Skip to content

Release Review Procedure

Supports: ../policies/change-management-policy.md, ../policies/secure-development-policy.md. Owner: DIR. Applies to every PR before merge to main. Ties: OPS-04, GOV-03, SEC- / PRIV- upkeep.

Purpose

A single pre-merge checklist that makes the change-management and secure- development policies concrete — and keeps the data room current as a byproduct of shipping, not a pre-audit sprint.

Pre-merge checklist

  1. Spec & scope. The change matches its Atelier spec; scope creep is called out.
  2. Reviewed. The PR is reviewed via the Atelier checkpoint; it merges to main (no review-bypassing direct push).
  3. Tests. Tests appropriate to the change pass. Safety/retention/rate-limit paths keep their smoke tests green (safety_smoke.py, rate_limit_smoke.py, presence_smoke.py where touched).
  4. Security review (if it touches auth/data/matching/messaging/safety/admin):
  5. object-level authz enforced in the query (no IDOR); extend the cross-user 404 test if a new read path was added (SEC-04, SEC-15);
  6. block separation preserved at any new read/derive path (SAF-01);
  7. input whitelisted, errors sanitized (no echoed values) (SEC-06);
  8. consent tier honoured for any event emission (ai-ml-data-governance- policy.md).
  9. Secret / PII scan. Run the rg scan for banned patterns (see below); the diff introduces no secrets or PII — safe labels only (../policies/data-classification-and-handling-policy.md).
  10. git diff --check is clean (no whitespace errors / conflict markers).
  11. Control-register upkeep (GOV-03). Update the relevant control row(s) — status, evidence link, last-verified date — or state explicitly why the change is control-neutral.
  12. Decision log (GOV-01). Record any material decision with date + rationale in READINESS.md.
  13. Counsel queue. Any new legal/privacy question is added to ../counsel-queue.md with a working assumption — never block on it.

Suggested secret/PII scan

Run from the repo root; investigate any non-label hit before merge:

rg -n -i -e 'aws_secret_access_key|aws_access_key_id' \
        -e 'BEGIN (RSA |EC |OPENSSH |)?PRIVATE KEY' \
        -e 'xoxb-|ghp_|sk-[A-Za-z0-9]{20,}' \
        -e 'password\s*[:=]\s*\S' \
        -e 'https?://[^ ]*[?&](token|access_token|code|state)=' \
        dataroom/

A label like DATABASE_URL or RATE_LIMIT_* is fine; a value is not. A real hit that was about to be committed is an incident (incident-response-playbook.md) — rotate the secret.

Production releases

GCP production exists. Any production-affecting change must include the security preflight gates (secure-development-policy.md), a rollback plan, a migration plan for schema changes, and an action-register update for accepted risks or GA/SLA gates. Until staging exists (ACT-002), production changes require extra DIR/OPS review.

Done when

All checklist items pass, the secret/PII scan is clean, and the data room reflects the change.