Definition of Done Template

Copy the checklist below into the Story issue (or PR body) and fill it out before requesting review. Annotation rules mirror the org PR template:

• [x] item passes and is verifiable now.
• [ ] — <who/when> item is pending; state who will verify and when. An unannotated [ ] reads as an oversight, not an open task.
• [x] — N/A (<reason>) item does not apply; reason is mandatory so reviewers do not re-derive it.

---

Definition of Done

Code quality

• Code passes ruff lint with no errors.
• Code passes mypy with no errors. Where a third-party library lacks inline types (no py.typed), install its stub package as a dev dependency (e.g. boto3-stubs[<service>], types-requests) rather than suppressing with ignore_missing_imports — only suppress when no stubs exist.
• No commented-out code or unresolved TODO comments left in the diff (TODOs added intentionally must link to a follow-up issue).

Test coverage (RAG006)

• pytest --cov=rag_sample --cov-branch --cov-fail-under=90 passes (90% aggregate line + branch).
• Per-file floor check passes: no non-excluded file below 70% combined line + branch.
• All tests use Given / When / Then comment structure leading each block (org dev standards).
• Integration tests added where the story touches an AWS service boundary (Aurora Data API, Bedrock, API Gateway) — or marked N/A with reason.

API contract (RAG005)

• backend/openapi.yaml regenerated and committed if any FastAPI route, schema, or security scheme changed.
• CI openapi-check diff passes (no drift between committed spec and what FastAPI produces).
• CODEOWNERS sign-off obtained for spec changes (API author + designated consumer rep) — or marked N/A if spec is unchanged.

Architecture and decisions

• ADR written or updated if an architectural decision was made or reversed — or marked N/A if no new decision.
• C4 model updated if a new component, relationship, or deployment boundary was added — or marked N/A.

Observability (RAG008)

• New Lambda code uses Logger, Tracer, and Metrics from AWS Lambda Powertools; no print() statements.
• Authorization header (and any other secrets) confirmed absent from log output; test asserts scrubbing if the story touches the authorizer or request-logging path.
• Any new CloudWatch log group has explicit retention_in_days = 30 set in Terraform (never default-infinite).

Secrets and security (RAG009, #25)

• No secrets, API keys, or credentials appear in code, config files, or committed test fixtures.
• Any new Lambda role follows least-privilege: actions and ARNs scoped to only what the function needs in each environment.
• Secrets Manager paths follow the per-env naming convention; no cross-env secret references.

Infrastructure and cost

• Infracost diff reviewed; cost delta is acceptable or justified in the PR body.
• Terraform plan reviewed for unintended resource replacements before applying.

PR standards (org dev standards)

• PR title matches #<story-number>: <description> (sentence-case, imperative, max 70 chars after prefix, no trailing period).
• PR body contains all required sections: Story, What changed, How to test locally, How to test in QA, Tests completed, Standards checklist.
• Every checklist item in the PR body is either [x], [ ] — <who/when>, or [x] — N/A (<reason>). No unannotated [ ] items.

QA exit criteria

• Story deployed to QA (auto on merge to main, RAG001).
• Manual smoke test performed in QA against the acceptance criteria in the Story issue.
• No regressions observed in CloudWatch logs or X-Ray traces during the QA smoke test.
• QA CloudWatch alarm is in OK state at time of Prod approval request.

Documentation

• Any operator-facing procedure introduced by this story (e.g., key issuance CLI, migration step) is documented in the relevant guide or runbook page.
• This DoD checklist is complete and honest; no item is left unannotated.