Change Control Review

Preset id wf-change-control-review. Flow: webhook-style trigger → collect artifacts → policy agent → condition (CAB vs automated validation) → consolidated outcome record.

GitHub and API nodes assume integration configuration in your deployment. Proof rows link to the same catalogItemId as the run when metadata is present.

See Workflow builder and Execution proofs.

Trigger shape (sample payload)

{ "changeId": "CHG-2048", "sampleDiffRef": "refs/pull/42/head" }

Node-by-node

1. Change Event — webhook-style trigger.
2. Collect Artifacts — internalEcho → /api/workflow-echo.
3. Policy scan — agent stub.
4. CAB gate — condition; TRUE → GitHub integration gate.
5. GitHub integration? — TRUE → CAB Sign-off (GitHub); FALSE → CAB stub transform.
6. Automated Validation — on the FALSE branch of the CAB gate.
7. Path merge — xor_join transform joins auto vs CAB outcomes so Record Outcome can run once.
8. Record Outcome — internalEcho audit write (no external connector).

Run with sample inputs

workflow_id: "wf-change-control-review" with the context JSON above.

Expected logs

Task lifecycle across CAB/auto branches; no integration_missing on guarded GitHub when GitHub is not configured.

Proof summary

Proof metadata includes task counts and integrationFailures (should stay 0 on the bundled graph when guards are intact).