# Change management policy

**Draft for review.** Not approved. Owner: `{{SECURITY_OWNER}}`. Last reviewed: `{{REVIEW_DATE}}`.

## Rules

1. Every change is made on a branch. Merging to `main` deploys production, so `main` only receives
   changes that passed `npm run v2:test` and `npm run v2:typecheck`.
2. Each change has a description of what and why. A change to an agreed contract (`docs/v2/api-p*.md`)
   records the deviation in the contract's "as built" section or in `docs/change-requests.md`,
   never silently in code.
3. Schema changes are new numbered migrations (`apps/v2/db/migrations`). A migration that has run
   in production is never edited.
4. Changes to security controls update `docs/compliance/soc2-control-matrix.md` and their tests in
   the same change.
5. A second person reviews changes to authentication, tenant isolation, encryption, billing and
   deletion before merge. (Target state: enforced by branch protection with a required review and
   a CI run; not yet configured.)
6. Emergency fixes may skip the review but not the tests; they are reviewed within two working days.

## Evidence

Git history, merge records, test runs, and the phase contracts with their "as built" sections.