Change Control designed
GPUaaS change control is evidence-first and contract-first. A change should move from source authority to implementation to checks to review to release evidence, with the same discipline whether the author is a human or an agent.
Change Flow
Release Promotion Sequence
Rules
| Rule | Meaning |
|---|---|
| Contract first | API/event behavior starts in doc/api/** |
| UX first | User-facing flows fit IA and UX specs before broad implementation |
| Evidence first | Done requires tests/checks/artifacts, not narrative only |
| Portable CI | Gate logic lives in scripts, CI YAML is orchestration |
| Release authority | Promote known source SHAs through platform-control policy |
| Guard graduation | Report-only controls should become warning and then blocking gates |
Review Domains
Product, architecture, security, ops, frontend, backend, content, and governance reviews should be routed by the risk and ownership of the change. A docs-only change can still need architecture or security review if it explains a control, boundary, or release posture.
Canonical sources