Verify

Outcome: Merge-ready main — all automated gates green, human review complete, no Critical security findings (or time-bound exception).

Goals

• Full automated test pyramid in CI
• Blocking secret/SAST/SCA gates
• Human reviewer for logic, design, and spec fit
• AI PR review advisory → blocking when tuned

Key roles

Role	Accountable for
DEV	Fix failures, address review
QA	Test strategy, gate thresholds
SEC	Scan policy, exceptions (SOP-012)

→ QA perspective · Security perspective

Decision guides

• Automated testing & QA
• Linters & static analysis
• AI guardrails & security
• Identity, access & secrets

Topic deep dives

• QA & guardrails

Reference SOPs

SOP	Procedure
SOP-005	PR review
SOP-012	Security exceptions

Non-negotiables

Block merge

Any new secret pattern in diff · Critical SAST/SCA (unless documented exception) · Failing contract tests

---

← Build · Lifecycle overview · Release →