PR has at least one approving review from someone other than the author.
CI checks pass (tests, lint, build).
Static analysis findings reviewed.
Dependency scanning findings reviewed; no new criticals/highs.
Secret scan clean.
Env / config check — every new production env var that holds a secret reads from Vault at runtime; no secret values in .env, config.yaml, values.yaml, container images, Helm charts, Terraform state, static Secret manifests, or CI logs. See Secrets Management → Application configuration and environment variables.
Migrations are backward-compatible (or flagged with an explicit downtime plan).
