54 lines
1.8 KiB
Markdown
54 lines
1.8 KiB
Markdown
# Architect Sweep Checklist
|
|
|
|
Run this review after the gauntlet is green and container verification passes.
|
|
Timebox to 5 minutes. Focus on intent, not syntax.
|
|
|
|
## Pre-review
|
|
|
|
- [ ] Pull up the diff: `git diff <last-clean-baseline>..HEAD`
|
|
- [ ] Confirm `validate/results.json` shows all checks passed
|
|
|
|
## Outbound calls
|
|
|
|
- [ ] Search for `requests`, `httpx`, `urllib`, `http.client`, `net/http`
|
|
- [ ] Every outbound call has a clear, expected destination
|
|
- [ ] No unexpected domains or IPs
|
|
- [ ] No data being sent that shouldn't be (tokens, user data, telemetry)
|
|
|
|
## Auth and access control
|
|
|
|
- [ ] No `try/except: pass` around auth logic
|
|
- [ ] No commented-out auth decorators or middleware
|
|
- [ ] No hardcoded credentials, even "temporary" ones
|
|
- [ ] Route protection is consistent (no unprotected admin endpoints)
|
|
|
|
## Obfuscation
|
|
|
|
- [ ] No unexplained Base64 or hex-encoded strings
|
|
- [ ] No dynamically constructed URLs from encoded parts
|
|
- [ ] No eval(), exec(), or subprocess with string interpolation
|
|
|
|
## Dependency changes
|
|
|
|
- [ ] Any new dependencies are real, well-known packages
|
|
- [ ] No typosquatting (check spelling against PyPI/Go modules)
|
|
- [ ] Version pins are present where expected
|
|
|
|
## Test quality
|
|
|
|
- [ ] Tests assert actual behavior, not just `assert True`
|
|
- [ ] Tests have meaningful names describing what they verify
|
|
- [ ] No tests that just call a function without checking the result
|
|
- [ ] Mock boundaries are at external integration points, not internal logic
|
|
|
|
## Architecture
|
|
|
|
- [ ] External integrations are behind clean interfaces (not scattered)
|
|
- [ ] No new global state or singletons without justification
|
|
- [ ] Error handling is specific, not broad exception swallowing
|
|
- [ ] File/network resources are properly closed
|
|
|
|
## Final decision
|
|
|
|
- [ ] **APPROVE** — code is safe to promote
|
|
- [ ] **REJECT** — document reason, kick back to LLM or fix manually |