vc-risk-evidence-pack

A high-risk software change evidence pack is a structured set of artifacts that captures risk classifications, context snippets, verification steps, and reviewer decisions to ensure auditable governance before finalizing or handing off changes.

You generate a risk-evidence pack by applying the 5-artifact schema to produce risk-gate, context-snippets, verification, review-decision, and adversarial-validation files directly in the harness folder of your active plan.

High-risk software changes include modifications to auth or identity, billing, data migrations, public APIs, deploy or runtime configurations, and trust-boundary logic that require durable governance before handoff.

No, you cannot finalize a high-risk change without reviewer sign-off because the validation process enforces built-in auto-stop rules that require a completed review-decision artifact before allowing completion.

The required artifacts in a manual-first risk-evidence pack are risk-gate.json, context-snippets.json, verification.json, review-decision.json, and adversarial-validation.json, which together form the 5-artifact schema.

Yes, the evidence pack validation runs built-in checks against the 5-artifact schema to ensure all required governance files are present and valid before preventing finalization without sign-off.