (utilities, helpers):    0.1 risk
+Important (frequently used):            0.3 risk
+Critical (affects multiple teams):      0.5 risk
+Revenue-impacting (payment system):     0.8 risk
+Core infrastructure (can break system): 1.0 risk
+```
+
+### Aggregate Risk Formula
+
+```
+Aggregate Risk = (
+  Security_Impact × 0.35 +
+  Complexity_Score × 0.25 +
+  Test_Coverage_Risk × 0.20 +
+  External_Deps_Risk × 0.15 +
+  Business_Criticality × 0.05
+)
+```
+
+**Example Calculation:**
+
+**Skill: cfn-redis-coordination-v2**
+
+| Component | Score | Weight | Contribution |
+|-----------|-------|--------|--------------|
+| Security Impact | 0.35 | 0.35 | 0.1225 |
+| Complexity (12/20) | 0.60 | 0.25 | 0.1500 |
+| Test Coverage (88%) | 0.20 | 0.20 | 0.0400 |
+| External Deps (Redis) | 0.30 | 0.15 | 0.0450 |
+| Business Critical | 0.30 | 0.05 | 0.0150 |
+| **Total Risk** | | | **0.3725** |
+
+**Decision:** Escalation (0.31-0.60 range)
+
+**Example Calculation:**
+
+**Skill: cfn-agent-spawn-secure-v2**
+
+| Component | Score | Weight | Contribution |
+|-----------|-------|--------|--------------|
+| Security Impact | 0.75 | 0.35 | 0.2625 |
+| Complexity (18/20) | 0.90 | 0.25 | 0.2250 |
+| Test Coverage (78%) | 0.50 | 0.20 | 0.1000 |
+| External Deps (3 APIs) | 0.40 | 0.15 | 0.0600 |
+| Business Critical | 0.80 | 0.05 | 0.0400 |
+| **Total Risk** | | | **0.6875** |
+
+**Decision:** Human Approval (> 0.60)
+
+---
+
+## Decision Matrix & Examples
+
+### Complete Decision Tree
+
+```
+START: New Skill Submission
+  │
+  ├─ Risk Score > 0.60?
+  │  ├─ YES → HUMAN APPROVAL (Rule 1)
+  │  └─ NO  → Continue
+  │
+  ├─ Test Coverage < 80%?
+  │  ├─ YES → HUMAN APPROVAL (Rule 2)
+  │  └─ NO  → Continue
+  │
+  ├─ Complexity > 15?
+  │  ├─ YES → HUMAN APPROVAL (Rule 3)
+  │  └─ NO  → Continue
+  │
+  ├─ Risk Score 0.31-0.60?
+  │  ├─ YES → ESCALATED REVIEW (Rule 4)
+  │  └─ NO  → Continue
+  │
+  ├─ Test Coverage 80-94%?
+  │  ├─ YES → Check Dependencies
+  │  │  ├─ External Deps? → ESCALATED REVIEW (Rule 5)
+  │  │  └─ No Deps → AUTO APPROVAL
+  │  └─ NO  → Continue
+  │
+  ├─ Complexity 6-15?
+  │  ├─ YES → ESCALATED REVIEW (Rule 6)
+  │  └─ NO  → Continue
+  │
+  └─ All Criteria Met?
