Pull Request Checklist

Use this checklist for feature, bugfix, and launch-hardening PRs.

Required Summary

• What changed.
• Why it changed.
• User or system behavior affected.
• Risk level and rollback notes.

Code Review

• [ ] Authenticated routes call getCurrentUser.
• [ ] Database access is scoped by firmId.
• [ ] Prisma queries use select where practical.
• [ ] Mutations validate input before writes.
• [ ] Secrets and tokens are never returned to the client.
• [ ] AI output that affects legal work has citations or approval routing.
• [ ] Jobs, webhooks, and uploads are idempotent or replay-safe.
• [ ] Realtime events are scoped to authorized rooms.
• [ ] New public APIs update OpenAPI/developer portal docs.

Testing

• [ ] Focused unit or route tests cover changed behavior.
• [ ] Component tests cover changed UI states.
• [ ] E2E or browser smoke covers cross-route workflows.
• [ ] npm run typecheck passes when TypeScript changed.
• [ ] npm run lint passes when code changed.
• [ ] npm run lint:warning-budget remains 0/0.

Documentation

• [ ] Developer docs updated for new APIs, jobs, AI workflows, storage flows, or

deployment changes.

• [ ] User docs updated when user-facing behavior changes.
• [ ] Environment variables added to .env.example and docs.
• [ ] Migration notes added for schema or data changes.

Release

• [ ] Rollback path is known.
• [ ] Migration is backward compatible or release-gated.
• [ ] Provider credentials and webhooks are ready or marked preview-only.
• [ ] Logs/metrics needed for post-release validation exist.

Screenshots

Attach screenshots or recordings for visual UI changes. Include mobile viewport evidence when layout or navigation changes.