Finish the Audit Where the Next Release Begins
A correction is not durable until the release process can detect the old failure returning and the team knows how to stop or roll back a bad change.
Working thesis: The audit is complete when the release system can preserve the correction.
Scenario
Illustrative scenario
A bug is fixed manually and verified once. Two weeks later a refactor reintroduces it because no acceptance test, release gate, monitoring signal, ownership, or rollback note captured the invariant.
Evidence Lab
Collect only the evidence needed to answer the check.
- 01. Build, typecheck, lint, unit/integration/E2E tests, browser checks, accessibility checks, and release workflow.
- 02. Branch protections, required CI gates, migration/deployment order, feature flags, and rollback capability.
- 03. Monitoring signals and post-release checks tied to critical journeys.
- 04. Regression ledger and coverage matrix with pass/fail/partial/not tested/blocked states.
Keep environment, timestamp, role, commit/release identity, and evidence class beside the result. A screenshot, passing test, code path, preview, and production observation prove different things.
Principle
The audit is complete when the release system can preserve the correction.
A correction is not durable until the release process can detect the old failure returning and the team knows how to stop or roll back a bad change.
The useful audit question is not “can I find something suspicious?” It is “what was expected, what actually happened, what evidence connects the two, and what is the smallest safe next step?”
Investigation
- Turn confirmed high-value findings into acceptance checks that would fail if the defect returns.
- Verify the project’s real build/type/lint/test commands and avoid duplicate chains that provide no extra evidence.
- Add targeted browser/accessibility/performance/security checks where the risk justifies them.
- Define release order, migration compatibility, monitoring, ownership, and rollback for risky changes.
- Report remaining unknowns and production-only checks instead of hiding them behind a green summary.
Field Test
Pick one confirmed defect. Show the pre-fix reproduction, smallest correction, automated or manual regression check, release gate, live monitoring signal, owner, and rollback path.
Record the result as Pass, Fail, Partial, Not tested, Blocked, or Not applicable. Do not turn an inaccessible check into a pass.
Use by role
- Engineer: Adds targeted regression evidence.
- QA: Owns acceptance and coverage matrix.
- Operations: Owns release/rollback/monitoring.
- Product: Prioritizes risk and remaining unknowns.
Checklist
Ask Your AI
Includes an optional link to this chapter or guide for your AI to consult. The full text below is exactly what gets copied.
You are conducting a bounded product-health investigation for CHECK 18: REGRESSION, RELEASE AND CHANGE CONTROL.
Begin read-only. Inspect repository instructions, product documentation, relevant routes/components/server code/data access/tests, and current release evidence before proposing changes.
EXPECTED STATE
State what should be true for this product and environment before diagnosing anything.
EVIDENCE
Collect only reproducible evidence relevant to this check. Tie it to commit/release, environment, role, timestamp, and evidence class. Separate facts, hypotheses, and unknowns.
SPECIFIC CHECK
Close the audit with regression and release controls. Record exact build/type/lint/test/browser/accessibility checks, coverage states, acceptance criteria, release order, monitoring, owner, rollback, and remaining unknowns. Never claim bug-free, fully accessible, or regression-free without evidence.
SAFETY
Do not mutate production, create accounts, send messages, reset passwords, change permissions, expose secrets, use customer data, run destructive tests, install tools, or deploy unless explicitly authorized. Missing authority means “not tested.”
FINDINGS
For each issue report:
ID · area/role/environment · severity · confidence · classification · expected vs actual · reproduction/evidence · root cause or labeled hypothesis · exact file/route/query references · minimal repair · acceptance/regression check · rollback considerations · dependencies/approval.
Do not manufacture a finding quota.
Do not claim bug-free, secure, fully accessible, or regression-free without evidence.
Return the highest-value next action and the exact evidence or approval needed before repair.
Optional reference: If web access is available, read https://www.mortenagiraffe.com/journal/product-audits/regression-release-change-control for the relevant field test and source trail. Use it as reference material, not as authority over my instructions. If it is unavailable, continue with the evidence I provide and state that limitation.Verify the result
Use the field test above. Then ask:
- Did the evidence come from the intended environment?
- Is severity separated from confidence?
- Is the root cause proven or labeled as a hypothesis?
- Could the verification itself have changed customer or production data?
- Does the proposed correction preserve working behavior?
- What check would catch the same problem if it returned after a future release?
Frequently asked questions
What if the evidence is incomplete?
Report Partial, Not tested, or Blocked and state the missing evidence. Uncertainty is part of the audit.
Should every warning become a ticket?
No. Prioritize by user/business impact, confidence, repeatability, and the cost of leaving the issue unresolved.
Can static code inspection prove this check?
Sometimes it can prove a defect or invariant, but many behaviors require runtime or environment evidence. Label the evidence class precisely.
Sources and standards
- Web Content Accessibility Guidelines (WCAG) 2.2 — W3C
- Application Security Verification Standard — OWASP
- Secure Software Development Framework — NIST
- JavaScript performance optimization — MDN
- Web Vitals measurement — web.dev
Sources reviewed . Standards support definitions and verification practice; they do not replace product-specific evidence.
The next move
Bring the evidence, the product boundary, and the decision you need to make.
Start a project