+     ├─ YES → AUTO APPROVAL
+     └─ NO  → ESCALATED REVIEW (Fallback)
+```
+
+### 25+ Real-World Examples
+
+#### AUTO-APPROVED SKILLS (Risk ≤ 0.30)
+
+**1. cfn-logging-utility**
+- Category: foundation
+- Risk: 0.12 (safe logging operations)
+- Coverage: 99% (comprehensive tests)
+- Complexity: 1 (single function)
+- Dependencies: 0
+- Decision: AUTO
+- Reason: Safe utility with excellent coverage
+
+**2. cfn-test-runner-basic**
+- Category: testing
+- Risk: 0.18 (test execution, no side effects)
+- Coverage: 97% (edge cases covered)
+- Complexity: 3 (linear flow)
+- Dependencies: 0
+- Decision: AUTO
+- Reason: Simple tool with high confidence
+
+**3. cfn-coordination-protocol-v1**
+- Category: coordination
+- Risk: 0.15 (no external calls)
+- Coverage: 98% (comprehensive blocking tests)
+- Complexity: 4 (limited state)
+- Dependencies: 0 (signal-based only)
+- Decision: AUTO
+- Reason: Pure coordination logic, well-tested
+
+**4. cfn-echo-wrapper**
+- Category: foundation
+- Risk: 0.08 (shell wrapper)
+- Coverage: 95% (basic tests)
+- Complexity: 2 (passthrough)
+- Dependencies: 0
+- Decision: AUTO
+- Reason: Minimal risk wrapper
+
+**5. cfn-json-parser**
+- Category: utilities
+- Risk: 0.22 (JSON parsing)
+- Coverage: 96% (malformed input tests)
+- Complexity: 3 (regex patterns)
+- Dependencies: 0 (standard jq)
+- Decision: AUTO
+- Reason: Well-established tool with safe operations
+
+#### ESCALATED-REVIEW SKILLS (Risk 0.31-0.60)
+
+**6. cfn-redis-coordination-v2**
+- Category: coordination
+- Risk: 0.37 (Redis connection risk)
+- Coverage: 88% (good but not excellent)
+- Complexity: 7 (Redis protocol handling)
+- Dependencies: Redis cluster
+- Trigger: Medium risk + external dependency
+- Decision: ESCALATE
+- Expert: Infrastructure specialist
+- Review SLA: 48 hours
+
+**7. cfn-postgres-connection-pool**
+- Category: infrastructure
+- Risk: 0.42 (database connection management)
+- Coverage: 85% (connection timeout edge cases)
+- Complexity: 9 (state machine)
+- Dependencies: PostgreSQL server
+- Trigger: Database writes + medium complexity
+- Decision: ESCALATE
+- Expert: Database architect
+- Review SLA: 48 hours
+
+**8. cfn-secure-agent-spawning**
+- Category: security
+- Risk: 0.48 (security-critical operation)
+- Coverage: 90% (attack vector testing)
+- Complexity: 8 (validation logic)
+- Dependencies: 2 (crypto libraries)
+- Trigger: Security-sensitive operations
+- Decision: ESCALATE
+- Expert: Security architect
+- Review SLA: 48 hours
+
+**9. cfn-event-bus-local**
+- Category: infrastructure
+- Risk: 0.35 (local event routing)
+- Coverage: 82% (message loss scenarios)
+- Complexity: 10 (event queueing)
+- Dependencies: 1 (bash arrays)
+- Trigger: Medium complexity + external dependency
+- Decision: ESCALATE
+- Expert: Architecture specialist
+- Review SLA: 48 hours
+
+**10. cfn-agent-selector-v2**
+- Category: coordination
+- Risk: 0.41 (agent selection logic)
+- Coverage: 87% (preference handling)
+- Complexity: 8 (multi-factor scoring)
+- Dependencies: 0
+- Trigger: Medium risk + complexity
+- Decision: ESCALATE
+- Expert: Orchestration specialist
+- Review SLA: 48 hours
+
+#### HUMAN-APPROVED SKILLS (Risk > 0.60)
+
+**11. cfn-orchestration-v3-enhanced**
+- Category: orchestration
+- Risk: 0.68 (orchestrator redesign)
+- Coverage: 75% (below threshold)
+- Complexity: 22 (high: state machines, timeouts)
+- Dependencies: 5 (Redis, databases, APIs)
+- Triggers: Risk > 0.60, Coverage < 80%, Complexity > 15
+- Decision: HUMAN
+- Assigned: CTO + Architecture Lead
+- Review SLA: 7 days
+- Board Review: YES (strategic change)
+
+**12. cfn-agent-spawn-secure-v2**
+- Category: infrastructure
+- Risk: 0.75 (security-critical: process creation)
+- Coverage: 78% (below threshold)
+- Complexity: 14 (near-threshold: process groups)
+- Dependencies: 3 (os, signal handlers, crypto)
+- Triggers: Risk > 0.60, Coverage < 80%
+- Decision: HUMAN
+- Assigned: Security Architect + CTO
+- Review SLA: 7 days
+- Board Review: YES (security implications)
+
