One production change - its change request, its checklist, its runbook

What this does, and what it does not

The prescan is a real reader, not a keyword search. Unified diffs are segmented per file with hunk accounting; SQL is split into statements with single quotes, double quotes, -- comments, /* */ blocks and dollar-quoted bodies all tracked, so a semicolon inside a literal never splits a statement and a PL/pgSQL function full of them stays one. Each statement is then classified for the strongest lock it takes and whether it can be undone at all — and the modifiers that actually decide the answer are read: CREATE INDEX CONCURRENTLY is not the same risk as CREATE INDEX, and ADD CONSTRAINT … NOT VALID is not the same risk as validating the whole table under a lock. Dependency lines are read as name and version pairs across five manifest dialects and compared as semver, so express ^4.18.2 → ^5.0.1 is reported as a major bump while lodash ^4.17.21 → ^4.17.22 is not.

Everything it finds is handed to the model as facts it must reconcile, and the reply is checked against them afterwards — if a flag goes unanswered, this page says which one. The page reads; it does not run anything, it never connects to a database, and it never reaches your infrastructure. Every command in a runbook is text for a human to read before running. A credential in a diff is already exposed: those are masked in your browser before anything is sent, and the right response is to rotate them, not to delete the line.

Nothing to hand? Load the column-drop release, a migration that drops a column, builds an index without CONCURRENTLY and ships a major dependency bump alongside it, or the capacity and config change, which halves the replica count, shortens a retention window and moves a cron schedule. Both replay a saved run in every lane, for free.