PROOF-CARRYING CHANGE (PCC-1) — TEMPLATE

Use this for any change that could materially affect users, revenue, data integrity, availability, or security. Paste into the PR description or change request and link evidence.

1) INTENT (1 paragraph)
- What is changing:
- What is not changing:
- User-facing impact (if any):

2) SCOPE + DEPENDENCIES
- Services/components touched:
- External dependencies (vendors/APIs/libraries):
- Backward compatibility considerations (clients, schemas, configs):

3) PRE-MORTEM RISKS (write before rollout)
List the most likely ways this fails in production.
- Risk #1:
 - Trigger/symptom:
 - Blast radius (who/what breaks):
- Risk #2:
 - Trigger/symptom:
 - Blast radius:
- Risk #3:
 - Trigger/symptom:
 - Blast radius:

4) VERIFICATION (links, not claims)
- Tests executed (unit/integration/contract/e2e):
- Manual checks performed:
- Queries/dashboards reviewed:
- If you used an AI coding assistant: what parts were AI-assisted and what was human-reviewed?

5) DEPLOYMENT + ROLLOUT PLAN
- Deployment method (standard pipeline, manual steps):
- Rollout strategy (staged, canary, region-by-region, feature flag):
- Rollout checkpoints (what must be true to continue):

6) MONITORING (how we’ll know fast)
- Primary signals (metrics/logs/traces/user reports):
- Alert thresholds (qualitative if you can’t specify numbers):
- Who is on-call / responsible during rollout window:

7) ROLLBACK / KILL SWITCH
- Fast rollback steps (exact command/runbook link):
- Data rollback considerations (migrations, backfills):
- Conditions that require rollback (clear triggers):

8) OWNERSHIP + APPROVALS
- DRI (directly responsible individual):
- Required reviewers (CODEOWNERS / security / data):
- Escalation path if risk is discovered late:

9) POST-DEPLOYMENT EVIDENCE (fill in after)
- What happened during rollout:
- Issues detected and actions taken:
- Follow-ups created (tickets/PRs) with owners:

PCC-1 CHECKLIST (quick gate)
[ ] Intent is explicit and bounded.
[ ] Top risks are written as failure modes, not generic worries.
[ ] Verification is linkable and reproducible.
[ ] Monitoring can detect the stated failure modes.
[ ] Rollback does not require a hero.
[ ] A DRI is named and reachable during rollout.