email-calendar-handler/project-control.yaml at main · Adamgdwn/email-calendar-handler · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
project_name: email and calendar handler
project_codename: InboxMind
project_type: application
risk_tier: medium
repository_model: single-repo
owner:
  name: Project Owner
  role: owner
technical_lead:
  name: Technical Lead
  role: technical-lead
status: active
environments:
  - dev
  - staging
  - prod
data_classification:
  handles_sensitive_data: true
  handles_money: false
  notes: >
    Processes personal and business email metadata/content plus read-only
    calendar data (Calendars.Read) from chunk 10. Phase 1 is local,
    single-account, human-reviewed MVP work only. The system must not send email,
    create drafts, or modify external labels without an explicit human_approved
    flag recorded in application state. Write-capable provider scopes require
    the roadmap write-scope gate (metrics plus governance review). Council
    correspondence may be FOIP-visible public record; see the risk register.
controls:
  required_docs:
    - README.md
    - docs/architecture.md
    - docs/manual.md
    - docs/roadmap.md
    - docs/deployment-guide.md
    - docs/runbook.md
    - docs/CHANGELOG.md
    - docs/risks/risk-register.md
  machine_enforcement:
    - required-file-check
    - lint
    - tests
    - typecheck
    - secret-scan
exceptions:
  - id: EX-2026-05-15-001
    status: closed
    severity: low
    owner: Project Owner
    opened: 2026-05-15
    closed: 2026-05-15
    review_by: 2026-06-15
    control: governance-preflight
    reason: >
      scripts/governance-preflight.sh could not run because GOVERNANCE_HOME was
      not set and no local automation/governance_check.sh fallback exists.
    acceptance: >
      Accepted for Milestone 1.1 scaffolding because development is step-by-step,
      local, and no external email actions are implemented. Governance metadata,
      required docs, lint, typecheck, tests, and secret scanning remain required.
    remediation: >
      Configure GOVERNANCE_HOME or vendor the governance check before real email
      ingestion credentials are connected.
    resolution: >
      Local automation/governance_check.sh was added so
      scripts/governance-preflight.sh can pass without GOVERNANCE_HOME.
agent_controls:
  applicable: true
  autonomy_level: A1
  model_registry:
    - anthropic_claude_api
  prompt_registry:
    - src/agents/CLAUDE.md
    - src/models/CLAUDE.md
    - src/memory/CLAUDE.md