chore: restore original directory structure (project under code-review-graph-main/)

2026-08-31 13:08:20 +08:00
parent ecc55158c1
commit ecfd03a21c
404 changed files with 0 additions and 0 deletions
@@ -0,0 +1,82 @@
+# Unified Review — Generic Checklist
+
+Reference for the Layer-1 chain decomposition and gstack CRITICAL sub-pass.
+Load the language-specific checklist when available (`java-spring.md`,
+`python-django.md`, `python-fastapi.md`, `node-express.md`, `go-gin.md`,
+`csharp-dotnet.md`, `rust.md`, `php-laravel.md`, `ruby-rails.md`); otherwise
+use this generic list.
+
+## Layer 1 — eight categories
+
+For each changed area mark ✅ Clean / ⚠️ Issues Found / — N/A.
+
+1. **Interface** — parameter validation, response conventions, HTTP status
+   codes, rate limiting, API versioning, protocol correctness
+2. **Business** — logic aligns with requirements, state machine correctness,
+   idempotency design, distributed locks
+3. **Data** — SQL injection, query performance, index usage, transaction
+   boundaries, cache invalidation
+4. **Utility** — input validity, no side effects, error return values,
+   date/time timezone handling
+5. **Error handling** — exception classification, fallback logic, error
+   message sanitization, retry with backoff
+6. **Security** — AuthN/AuthZ, sensitive data masking, permission control,
+   CSRF/XSS prevention
+7. **Performance** — N+1 queries, caching strategy, connection pooling,
+   batch operations, blocking in async paths
+8. **Observability** — structured logging with correlation IDs, metrics,
+   health checks
+
+## gstack CRITICAL sub-pass (highest severity)
+
+### SQL & Data Safety
+- String interpolation in SQL — use parameterized queries
+- TOCTOU check-then-set — use atomic `WHERE` + update
+- Bypassing model validations for direct DB writes
+- N+1 queries — missing eager loading
+
+### Race Conditions & Concurrency
+- Read-check-write without uniqueness constraint / duplicate-key retry
+- find-or-create without a unique DB index
+- Status transitions not atomic (`WHERE old_status = ? UPDATE ...`)
+- Unsafe HTML rendering on user-controlled data
+
+### LLM Output Trust Boundary
+- LLM-generated values (emails, URLs, names) written to DB without format
+  validation
+- Structured tool output accepted without type/shape checks
+- LLM-generated URLs fetched without an allowlist (SSRF)
+- LLM output stored in knowledge bases without sanitization (stored prompt
+  injection)
+
+### Shell Injection
+- `subprocess` with `shell=True` AND interpolated command strings
+- `os.system()` with variable interpolation
+- `eval()`/`exec()` on LLM-generated code without sandboxing
+
+### Enum & Value Completeness
+- New enum/status/tier values: read (not just grep) every consumer that
+  switches/filters/displays the value
+- Check allowlists and `case`/`if-elsif` chains for fall-through
+
+## Suppressions — do NOT flag
+- Harmless redundancy that aids readability
+- "Add a comment explaining a threshold" — thresholds drift
+- Consistency-only changes
+- Anything already addressed in the diff
+
+## Severity
+- 🔴 **blocker** — must fix before merge (injection, secrets, missing
+  transaction, auth bypass) → verdict FAIL
+- 🟡 **major** — should fix before merge (missing validation, missing
+  fallback, N+1, unmasked data)
+- 🔵 **minor** — can optimize later (naming, duplicate code, comments)
+
+## Confidence calibration
+- 9-10 verified by reading specific code
+- 7-8 high-confidence pattern match
+- 5-6 medium — show with caveat
+- 3-4 low — move to appendix
+- 1-2 speculation — suppress unless severity would be P0
+
+Every finding: `[SEVERITY] (confidence: N/10) file:line — problem → fix`.