# Secure feature contract and release checklist

Blank work product. Replace bracketed fields with system-specific facts. Unknown evidence stays unknown; do not mark a control passed because a template is complete.

## Feature contract

- Feature / owner / revision / supported clients: [facts]
- Legitimate user story: [actor, action, object, result]
- Data classification and retention: [what, why, where, how long]
- Abuse goals: [specific unauthorized effects]

## State transitions

| From→to | Who may request it | Trusted prerequisites | Atomic effect | Failure / retry behavior | Evidence |
| --- | --- | --- | --- | --- | --- |
| [receive→quarantine] | [actor] | [permission, quota] | [durable state] | [cleanup / no publish] | [test] |

## Input, authority and output contract

| Boundary | Allowed input / action | Rejected cases | Enforcement location | Ordinary-use test | Abuse test |
| --- | --- | --- | --- | --- | --- |
| [API/file/worker/download] | [explicit contract] | [examples] | [component] | [ID] | [ID] |

## Operations and release

- Observable events without sensitive bodies: [fields]
- Budget / concurrency / queue limits: [measurable values]
- Dependency failure behavior: [fail closed, retry, cleanup]
- Rollback and already-created data: [procedure]
- Release candidate and test artifact identity: [exact match]
- Remaining risk, owner, deadline, escalation: [record]
- Decision and approver: [evidence-based outcome]