Workflow pattern detection — observe human-AI interactions and auto-generate automations

[deefactorial]

Description

The AI-SDLC framework currently governs AI agent behavior, but it doesn't learn from how humans use those agents. We need a system that observes human-AI interaction patterns, detects repetitive workflows, and proposes deterministic automations that eliminate manual toil.

The key principle: The LLM observes and proposes, but the output is deterministic automation — shell scripts, YAML workflows, skill files. No AI in the runtime loop.

Architecture

Layer 1: Observe — Session Telemetry

• Claude Code session transcripts (available via transcript_path in hook input)
• Tool call sequences (Bash commands, file edits, reads)
• Prompt patterns (what users ask repeatedly)
• Pipeline audit log events
• Git commit patterns and timing

Layer 2: Detect — Pattern Recognition

• Sequence mining across sessions to find repeated tool call chains
• Frequency analysis: "user runs X after Y in 80% of sessions"
• Frustration signals: repeated failed attempts, copy-paste cycles
• Time-based patterns: "every Monday the user does X"

Example patterns to detect:

• "User copied CI output to Claude to fix it 5 times on one PR" → needs /fix-pr command
• "User always runs build+test+lint before committing" → needs pre-commit hook
• "User creates GitHub issue from Slack discussion weekly" → needs emoji trigger
• "User manually checks PR status, copies review findings, pastes to Claude" → needs automated fix-review loop

Layer 3: Propose — Automation Candidates

• Each detected pattern generates a proposal with:
  • Description of the observed pattern
  • Frequency and confidence score
  • Proposed automation type (skill, hook, workflow, or slash command)
  • Draft implementation
• Proposals are presented to the human for review
• Could be surfaced via Slack, CLI output, or a dashboard

Layer 4: Apply — Generate Deterministic Automation

• Human approves a proposal
• System generates the appropriate artifact:
  • .claude/skills/<name>/SKILL.md for interactive workflows
  • .claude/commands/<name>.md for slash commands
  • .claude/hooks/<name>.sh for pre/post tool hooks
  • .github/workflows/<name>.yml for CI/CD automations
• The automation is committed as code — version-controlled, reviewable, deterministic
• No LLM in the runtime execution path

Data Sources

Source	What It Captures	Access Method
Claude Code transcripts	Tool calls, prompts, results	transcript_path from hook input
AI-SDLC audit log	Pipeline stage events, decisions	orchestrator/src/audit-extended.ts
GitHub Actions logs	CI results, workflow runs	gh api
Git history	Commit patterns, file change frequency	git log
Slack messages	Discussion patterns, issue triggers	Slack API

Example Workflow

1. After 5 sessions, the system detects: "User always copies CI failure output, pastes to Claude, asks to fix, pushes, repeats"
2. System proposes: "Create a /fix-pr slash command that automatically fetches CI logs and review findings"
3. User approves
4. System generates .claude/commands/fix-pr.md with the workflow steps
5. Next session, user types /fix-pr 49 instead of the manual cycle

Prior Art

• GitHub Copilot Workspace — observes edit patterns
• Temporal workflows — detect repeated human-in-the-loop steps
• Process mining (Celonis) — discover workflows from event logs
• Claude Code Insights — already analyzes session patterns (we can build on this)

Complexity

8

Acceptance Criteria

• Session telemetry collector captures tool call sequences from Claude Code transcripts
• Pattern detection engine identifies repeated 3+ step sequences across sessions
• Proposal generator creates draft automations (skills, hooks, workflows) from detected patterns
• Proposals include confidence score, frequency, and draft implementation
• Human review interface presents proposals for approval/rejection
• Approved proposals generate deterministic artifacts (committed to repo)
• At least 3 pattern types detected: command sequences, copy-paste cycles, periodic tasks
• Integration with existing Claude Code Insights data

[deefactorial]

✅ Security Triage: PASSED

Risk Score: 2/10
Safe: true

Findings

• Issue proposes access to session transcripts and telemetry data, which could include sensitive information
• Mentions automated generation of workflow files (.github/workflows/*.yml) which are security-sensitive
• Proposes system that auto-generates and commits code artifacts based on AI analysis

Rationale

This is a legitimate feature request for workflow automation based on pattern detection. While it involves sensitive operations like accessing transcripts and generating workflow files, it explicitly requires human review and approval, includes proper security boundaries, and follows standard development practices.

---

This issue passed automated security triage.
A maintainer must still manually apply the ai-ready label to enable AI processing.

Analyzed by AI-SDLC Security Triage

[deefactorial]

AI-SDLC: Manual Routing Required

Complexity 8 exceeds the AI-eligible threshold (max 3). Routed as "ai-assisted" — requires human involvement.

A maintainer can manually add the ai-eligible label to override.

Routed by AI-SDLC