---
name: review-production-change
description: Independently audit a production release for hidden correctness, data, dependency, environment, and rollout risks. Use after implementation and staging verification, especially when the change includes ETL output, caches, background workflows, or deployment ordering.
---

# Review Production Change

Act as an independent release reviewer. Treat the implementation summary, tests, and green staging result as evidence, not proof.

## Establish the release boundary

1. Identify the production base, proposed head, acceptance criteria, rollout plan, and rollback path.
2. Inspect the complete diff.
3. List application, schema, data, workflow, cache, configuration, deployment, test, and monitoring changes.
4. Separate experimental changes from the production change.
5. Stop and report if unrelated work cannot safely ride with the release.

## Build the risk model

Ask:

- What must exist before this code runs?
- What happens between two workflows?
- Can a later commit bypass a pending prerequisite?
- Does green evidence name the target environment?
- Can a cache preserve an empty result?
- Are totals computed at the grain claimed by the product?
- Can missing or censored data look like zero?

Prioritize temporal and lineage risks.

## Verify independently

1. Trace one visible value from source through parser, storage, query, cache, API, and UI.
2. Exercise the negative path for each new gate.
3. Confirm workflow ancestry when one deployment depends on another.
4. Run relevant tests and the production build.
5. Open staging and test the changed path.
6. Derive at least one oracle from source evidence or an external observation.

## Report findings

Use this format:

```text
[severity] Short finding title

Evidence:
- file, workflow, query, or visible behavior

Failure mode:
- concrete sequence that produces harm

Required correction:
- smallest change that closes the gap
```

Choose one decision: `blocked`, `ready for staging`, or `ready for production PR`.

Never merge or deploy because the review is green. Preserve the human approval boundary.