Vellum Feature Flag Rollout

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

assistant/CLAUDE.md

assistant/src/approvals/CLAUDE.md

assistant/src/notifications/CLAUDE.md

assistant/src/runtime/CLAUDE.md

gateway/CLAUDE.md

Audit 0.4.1 · source sha 19bc86343b63 · 14 Oct 2026Report an issue or request a re-scan

• Publishervellum-ai GitHub organizationOwner of the repository this skill is read from
• Source foldervellum-ai/vellum-assistant/.cursor/skills/vellum-feature-flag-rolloutThe exact folder we audited
• LicenceMITAs the repository states it
• Commit pinned for this verdict19bc86343b63A new audit runs when the source changes
• Repository statusNot archivedLast push 1 day ago
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Guide Vellum Assistant feature flag changes and rollout hygiene. Use when adding, editing, reviewing, or documenting assistant feature flags, rollout-gated behavior, or platform flag follow-up work.

---
name: vellum-feature-flag-rollout
description: Guide Vellum Assistant feature flag changes and rollout hygiene. Use when adding, editing, reviewing, or documenting assistant feature flags, rollout-gated behavior, or platform flag follow-up work.
---

# Vellum Feature Flag Rollout

## Flag Rules

Assistant feature flags use simple kebab-case keys and must be declared in:

```text
meta/feature-flags/feature-flag-registry.json
```

New flags require:

- `scope: "assistant"`
- a canonical kebab-case key
- a safe default
- tests or guard coverage when resolver behavior changes
- a companion `vellum-assistant-platform` PR to provision the flag in Terraform

## Rollout Hygiene

There is no release-note surfacing mechanism — the workspace-bulletin feature was removed and the historical release-note migrations are frozen. Do not add new release-note migrations for any feature (flagged or GA). If a release needs user-facing notes, design an explicit on-demand surfacing mechanism first.

## Permission Controls V2

Under `permission-controls-v2`, do not add new deterministic approval modes for assistant-owned actions beyond the conversation-scoped host computer access gate. Avoid global toggles, persistent trust-rule UI, wildcard scopes, and time-window approvals.

## Review Workflow

1. Confirm whether the change adds, renames, removes, or consumes a flag.
2. Check registry declaration and key format.
3. Check default behavior and rollout safety.
4. Check docs, release notes, and user-facing copy for flag leaks.
5. Check whether the platform repo needs a Terraform update.
6. Recommend focused tests for resolver, route, UI, or behavior changes.

## PR Notes

Call out:

- flag key
- default state
- rollout plan
- companion platform PR status
- whether release notes are intentionally omitted

Excerpt, first 1,812 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

git clone https://github.com/vellum-ai/vellum-assistant
git -C vellum-assistant checkout 19bc86343b63

Works in

1. 2026-10-14
   ✓SAFE B 89 / 100

   first audit · source 19bc86343b63

Questions about Vellum Feature Flag Rollout

• github.com/vellum-ai/vellum-assistant/tree/main/.cursor/skills/v — the audited source at commit 19bc86343b63 and every finding aboveObserved · 14 Oct 2026

Spotted something wrong? Report a correction · Methodology