devflow-kit 1.8.2 → 2.0.0

package/src/assets/skills/compliance/frameworks/pci-dss/reference.md

@@ -0,0 +1,55 @@
+# PCI DSS — Code-Level Checks
+
+**Standard**: PCI DSS v4.0.1 (Payment Card Industry Data Security Standard)
+
+## Never Store
+
+PCI DSS prohibits storing these elements after authorization under any circumstances:
+
+| Element | Prohibition |
+|---------|------------|
+| Full magnetic-stripe / chip data (track data) | Never stored — Req 3.3.1.1 |
+| CAV2/CVC2/CVV2/CID (card verification codes) | Never stored — Req 3.3.1.2 |
+| PINs / PIN blocks | Never stored — Req 3.3.1.3 |
+| Full PAN unmasked | Render unreadable (tokenize or encrypt) — Req 3.5.1 |
+
+**Pattern**: grep model/schema files for `cvv|cvc|cvv2|track_data|track1|track2|pin_block`.
+
+## Scope Minimization (Req 1 / Req 12.5.2)
+
+Limit cardholder data (CHD) to systems that require it:
+- Tokenize at the point of entry (Req 3.5); pass token not PAN to downstream services
+- Network segmentation: CHD environment must not share a subnet with unscoped systems
+- Code review: trace PAN from entry point — it must not appear in logs, analytics, or non-payment services
+
+## Key Requirements as Code Checks
+
+### Req 3 — Protect Stored Account Data
+- PAN stored only where necessary; rendered unreadable (AES-256, tokenization, truncation)
+- Retain CHD only as long as a documented business/legal/regulatory need exists (Req 3.2.1); PCI DSS sets no fixed retention period — define and enforce your own retention policy per QSA guidance
+
+### Req 6.x — Develop and Maintain Secure Systems
+- No injection flaws (parameterized queries)
+- No hard-coded credentials or cryptographic keys in source code
+- Dependency scanning in CI/CD pipeline
+
+### Req 10 — Log and Monitor All Access to System Components
+- Log all access to CHD: user, datetime, action, resource
+- Logs must be tamper-evident and retained for **12 months** (3 months online)
+- Failed authentication attempts logged and alerted
+
+## Tokenization Pattern
+
+```typescript
+// NEVER pass raw PAN beyond the payment entry boundary
+const { token } = await paymentVault.tokenize({ pan: req.body.cardNumber });
+// Store and use token; raw PAN is dropped
+await orders.create({ userId, paymentToken: token, amount });
+```
+
+## Common Code-Level Gaps
+
+- PAN logged in request/response interceptors for debugging
+- CVV field persisted in a draft-order or session table
+- Payment callback webhook handler echoes full card data back in response
+- Test fixtures with real-looking card numbers (use approved test PANs only)

package/src/assets/skills/compliance/frameworks/soc2/fragment.md

@@ -0,0 +1,10 @@
+## Mapping
+| CC6.1 | CC6.7 | CC6.1 | CC7.2 | CC6.5 | CC6.6 |
+
+## Reference
+CC6/CC7/CC8.1 trust-services criteria expressed as code checks
+
+## Checklist
+
+## Rule
+- Apply SOC 2: enforce CC6/CC7 controls — access logging, incident-response hooks, and change-management gates.

package/src/assets/skills/compliance/frameworks/soc2/reference.md

@@ -0,0 +1,53 @@
+# SOC 2 — Code-Level Checks
+
+**Standard**: AICPA Trust Services Criteria (TSC) — Security, Availability, Confidentiality
+
+## Relevant Trust Services Criteria
+
+### CC6 — Logical and Physical Access Controls
+
+| Criterion | Code obligation |
+|-----------|----------------|
+| CC6.1 | Classify data at rest; encrypt sensitive/confidential data stores |
+| CC6.3 | Role-based access; enforce at API layer — never rely on UI gating alone |
+| CC6.5 | Remove access when employment or role changes (offboarding triggers) |
+| CC6.6 | Restrict external network access; firewall/SG rules scoped to required IPs |
+| CC6.7 | Encrypt regulated data in transit; no plaintext transmission channels |
+
+### CC7 — System Operations
+
+| Criterion | Code obligation |
+|-----------|----------------|
+| CC7.2 | Detect and log anomalies: failed auth, privilege escalation, bulk exports |
+| CC7.3 | Documented incident response procedures reachable from the code repo |
+
+### CC8 — Change Management
+
+| Criterion | Code obligation |
+|-----------|----------------|
+| CC8.1 | All production changes via version-controlled PR; no direct console/DB edits |
+
+## Change Management Pattern (CC8.1)
+
+```typescript
+// Every schema migration must be code-reviewed and deployed via pipeline
+// Direct DB modifications that bypass migrations violate CC8.1
+// Pattern: version-controlled migration + PR + CI gate before merge
+```
+
+## Audit Log Requirements (CC7.2)
+
+Each security-relevant event must include:
+- `actor` — authenticated user or service account ID (never anonymous)
+- `action` — what was attempted and whether it succeeded
+- `resource` — the target object and its classification
+- `timestamp` — UTC ISO-8601; clock source must be NTP-synchronized
+- `purpose` — business justification for sensitive operations
+
+## Common Code-Level Gaps
+
+- Audit events missing `actor` field (logged before auth middleware runs)
+- Bulk data export endpoints with no rate limit or alert threshold (CC7.2)
+- Shared service-account credentials used across environments (CC6.1, CC6.5)
+- Feature flags that can disable security controls in production (CC6.3)
+- Database migrations applied outside the CI/CD pipeline (CC8.1)

package/src/assets/skills/compliance/frameworks/sox/fragment.md

@@ -0,0 +1,10 @@
+## Mapping
+| — | ITGC | — | ITGC | SOX §802 | ITGC |
+
+## Reference
+ITGC change control, segregation of duties, 7-year retention, audit integrity
+
+## Checklist
+
+## Rule
+- Apply SOX: enforce ITGC change control, segregation of duties, and 7-year audit-log retention.

