chore: restore original directory structure (project under code-review-graph-main/)

2026-08-31 13:08:20 +08:00
parent ecc55158c1
commit ecfd03a21c
404 changed files with 0 additions and 0 deletions
@@ -0,0 +1,12 @@
+# Data Migration — Manual Review Checklist
+
+High-risk module: schema/data migration requires human confirmation.
+
+- [ ] Migration is idempotent and re-runnable
+- [ ] Forward and rollback paths both defined and tested
+- [ ] Backfill is batched / resumable for large tables
+- [ ] Data type / precision changes do not silently truncate
+- [ ] Nullability and default changes safe for existing rows
+- [ ] Migration ordering across shards / replicas is consistent
+- [ ] Application deploys compatibly with both old and new schema (expand/contract)
+- [ ] Irreversible operations are flagged with a documented reason
@@ -0,0 +1,11 @@
+# Distributed Lock — Manual Review Checklist
+
+High-risk module: distributed-lock changes require architecture confirmation.
+
+- [ ] Lock has a TTL / expiry — no permanent deadlock after crash
+- [ ] Lock release is atomic and ownership-checked (compare-and-delete)
+- [ ] Lock scope is correct (key includes the right entity identifiers)
+- [ ] Renewal / watchdog exists for long critical sections
+- [ ] Locking order is consistent across paths (no lock-ordering deadlock)
+- [ ] Fencing tokens / version check prevents stale-holder writes
+- [ ] Fail-open vs fail-closed behavior is intentional and documented
@@ -0,0 +1,11 @@
+# Inventory Module — Manual Review Checklist
+
+High-risk module: stock/inventory changes require human confirmation.
+
+- [ ] Stock decrement is atomic (conditional UPDATE, not read-then-write)
+- [ ] Oversell prevented: `UPDATE ... SET qty = qty - ? WHERE qty >= ?`
+- [ ] Reservation vs. deduction semantics are consistent
+- [ ] Concurrent orders cannot both reserve the last unit
+- [ ] Restock/return increments handled correctly
+- [ ] Inventory events are idempotent (retry-safe)
+- [ ] Async stock updates propagate to downstream (warehouse, carts) safely
@@ -0,0 +1,12 @@
+# Order Module — Manual Review Checklist
+
+High-risk module: order lifecycle changes require human confirmation.
+
+- [ ] State machine transitions are atomic (`WHERE status = ?` updates)
+- [ ] Cancellation / timeout / expiry paths complete all side effects
+- [ ] Order idempotency key prevents duplicate order creation
+- [ ] Price/lock snapshot captured at order time, not at payment time
+- [ ] Partial fulfillment / split-shipment handled
+- [ ] Negative or inconsistent totals impossible
+- [ ] Concurrent edits (cart + order) do not corrupt state
+- [ ] Audit trail: every status change logged with reason
@@ -0,0 +1,14 @@
+# Payment Module — Manual Review Checklist
+
+High-risk module: payment changes require human confirmation for every
+blocker/major fix.
+
+- [ ] Callback idempotency: a duplicated webhook/callback does not double-charge
+- [ ] Amounts stored as fixed-point (integers/cents), never floats
+- [ ] Currency codes and precision handled correctly
+- [ ] Provider signature / HMAC verification on callbacks
+- [ ] Refund logic: correct reversal, no double-refund
+- [ ] Failure path: payment timeout, declined, retry semantics
+- [ ] Transaction boundary spans charge + order-state update
+- [ ] Sensitive data (PAN, tokens) never logged or masked on output
+- [ ] Ledger/journal entries are append-only and auditable
@@ -0,0 +1,11 @@
+# Permission Module — Manual Review Checklist
+
+High-risk module: authorization changes require product/human confirmation.
+
+- [ ] Every endpoint/action enforces the intended permission — no default-allow
+- [ ] Role hierarchy / scoping (tenant, org, user) is consistent
+- [ ] Object-level permissions checked on read AND write
+- [ ] Deny-before-allow ordering is safe
+- [ ] Permission checks cannot be bypassed via IDs, query params, or bulk ops
+- [ ] New permission/role values handled by all consumers (enum completeness)
+- [ ] Sensitive actions audited with actor + target