PR Release Risk Gatekeeper

The problem

Pull requests are often merged based on code style or local logic without a formal assessment of deployment risk. High-pressure releases frequently skip checks for rollback readiness, migration safety, or telemetry coverage, leading to production incidents.

What it does

• Evaluates a single pull request against a formal release rubric to provide a GO/NO-GO decision.
• Validates CI and test evidence to ensure coverage actually matches the specific behavioral changes.
• Audits migration safety, including lock durations, idempotent data handling, and state recovery.
• Identifies unresolved blockers, missing approvals, and gaps in operational observability.
• Generates a post-release watchlist and rollback trigger checklist for the on-call engineer.

Why this beats prompting it yourself

This skill moves beyond code review into operational gatekeeping. It uses a structured evidence framework that treats "missing information" as a risk rather than a pass, preventing the hallucinated confidence common in generic LLM prompts. It enforces a strict blocker policy that ensures one critical risk overrides a high average score.

Use cases

• Perform a final safety check on high-stakes database migrations before merging to main.
• Audit third-party dependency updates for breaking contract changes and supply chain risks.
• Verify deployment readiness for critical features involving complex feature-flag rollouts.
• Generate an auditable release gate report for compliance or SOC2 requirements.

Known limitations

Does not execute code, run migrations, or perform live deployments. It cannot replace specialist security penetration testing or guarantee zero regressions.