+**13. cfn-event-bus-distributed**
+- Category: architecture
+- Risk: 0.70 (distributed system complexity)
+- Coverage: 72% (below threshold)
+- Complexity: 24 (very high: consensus, replication)
+- Dependencies: 4 (Redis, PostgreSQL, gRPC, custom)
+- Triggers: Risk > 0.60, Coverage < 80%, Complexity > 15, Multi-system integration
+- Decision: HUMAN
+- Assigned: Principal Architect + CTO
+- Review SLA: 7 days
+- Board Review: YES (affects all systems)
+
+**14. cfn-approval-system-redesign**
+- Category: governance
+- Risk: 0.82 (affects approval process itself)
+- Coverage: 70% (below threshold)
+- Complexity: 26 (meta-complexity)
+- Dependencies: 6+ (database, notifications, validators)
+- Triggers: Risk > 0.60, Coverage < 80%, Architecture change, Revenue impact
+- Decision: HUMAN
+- Assigned: CTO + All Tech Leads
+- Review SLA: 14 days
+- Board Review: YES (governance change)
+
+**15. cfn-compliance-audit-system**
+- Category: governance
+- Risk: 0.80 (regulatory compliance)
+- Coverage: 68% (below threshold)
+- Complexity: 20 (compliance rules engine)
+- Dependencies: 5 (audit log, database, notification)
+- Triggers: Risk > 0.60, Coverage < 80%, Compliance implications
+- Decision: HUMAN
+- Assigned: Compliance Officer + CTO
+- Review SLA: 14 days
+- Board Review: YES (legal/compliance)
+
+### Category-Specific Patterns
+
+**Coordination Skills:**
+- Auto: Risk ≤ 0.25, No external calls, Coverage ≥ 95%
+- Escalate: Risk 0.26-0.50, Redis/local services, Coverage ≥ 85%
+- Human: Risk > 0.50, Multi-system, Coverage < 80%
+
+**Infrastructure Skills:**
+- Auto: Simple utilities, No database access, Coverage ≥ 95%
+- Escalate: Docker/Kubernetes changes, PostgreSQL queries, Coverage ≥ 80%
+- Human: Distributed system changes, Schema changes, Coverage < 80%
+
+**Security Skills:**
+- Auto: Validation logic, No credential handling, Coverage ≥ 95%
+- Escalate: Encryption wrappers, API key management, Coverage ≥ 85%
+- Human: Auth system changes, Compliance changes, Coverage < 90%
+
+**Testing Skills:**
+- Auto: Test runners, Assertions, Coverage ≥ 90%
+- Escalate: Custom test frameworks, CI/CD integration, Coverage ≥ 80%
+- Human: Credential injection in tests, Agent mocking systems, Coverage < 80%
+
+**Foundation Skills:**
+- Auto: Logging, Echo wrappers, Config readers, Coverage ≥ 95%
+- Escalate: Complex utilities, Multiple dependencies, Coverage ≥ 90%
+- Human: Core utilities affecting other skills, Coverage < 85%
+
+---
+
+## TDD Integration
+
+### Test Coverage Requirements by Approval Level
+
+#### Auto-Approval
+- Minimum coverage: **95%**
+- Test pass rate: **100%** (no failures allowed)
+- Coverage must include:
+  - Happy path (main functionality)
+  - Error cases (invalid input)
+  - Edge cases (boundary conditions)
+  - Timeout scenarios (if applicable)
+- Coverage gaps allowed: None
+- Report format: Line coverage + branch coverage
+
+#### Escalated Review
+- Minimum coverage: **80%**
+- Test pass rate: **98%+** (max 1 failure per 50 tests)
+- Coverage must include:
+  - Core functionality paths
+  - Major error cases
+  - Common edge cases
+  - Integration points
+- Coverage gaps allowed: < 20% for non-critical paths
+- Expert validates coverage adequacy during review
+
+#### Human Approval
+- Minimum coverage: **None** (can be < 50%)
+- Test pass rate: No minimum
+- Coverage quality evaluated by:
+  - Test comprehensiveness
+  - Critical path coverage
+  - Maintainability of tests
+  - Test documentation
+- Human reviewer determines adequacy
+- Plan for test improvement may be required
+
+### Test Execution Integration
+
+**Before Approval Submission:**
+```bash
+# Run test suite and capture results
+./test.sh > test_results.json 2>&1
+
+# Extract coverage metrics
+coverage_pct=$(grep 'coverage:' test_results.json | awk '{print $2}')
+
+# Determine approval level based on coverage + risk
+if [[ $(echo "$coverage_pct >= 0.95" | bc) -eq 1 ]]; then
+  approval_level="auto"
+elif [[ $(echo "$coverage_pct >= 0.80" | bc) -eq 1 ]]; then
