For compliance and audit
For compliance leads and internal audit. The complete change population for any window, mapped to each clause, in a portal your auditor can use, signed so they can verify it.
If this sounds familiar
Fieldwork starts in six weeks and the change-management sample is due before it.
- Control
- Approvals enforced, not documented after the fact. Exceptions need a reason and an expiry.
- How it works
- Proof
- Every change in the window, including drift, with signed evidence and RFC 3161 timestamps.
- How it works
- One rulebook
- Framework packs as data: the clause, what it requires and which record evidences it.
- How it works
Allow partial refunds from the merchant dashboard
Asked by A. Patel, with Claude Code · change CHG-2291 · 7d3a9c…41fe
- The change, in plain words
- Merchants can refund part of a payment instead of all of it. Adds a
refund_amountcolumn and one endpoint.14 files · +412 −38 · 1 migration - Risk, and why
- Touches payments code
- Includes a database migration
- Written with an AI agent
- Evidence
- 1,284 tests passed
- No secrets, 0 critical CVEs
- Built in CI, signed
- Verified in staging for 26 h
- Blast radius
- Business service Card payments. Impact tolerance: no more than 2 hours of disruption.Canary 5% → 25% → 100%, halts if errors pass 0.5%
- Backout plan
- One-step rollback to v4.17.3. The migration has a tested down-migration; the 06:00 verified backup is the fallback.
2 approvers, never the requester
- R. Lindqvist (you)
- Waiting
- J. Osei, Risk
- Waiting
- Rollout
- Not started
Your signature will cover change 7d3a9c…41fe and nothing else.
What to tell your boss
“Audit prep becomes an export, and the auditor can check the evidence without taking our word.”
Forward the one-page board briefSee what shipped without approval in your last 90 days.
Install the GitHub App and the scan arrives in minutes: every repo scored, every unreviewed merge and unapproved deploy named. Nothing is blocked until you choose.
Ship like a startup. Prove it like a bank.