CTO Toolkit
Definition of Done
A completion standard covering verification, security, observability and operability.
How to use this
Treat Done as the contract for “safe to release / merge”. This is where you paint a picture of what good looks like at the end of the work, so nobody has to guess. Adjust per product risk, but never reduce it to “code pushed”.
Verification
- Acceptance criteria are met and evidenced
- Automated tests cover the change at the right level of risk
- Relevant manual exploratory checks completed where automation is insufficient
- Peer review has happened with architecture and security considered
Security & quality
- Secrets, authz and data-handling rules respected
- Known vulnerabilities introduced by the change are addressed or explicitly accepted
- Accessibility / privacy obligations considered where applicable
Operability
- Observability exists for new failure modes (logs, metrics, traces as appropriate)
- Rollback or mitigation path is understood
- Runbooks or support notes updated when behaviour changes for operators
- Documentation that others rely on is updated
This is an original, generic framework for reuse. It is not proprietary employer material.