+  approval_level="escalate"
+else
+  approval_level="human"
+fi
+```
+
+**Recording Test Results in Database:**
+```sql
+-- Insert into approval_history
+INSERT INTO approval_history (
+  skill_id,
+  version,
+  approval_level,
+  approver,
+  decision,
+  test_results
+) VALUES (
+  1,
+  '2.1.0',
+  'escalate',
+  'system',
+  'escalated',
+  json_object(
+    'pass_count', 45,
+    'fail_count', 0,
+    'pass_rate', 1.0,
+    'coverage_pct', 88,
+    'test_duration_sec', 12.4
+  )
+);
+```
+
+---
+
+## Escalation Triggers
+
+### Automatic Escalation Rules
+
+**Rule 1: Security Sensitivity**
+- Any skill handling credentials/secrets
+- Any skill modifying audit trails
+- Any skill changing access controls
+- Result: ESCALATE or HUMAN (auto-escalate to expert)
+
+**Rule 2: External Service Dependencies**
+- Redis/Memcached connections
+- PostgreSQL/MySQL database access
+- AWS/cloud provider API calls
+- Third-party API integrations
+- Result: ESCALATE (expert review required)
+
+**Rule 3: Test Coverage Below Threshold**
+- Coverage 50-79%: ESCALATE
+- Coverage < 50%: HUMAN
+- Result: Expert determines if acceptable for use case
+
+**Rule 4: Complexity Threshold**
+- Cyclomatic complexity 6-15: ESCALATE
+- Cyclomatic complexity > 15: HUMAN
+- Result: Expert validates that complexity is justified
+
+**Rule 5: Cross-Team Dependencies**
+- Any skill used by 3+ teams
+- Any skill in critical path for multiple systems
+- Any skill affecting deployment pipeline
+- Result: ESCALATE or HUMAN (impact analysis required)
+
+**Rule 6: Production Environment Changes**
+- Database schema modifications
+- Infrastructure configuration changes
+- Log level/retention policy changes
+- Result: HUMAN (requires coordination)
+
+---
+
+## Category-Specific Criteria
+
+### Coordination Skills
+**Purpose:** Enable multi-agent orchestration and synchronization
+
+**Auto-Approval Criteria:**
+- Risk ≤ 0.25
+- Coverage ≥ 95%
+- Complexity ≤ 5
+- Only signal-based communication (no API calls)
+- No database access
+
+**Example:** `cfn-coordination-protocol-v1` - Pure signal-based blocking mechanism
+
+**Escalation Criteria:**
+- Risk 0.26-0.50
+- Coverage ≥ 85%
+- Uses Redis/local coordination services
+- Single system integration
+
+**Example:** `cfn-redis-coordination-v2` - Redis-backed coordination with state management
+
+**Human Approval Criteria:**
+- Risk > 0.50
+- Coverage < 80%
+- Multi-system orchestration
+- Changes to CFN Loop semantics
+
+**Example:** `cfn-orchestration-v3-enhanced` - Redesigned orchestration system
+
+### Infrastructure Skills
+**Purpose:** Manage system resources, deployment, and operations
+
+**Auto-Approval Criteria:**
+- Risk ≤ 0.30
+- Coverage ≥ 95%
+- Complexity ≤ 5
+- No database schema changes
+- No credential handling
+
+**Example:** `cfn-docker-helper` - Docker command wrapper
+
+**Escalation Criteria:**
+- Risk 0.31-0.60
+- Coverage ≥ 80%
+- Kubernetes/Docker changes
+- Database query (read-only)
+- Environment configuration
+
+**Example:** `cfn-postgres-connection-pool` - Connection management
+
+**Human Approval Criteria:**
+- Risk > 0.60
+- Coverage < 80%
+- Database schema changes
+- Distributed system changes
+- Compliance implications
+
+**Example:** `cfn-event-bus-distributed` - Distributed messaging system
+
+### Security Skills
+**Purpose:** Handle authentication, authorization, and secure operations
+
+**Auto-Approval Criteria:**
+- Risk ≤ 0.25
+- Coverage ≥ 95%
+- Complexity ≤ 5
+- Validation/sanitization logic only
+- No credential creation/storage
+
+**Example:** `cfn-input-validator` - Safe input validation
+
+**Escalation Criteria:**
+- Risk 0.31-0.60
+- Coverage ≥ 85%
+- Encryption wrappers
+- API key management (read-only)
+- Permission checking
+
+**Example:** `cfn-secure-agent-spawning` - Secure process creation
+
+**Human Approval Criteria:**
+- Risk > 0.60
+- Coverage < 80%
+- Credential storage/generation
+- Auth system changes
+- Compliance/regulatory implications
+
+**Example:** `cfn-compliance-audit-system` - Regulatory compliance system
