Safety checks Every sprint
This page turns a page of principles into a process with evidence behind it. Every sprint, before the release branch is merged, the team works through the checklist and signs the result. Each result is stored as a record that cannot be edited afterwards — this is what a funding body can ask to see when it wants proof that the safety commitments are more than a promise.
How a line gets ticked
A line is only ticked when it is answered with evidence, not from memory: a code search result, a commit link, a screenshot, or a test run. The checklist lives where the work happens, so it is hard to skip:
- docs/guardrail-checklist.md — the 20 checks in full, with the evidence required for each one.
- .github/pull_request_template.md — the checks relevant to the code being changed are copied into every pull request; if they are not ticked, it does not merge.
This page is the register: it shows the result of each sprint and who signed it.
A signed result cannot be edited or withdrawn afterwards.
Checklist by sprint
| Check | What is checked | Group | S5 | S6 | S7 | Most recent evidence |
|---|---|---|---|---|---|---|
| SC-01 | No function or variable that calculates odds takes a user id | Locked | ✅ | ✅ | ✅ | search for adjustOddsBy → 0 results · commit 4f21c9e |
| SC-02 | No timer or countdown component in quizzes or challenges | Locked | ✅ | ✅ | ✅ | search for countdown|setInterval across the quiz and challenge modules |
| SC-03 | No double-or-nothing or all-in action anywhere in the product | Locked | ✅ | ✅ | ✅ | reviewed the action list for every game module |
| SC-04 | The critical state screen, the end-of-run screen and the AI companion all render the support banner from the shared component | Locked | ✅ | ✅ | FAIL | the AI companion is rendering a local copy after the layout fix — blocks release |
| SC-05 | The recovery screen always shows the learning path alongside, not only the random one | Locked | — | — | — | Not applicable yet: the recovery module is not live |
| SC-06 | Schema and routes: there is no way to restore a lost Family asset | Locked | ✅ | ✅ | ✅ | migration review: no column allows the state to be reversed |
| SC-07a | No endpoint buys tokens with real money, under any name | Standard | ✅ | ✅ | ✅ | reviewed every route that writes to a wallet · no payment gateway in the project |
| SC-07b | New tokens come from two sources only: completing a lesson and reaching a fixed Showdown milestone | Standard | ✅ | ✅ | In progress | ledger query waiting on end-of-sprint data |
| SC-08 | No links out to a real betting site; no bookmaker logos or colours; team names stay anonymised | Standard | ✅ | ✅ | ✅ | reviewed every external link plus screenshots of the betting screen |
| SC-09 | No API or interface suggests the next challenge to a player | Standard | — | — | — | Not applicable yet: challenges are not live |
| SC-10 | Cooldown runs off a server timestamp, and no person or role can shorten a valid cooldown | Standard | ✅ | ✅ | In progress | additional check: every intervention this sprint carries two signatures |
| SC-11 | A challenge stops itself once the set number of bets is reached, win or lose | Standard | — | — | — | Not applicable yet: challenges are not live |
| SC-12 | The transparency panel shows every figure in every betting session, and the true-probability formula has unit tests | Standard | ✅ | ✅ | ✅ | test trueProbability.spec · 12 cases, all passing |
| SC-13 | The recovery draw code is completely separate from the betting odds engine | Standard | — | — | — | Not applicable yet: the recovery draw is not live |
| SC-14 | AI companion: signed off by the clinical reviewer, recognises a crisis, and states plainly that it is an AI | Standard | ✅ | ✅ | In progress | the new system instructions are waiting on Dr Alice Brennan to re-sign |
| SC-15 | Sensitive data is de-identified and encrypted; the real-betting survey is voluntary | Standard | ✅ | ✅ | ✅ | admin screen review: no screen displays a name or an email |
| SC-16 | Video skip-blocking still works, and learning rewards stay fixed rather than random | Standard | ✅ | ✅ | In progress | waiting on end-to-end tests against the new player |
| SC-17 | The reward for an abstinence challenge stays a badge and never becomes betting funds | Standard | — | — | — | Not applicable yet: challenges are not live |
| SC-18 | The end-of-challenge report always puts the real win rate next to the theoretical house edge | Standard | — | — | — | Not applicable yet: challenges are not live |
| SC-19 | Every risk warning fact shown to a player carries its source line, not just the name of the reviewer who signed it | Standard | ✅ | ✅ | ✅ | render test: each fact block on a player screen contains Source: · 15 of 15 |
| SC-20 | No challenge screen offers tokens as a reward, and no published completion rate appears without an estimate label or a sample size | Standard | — | — | — | Not applicable yet: challenges are not live |
| (21) proposed | Ban near-miss effects in every random mechanic | Proposed | — | — | — | Not numbered yet — waiting on sign-off |
| (22) proposed | Ban sponsors from targeting players who show higher-risk behaviour | Proposed | — | — | — | Not numbered yet — waiting on sign-off |
Signed records
One record per closed sprint. This is the artefact that leaves the building: it is what the Export record button produces, and what an external reviewer or a funding body is handed when they ask for proof. Each one carries two signatures, at least one from someone who did not write the code being checked.
| Record | Sprint | Result | Signed by | Second signature, outside the code team | Signed on | |
|---|---|---|---|---|---|---|
| GA-2026-06 | Sprint 6 · 29 Jun – 10 Jul | Pass · 14 of 14 | Marcus Hale system admin | Dr Alice Brennan clinical reviewer | 24/07/2026 | |
| GA-2026-05 | Sprint 5 · 15 – 26 Jun | Pass · 14 of 14 | Marcus Hale system admin | Priya Raman impact analyst | 27/06/2026 | |
| GA-2026-07 | Sprint 7 · 13 – 24 Jul | Not signed · 1 line failing | — | — | — | Nothing to export until the result is signed |
A record number is issued when the result is signed and never reused. The contents cannot be edited afterwards — a correction is a new record that refers back to the old one, so the original stays readable.
What is blocking the sprint 7 release
SC-04 · AI companion — after the layout fix, the companion screen is rendering its own copy of the support banner instead of the shared component. This is exactly the kind of fault the checklist exists to catch: the banner was pushed to the bottom of the page to tidy things up, it still looks present, but it has been cut off from the single source. The sprint result is FAIL, and a fail means no release.
What the group column means
Group is not a measure of importance. It is a measure of how firmly the check is settled.
- Locked — agreed with the funder, not open to negotiation, and unchanged since the first sprint.
- Standard — our own engineering standards. The content is sourced, but treating each one as a release blocker is our decision, reviewed each year.
- Proposed — the last two lines are not numbered yet and do not block a release until they are signed off.
Grouping never means a standard check can be skipped while coding. It only records what was agreed with the funder and what we set for ourselves.