Why this matters
Prevents surprises, improves review quality, and reduces accidental risk in production.
Ensure the PR title/description honestly reflects what the diff actually changes. Flag out-of-scope changes (behavioral changes hidden as refactors, unrelated dependency bumps, config/security changes) and require either: - splitting into separate PRs, or - an explicit 'Additional changes' section with rationale and risk/rollout notes.
Prevents surprises, improves review quality, and reduces accidental risk in production.
Side-by-side examples engineers can pattern-match during review.
PR says 'docs update' but changes auth logic and permissions.PR says 'docs update' + separate PR for auth changes, or clearly calls out auth change with tests and rollout.Description: "minor refactor"; diff changes access controlDescription includes all risky changes + review guideFrom the same buckets as this rule.
If the PR claims to fix a specific issue (e.g., 'Fixes #123' / 'Fix PAY-123'), validate it against the real production error. - If an observability MCP is available (Sentry/Datadog/Bugsnag): fetch the event/stack trace and confirm the change addresses the root cause. - Require a regression test (or a clearly documented reason why a test cannot be added). Call out fixes that only hide symptoms (catch-and-ignore, broader retries, defaulting values) without removing the underlying failure mode.