AGENT-SAFE SHIPPING CHECKLIST (PR GATES + ROLLOUT TEMPLATE)

Use this when your team uses GitHub Copilot/Cursor/Cody or any workflow where AI generates non-trivial diffs.

1) CLASSIFY THE CHANGE (pick one)
- Docs/comments only
- Tests only
- Internal tooling
- Product code (no data model change)
- API behavior change
- Database migration / schema change
- Authn/authz or payments
- Infra/IAM/CI pipeline

2) REQUIRED PR METADATA (fail the PR if missing)
- Intent: one sentence describing the user/system behavior change
- Blast radius: what breaks if this is wrong (which service, which endpoint, which table)
- Rollout plan: canary/staged vs full rollout, and where you’ll watch signals
- Rollback plan: exact rollback action (revert commit, feature flag off, deploy previous image, down migration path)

3) REVIEW RULES (minimum)
- Someone is the “intent owner” (name a human who will take the page if this regresses)
- Code owner review required for: auth/payments, migrations, CI/IAM, public API changes
- Cap PR size for AI-generated code. If it’s too big to review, split it.

4) CI/CHECKS TO REQUIRE (choose based on change type)
- Always: build + unit tests + lint/typecheck
- API behavior: integration tests + contract tests if you have service consumers
- Migrations: migration safety review (locks, indexes, backwards compatibility) + integration tests
- IAM/CI: policy-as-code checks (OPA/Conftest) + least-privilege review
- Dependencies: security/license scan (GitHub Advanced Security or Snyk)

5) RELEASE SAFETY DEFAULTS
- Prefer feature flags for behavior changes
- Use staged rollout/canary for high-risk paths
- Ensure you can rollback faster than you can deploy
- Confirm dashboards/alerts exist for the affected path BEFORE merging

COPY-PASTE PR TEMPLATE
Title: [AREA] concise change description
Intent:
Blast radius:
Tests:
Rollout plan:
Rollback plan:
Observability (dashboards/alerts to watch):
Notes (risk, follow-ups, flags):

If you adopt one habit: never merge AI-generated changes to auth, payments, migrations, or IAM without an explicit rollout + rollback plan in the PR.