# SDLC Handoff Rules (Corrective — GRO-479)

Three critical rules for SDLC pipeline handoffs, identified after CEO feedback on 2026-04-05.

## Rules

1. **Every handoff = PATCH, not comment.** Always PATCH `assigneeAgentId` + `status: todo`. Never rely on @-mention comments alone — they don't trigger inbox wakeups.

2. **Security review = Barkley (fadbc601), never Shedward.** Shedward (130a6a56) does UAT regression only. Barkley Trimsworth (fadbc601) does UAT security review. Do not confuse the two roles.

3. **Full pipeline after UAT pass — never short-circuit.** After Shedward UAT PASS:
   - Route to Barkley for security review (`status: todo`, `assigneeAgentId: fadbc601...`)
   - After Barkley security PASS: route to CEO for prod merge (`status: todo`, `assigneeAgentId: 1471aa94...`)
   - Never mark `done` after UAT pass. Only CEO marks done after prod merge.

## Past Failures

- Comment-only handoffs (no PATCH) — tasks invisible to target agents
- Security review assigned to Shedward instead of Barkley (GRO-452)
- Tasks marked done after Shedward UAT pass without flowing to Barkley → CEO (GRO-450, GRO-477)