+
+### Testing Skills
+**Purpose:** Enable reliable test execution and validation
+
+**Auto-Approval Criteria:**
+- Risk ≤ 0.25
+- Coverage ≥ 95%
+- Complexity ≤ 5
+- No test side effects
+- No credential injection
+
+**Example:** `cfn-test-runner` - Basic test execution wrapper
+
+**Escalation Criteria:**
+- Risk 0.31-0.60
+- Coverage ≥ 80%
+- Custom test framework
+- Integration with CI/CD
+- Mock object generation
+
+**Example:** `cfn-mock-agent-system` - Agent mocking framework
+
+**Human Approval Criteria:**
+- Risk > 0.60
+- Coverage < 80%
+- Credential injection in tests
+- Test database population
+- Compliance test requirements
+
+**Example:** `cfn-compliance-test-suite` - Regulatory testing
+
+### Foundation Skills
+**Purpose:** Bootstrap system with core utilities
+
+**Auto-Approval Criteria:**
+- Risk ≤ 0.20 (most restrictive)
+- Coverage ≥ 95%
+- Complexity ≤ 5
+- No external dependencies
+- No state modification
+
+**Example:** `cfn-logging-utility` - Safe logging wrapper
+
+**Escalation Criteria:**
+- Risk 0.21-0.45
+- Coverage ≥ 90%
+- Limited external dependencies
+- Used by multiple skills
+
+**Example:** `cfn-json-parser` - JSON parsing utility
+
+**Human Approval Criteria:**
+- Risk > 0.45
+- Coverage < 80%
+- Core infrastructure change
+- Affects skill loading
+- System bootstrap changes
+
+**Example:** `cfn-skill-registry-v2` - Skills database initialization
+
+---
+
+## Approval Criteria Database Schema
+
+### Storing Approval Criteria
+
+```sql
+-- Define criteria for auto-approved coordination skills
+INSERT INTO approval_criteria_templates (
+  approval_level,
+  category,
+  criteria_json,
+  description,
+  enabled
+) VALUES (
+  'auto',
+  'coordination',
+  json_object(
+    'risk_score_max', 0.3,
+    'test_coverage_min', 0.95,
+    'complexity_max', 'low',
+    'external_dependencies', false,
+    'requires_security_review', false,
+    'cyclomatic_complexity_max', 5,
+    'allowed_file_system_access', 'skill_directory_only'
+  ),
+  'Auto-approve simple coordination skills with high test coverage and no external dependencies',
+  1
+);
+
+-- Define criteria for escalated infrastructure skills
+INSERT INTO approval_criteria_templates (
+  approval_level,
+  category,
+  criteria_json,
+  description,
+  enabled
+) VALUES (
+  'escalate',
+  'infrastructure',
+  json_object(
+    'risk_score_min', 0.31,
+    'risk_score_max', 0.6,
+    'test_coverage_min', 0.80,
+    'complexity_min', 'medium',
+    'complexity_max', 'high',
+    'allowed_external_services', ['redis', 'postgres', 'docker'],
+    'requires_security_review', true,
+    'requires_infrastructure_review', true,
+    'expert_email', 'infrastructure@example.com'
+  ),
+  'Escalated review for medium-risk infrastructure changes',
+  1
+);
+```
+
+### Querying for Approval Level
+
+```sql
+-- Determine approval level for a new skill
+SELECT
+  s.id,
+  s.name,
+  s.category,
+  CASE
+    WHEN s.test_coverage >= 0.95
+      AND json_extract(s.approval_criteria, '$.risk_score') <= 0.30
+      AND json_extract(s.approval_criteria, '$.complexity_score') <= 5
+      THEN 'auto'
+    WHEN s.test_coverage >= 0.80
+      AND json_extract(s.approval_criteria, '$.risk_score') <= 0.60
+      THEN 'escalate'
+    ELSE 'human'
+  END as recommended_approval_level
+FROM skills s
+WHERE s.status = 'active'
+ORDER BY s.created_at DESC;
+```
+
+---
+
+## Summary
+
+The three-tier approval system ensures:
+
+1. **Efficiency:** 80%+ of skills auto-approved in < 5 seconds
+2. **Quality:** Risk-based routing ensures appropriate review levels
+3. **Scalability:** Human experts review only high-risk skills
+4. **Compliance:** Complete audit trail of all decisions
+5. **Flexibility:** Category-specific criteria for domain expertise
+6. **Continuous Improvement:** TDD integration drives test coverage
+
+By following these detailed criteria and rubrics, expert reviewers can consistently make informed approval decisions that balance speed, quality, and risk management.