Most release checklists fail in the same way: the items are true by inspection. "Authentication is secure." "Errors are handled properly." "Performance is acceptable." Nobody can fail them, so nobody does, and the checklist becomes a document that was ticked.
What a pass criterion is
An observable result a second person can verify from the text alone. Compare:
Item: Login is protected against brute force. Criterion: Send 20 failed attempts within 60 seconds to login, OTP and password reset; attempts are refused before the 20th, and the refusal is logged with the account or address.
The second version can be run by someone who has never seen the product, and two people running it get the same answer. That is the whole test of a criterion.
The rules we used
Writing the 53 items, we applied four rules.
A number or a state, never a quality. "Within 10 seconds", "zero rows", "4xx with no state change", "every table". Not "fast", "isolated", "rejected properly".
A method that names the tool or the action. Scan the built assets; query the catalog; send an unsigned event; block the network mid-request. The how column says whether a person, a script or a named tool does it.
A severity if failed, from a fixed scale. Critical is data exposure, money or account takeover. High is a broken core flow. Medium is degraded. Low is cosmetic or reporting. The scale is on the checklist page so a finding's severity is not negotiated per release.
A mapping to a documented pattern. Every item points to at least one entry in the failure catalogue with a source. An item that catches nothing anyone has documented is a preference, not a check.
The item we had to think about
DR-05, the release record, is the one item whose criterion is about paperwork: the record names the checklist version, the verdict (a one-word release result (pass, pass with findings, fail) with the findings and the checklist version behind it), the build hash and the tester. It is low severity. It earned its place because every other item's result is only useful if it is written down where the next person can find it.
Run it yourself
The checklist is public because a criterion you cannot run yourself is not a criterion. The service is that we run it on every release and sign the result. The checklist page has all 53.