---
description: "System default workflow for unplanned work"
targets:
  - unplanned
autoSelect: false
updateMode: strict
requires:
  skills: []
  mcp: []
---
# Default Unplanned Work

## Goal

Handle unexpected, interrupt-driven work with the smallest safe action that addresses the immediate trigger, preserves relevant evidence, verifies the affected state, and makes any remaining structured work explicit.

Use this workflow when unplanned work does not have a more specific repository or domain template. It is suitable for urgent fixes, investigation, cleanup, operational response, documentation correction, data or artifact repair, follow-on discoveries, and bounded maintenance tasks.

## Rules

- Identify the trigger, urgency, affected surface, current-work relationship, and requested outcome before changing state.
- Keep the scope limited to the unplanned trigger and the smallest useful fix, analysis, repair, or containment step.
- Preserve evidence before changing state when evidence may be lost, disputed, or needed for review.
- Do not perform broad refactors, speculative improvements, unrelated cleanup, or opportunistic modernization.
- Separate proof of the requested unplanned outcome from proof that a note, plan, or blocker report was produced. A report is completion evidence only when reporting is the requested deliverable.
- Prefer reversible actions and inspectable evidence. Use human approval before irreversible, risky, ambiguous, or externally visible changes.

## Suggested Process

### 1. Classify The Interruption

- State what triggered the work, why it is unplanned, how urgent it appears, and what surface or artifact is affected.
- Determine whether this blocks, modifies, or is independent from the current work.
- Define the narrow target outcome and the evidence a reviewer should inspect to decide whether it was achieved.

### 2. Check Safety And Scope

- Inspect only the context needed to confirm risk, ownership, dependencies, and likely blast radius.
- Decide whether immediate action is safe, whether containment or investigation is safer, or whether approval is required first.
- If the work is too broad for a bounded unplanned action, perform only safe triage or containment and route the rest to follow-up work.

### 3. Preserve Evidence When Relevant

- Capture the current state before modifying it when the issue involves failure symptoms, data or artifact repair, operational state, user-visible behavior, auditability, or potential regression.
- Record enough source, timestamp, command, file, API, screenshot, log, or observed-state evidence for a reviewer to understand the before state.

### 4. Act Narrowly

- Apply the smallest useful change, repair, cleanup, investigation, or containment step that addresses the confirmed trigger.
- Avoid touching adjacent areas unless they are required to complete the narrow outcome or prevent immediate harm.
- If new findings reveal a larger problem, stop expanding the change and decide whether to split follow-up work.

### 5. Verify And Decide Next Routing

- Verify the exact affected state or artifact using the strongest practical evidence available for the domain.
- Compare the observed result against the narrow target outcome, not just against completion of the attempted action.
- Name any remaining uncertainty, residual risk, skipped checks, and whether the remaining work belongs in the same unplanned action, a follow-up issue, or human handoff.

## Handoff To Human When

- The safe action boundary remains unclear after inspecting accessible evidence.
- The work requires approval for irreversible, destructive, externally visible, privacy-sensitive, financial, legal, security-sensitive, or operationally risky action.
- Required credentials, permissions, private context, or unavailable external information blocks verification or safe execution.
- The next decision depends on product, policy, priority, or operational judgment rather than inspectable evidence.

## Success Criteria

- The trigger, urgency, affected surface, and relationship to current work are identified from available evidence.
- The action taken is the smallest useful fix, investigation, repair, cleanup, or containment step within the confirmed unplanned scope.
- Completion criteria are falsifiable and reviewer-checkable: they name the evidence type, the affected state or artifact to inspect, and the expected observed result.
- Verification evidence proves the requested unplanned outcome itself, or the result is explicitly marked blocked with blocker evidence and the next safe action.
- Any broader remaining work, speculative improvement, or unresolved risk is excluded from the unplanned scope and routed as follow-up or human handoff when appropriate.
