Summary

• Base branch: master (all contributions)
• What changed and why: (2–5 bullets — the diff shows what, you explain why)
• Scope boundary: (what this PR explicitly does NOT change)
• Blast radius: (what other subsystems or consumers could be affected)
• Linked issue(s): Use plain text outside backticks. Use Closes #,
  Fixes #, or Resolves # only for issues this PR fully resolves. Use
  Related #, Depends on #, or Supersedes # for non-closing relationships.
• Labels: Snapshot the current GitHub labels after labels are applied, for
  example type: docs, risk: low, size: S, docs.

Validation Evidence (required)

Local validation is the signal CI cannot replace. Run the full battery and paste literal output (tails, failures, warnings — not "all passed").

cargo fmt --all -- --check
cargo clippy --all-targets -- -D warnings
cargo test

Docs-only changes: replace with markdown lint + link-integrity (scripts/ci/docs_quality_gate.sh). Bootstrap scripts: add bash -n install.sh.

• Commands run and tail output:
• Beyond CI — what did you manually verify? (scenarios, edge cases, what you did NOT verify)
• If any command was intentionally skipped, why:

Security & Privacy Impact (required)

Yes/No for each. Answer any Yes with a 1–2 sentence explanation.

• New permissions, capabilities, or file system access scope? (Yes/No)
• New external network calls? (Yes/No)
• Secrets / tokens / credentials handling changed? (Yes/No)
• PII, real identities, or personal data in diff, tests, fixtures, or docs? (Yes/No)
• If any Yes, describe the risk and mitigation:

Compatibility (required)

• Backward compatible? (Yes/No)
• Config / env / CLI surface changed? (Yes/No)
• If No or Yes to either: exact upgrade steps for existing users:

Rollback (required for risk: medium and risk: high)

Low-risk PRs: git revert <sha> is the plan unless otherwise noted.

Medium/high-risk PRs must fill:

• Fast rollback command/path:
• Feature flags or config toggles: (or None)
• Observable failure symptoms: (what to grep logs for, which metric moves, which alert fires)

Supersede Attribution (required only when Supersedes # is used)

• Superseded PRs + authors (#<pr> by @<author>, one per line):
• Scope materially carried forward:
• Co-authored-by trailers added in commit messages for incorporated contributors? (Yes/No)
• If No, why (inspiration-only, no direct code/design carry-over):

Labels live in the GitHub label UI, not in the body. Maintainers and reviewers with label permissions set risk:*, size:*, and scope labels via the sidebar. If auto-labels need correction, add risk: manual and the intended label. Contributors without label permission can note the mismatch in a comment.

Do not add bot/AI attribution footers such as Co-authored-by: Claude ...
or Created with Claude Code to the PR body or commit-message tail. Human
co-author trailers are appropriate only for incorporated contributor work under
the supersede-attribution section and privacy contract.

Privacy contract (docs/book/src/contributing/privacy.md) is a merge gate. Never commit real identities, secrets, personal emails, or PII in diff, tests, fixtures, or docs.