From fefc8846c359b24d32eda7f74e697d2266df15e6 Mon Sep 17 00:00:00 2001
From: Paul O'Reilly <hello@pauloreilly.nz>
Date: Sun, 30 Aug 2026 02:56:03 +1200
Subject: [PATCH] templates: reference triggers.yaml with WT-ADV safe defaults
 (M41)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

version: 2 + auto_advance default deny — imported projects are inert until
a human applies a grant tag (spec/workflow-triggers.md §3b WT-ADV-8).

Claude-Session: https://claude.ai/code/session_012arAwUuBQrpnMzJ36mEVBk
---
 .../triggers/triggers-template.yaml           | 34 +++++++++++++++++++
 1 file changed, 34 insertions(+)
 create mode 100644 task-templates/triggers/triggers-template.yaml

diff --git a/task-templates/triggers/triggers-template.yaml b/task-templates/triggers/triggers-template.yaml
new file mode 100644
index 0000000..3e607c8
--- /dev/null
+++ b/task-templates/triggers/triggers-template.yaml
@@ -0,0 +1,34 @@
+# Reference triggers.yaml for new projects — copy to the project's
+# workflow-triggers CRS attachment and edit.
+#
+# version: 2 REQUIRES the auto_advance section (WT-ADV-8,
+# spec/workflow-triggers.md §3b): an imported project's rules are INERT
+# until a human tags an item with a grant tag. This is deliberate —
+# attaching trigger rules must never, by itself, start dispatching work.
+version: 2
+mode: observe   # flip to enforce only after ≥3 nights of observe (WT-OBS-11)
+
+auto_advance:
+  default: deny
+  stop_tag: auto-advance-stop
+  grants:
+    # "milestone tagged auto-advance ⇒ advance it and all its children"
+    - tag: auto-advance
+      stages: all
+      inherit: true
+    # Example of a stage-scoped, non-inheriting grant:
+    # - tag: ai-driven
+    #   applies_to: [epic]
+    #   stages: {epic: [planning, spec]}
+    #   inherit: false
+
+triggers:
+  # Add project rules here. Example:
+  - name: example-noop
+    on_events: [item_state_changed]
+    match:
+      state: __never-matches__
+    action:
+      kind: dispatch_workflow
+      template: replace-me
+      version: 1