zero-check-pipeline/templates/architect-sweep-checklist.md

Architect Sweep Checklist

Run this review after the gauntlet is green and container verification passes. Timebox to 5 minutes. Focus on intent, not syntax.

Pre-review

• Pull up the diff: git diff <last-clean-baseline>..HEAD
• Confirm validate/results.json shows all checks passed

Outbound calls

• Search for requests, httpx, urllib, http.client, net/http
• Every outbound call has a clear, expected destination
• No unexpected domains or IPs
• No data being sent that shouldn't be (tokens, user data, telemetry)

Auth and access control

• No try/except: pass around auth logic
• No commented-out auth decorators or middleware
• No hardcoded credentials, even "temporary" ones
• Route protection is consistent (no unprotected admin endpoints)

Obfuscation

• No unexplained Base64 or hex-encoded strings
• No dynamically constructed URLs from encoded parts
• No eval(), exec(), or subprocess with string interpolation

Dependency changes

• Any new dependencies are real, well-known packages
• No typosquatting (check spelling against PyPI/Go modules)
• Version pins are present where expected

Test quality

• Tests assert actual behavior, not just assert True
• Tests have meaningful names describing what they verify
• No tests that just call a function without checking the result
• Mock boundaries are at external integration points, not internal logic

Architecture

• External integrations are behind clean interfaces (not scattered)
• No new global state or singletons without justification
• Error handling is specific, not broad exception swallowing
• File/network resources are properly closed

Final decision

• APPROVE — code is safe to promote
• REJECT — document reason, kick back to LLM or fix manually