[ziadantar90]

What this adds

• scripts/risk-check.sh reads a new .sql migration on a database risk path before it calls the change full. If every statement fits a strict allow-list in the public schema, the first line still says Mode: plain, followed by a + <file>: additive migration … line and a Needs: line. The allow-list covers:

  • new tables with row-level security on;
  • added columns with plain-value defaults, checks, unique keys and foreign keys;
  • indexes;
  • policies and grants for named roles on the new tables;
  • stable or immutable SQL functions that only select and whose names the integration branch's SQL doesn't use yet;
  • comments.

  A .sql database test in a test folder counts as plain too.

  These stay full:

  • sign-in, secret, money and permission names;
  • anything it can't read safely;
  • row-level security changes on existing tables;
  • edits to merged migrations;
  • unwritten migrations, which get a Note: line;
  • a failed read of the integration branch;
  • the owner forcing full;
  • any other risk path.

• harness/MODES.md § Additive migration (new): small mode with the database tests in the acceptance criteria and § Check, one /code-review medium before the hand-off, and the owner applying the migration through the steps file. § Choosing mode sends a + line to small mode with a plan, never light mode.

• harness/templates/small-plan.md § Limit and project/CONTROLS.md § Risk paths name the exception.

• Self-test: positive cases, and about 40 must-stay-full cases, one for each bypass the reviews found.

• Update note updates/2026-11-03-additive-migrations.md (with a reviewed: line) and a changelog fragment.

Checks: STRICT=1 bash scripts/kit-selftest.sh passes, with 4 fixtures and 0 problems. check-updates and check-lessons report 0 problems. In the negative test, the old risk-check fails the new cases.

---

Generated by Claude Code