Release Go/No-Go Checklist

Decision Rule

• GO: all mandatory checks pass.
• NO-GO: any mandatory check fails or unresolved SEV-1/SEV-2 risk exists.

Architecture and Contracts

• Architecture ADR set finalized
• OpenAPI validated + lint clean
• AsyncAPI validated
• Breaking changes reviewed with migration notes

Security

• Threat model reviewed
• Security control verification complete
• No unresolved critical/high vulns
• Secret scanning clean

Data and Billing Integrity

• Ledger invariants pass
• Migration validation pass (forward + rollback)
• Stripe webhook replay/idempotency tests pass

Reliability and Operations

• SLO dashboards and alerts live
• Runbooks published for critical incidents
• Incident severity and escalation policy active
• Backup/restore drill completed

Delivery

• CI pipeline all required gates green
• Release notes and compatibility notes complete
• Approval recorded by platform + security owners