package/src/assets/skills/compliance/frameworks/sox/reference.md

@@ -0,0 +1,67 @@
+# SOX — Code-Level Checks
+
+**Law**: Sarbanes-Oxley Act of 2002 — §404 (Internal Controls) and §802 (Records Retention)
+
+SOX §404 applies to internal controls over financial reporting (ICFR). Relevant code areas: financial data stores, general ledger integrations, ERP connectors, billing systems, and the CI/CD change-management pipeline that deploys them.
+
+## ITGC — IT General Controls
+
+IT General Controls are the primary SOX intersection with software engineering. Key domains:
+
+### Change Management (CC8.1 in SOC 2 terms; ITGC-CM)
+
+All changes to financial systems must follow:
+1. Documented change request with business justification
+2. Code review by someone other than the author
+3. Testing in a non-production environment
+4. Approval by an authorized approver (segregation of duties)
+5. Deployment via the automated pipeline — no manual console/DB changes
+
+**Code review flag**: any migration, schema change, or configuration update to a financial system that lacks a PR and reviewer.
+
+### Segregation of Duties (ITGC-SOD)
+
+- The developer who implements a financial feature must not be the sole approver of their own change
+- Service accounts used to process financial transactions must not have the ability to modify their own audit logs
+- No single role can initiate AND approve a financial transaction
+
+### Access Management (ITGC-AM)
+
+- Access to financial system databases must be role-based; no shared credentials
+- Privileged access (e.g., direct DB write to a ledger table) requires just-in-time approval and audit logging
+- Offboarding must revoke financial system access within one business day
+
+## §802 — Records Retention
+
+Financial records must be retained for **7 years**. Code obligations:
+- `retainUntil` on financial records = created + 7 years
+- Deletion of financial records before retention period is a criminal violation; implement hard guards
+- Audit logs covering financial transactions are themselves financial records — same 7-year rule
+
+```typescript
+// SOX §802: financial records retained for 7 years; hard guard against early deletion
+async function deleteRecord(id: string): Promise<Result<void, DeleteError>> {
+  const record = await financialRepo.findById(id);
+  if (!record) return Err({ type: 'NotFound' });
+  if (record.retainUntil > new Date()) {
+    return Err({ type: 'RetentionPolicyViolation', retainUntil: record.retainUntil });
+  }
+  await financialRepo.delete(id);
+  return Ok(undefined);
+}
+```
+
+## Delta vs SOC 2 CC8.1
+
+SOC 2 CC8.1 covers change management for all in-scope systems. SOX adds:
+- **Criminal liability** for records destruction (§802)
+- Mandatory external audit attestation (§404)
+- Explicit segregation of duties for financial transaction approvals
+- 7-year retention anchor (vs. the variable periods in SOC 2)
+
+## Common Code-Level Gaps
+
+- No retention guard on financial record deletion (§802 violation risk)
+- Developer self-merging PRs for financial system changes (ITGC-SOD)
+- Audit log sink with write access granted to the application service account (ITGC-AM)
+- Financial data in a non-production environment without de-identification (ITGC-AM)

package/src/assets/skills/compliance/references/detection.md

@@ -0,0 +1,108 @@
+# Detection Patterns
+
+Grep patterns and IaC globs for automated compliance surface detection.
+
+## PII / PHI Field Name Patterns
+
+```bash
+# Grep source files for common PII field names
+grep -rn \
+  -e '\bssn\b' -e '\bsocial_security\b' \
+  -e '\bdob\b' -e '\bdate_of_birth\b' -e '\bbirth_date\b' \
+  -e '\bcredit_card\b' -e '\bcard_number\b' -e '\bpan\b' \
+  -e '\bcvv\b' -e '\bcvc\b' -e '\bcvv2\b' \
+  -e '\btrack_data\b' -e '\btrack1\b' -e '\btrack2\b' \
+  -e '\bpin_block\b' \
+  -e '\bmedical_record\b' -e '\bmrn\b' -e '\bdiagnosis\b' \
+  -e '\bnational_id\b' -e '\bpassport\b' \
+  --include='*.ts' --include='*.js' --include='*.py' --include='*.go' \
+  src/ lib/
+```
+
+## Logging Sinks Near PII
+
+```bash
+# Find logging calls that appear within 5 lines of PII field references
+# Use: grep -A5 -B5 patterns near PII identifiers
+grep -rn \
+  -e 'console\.\(log\|error\|warn\)' \
+  -e 'logger\.\(info\|error\|warn\|debug\)' \
+  -e 'log\.\(info\|error\|warn\|debug\)' \
+  --include='*.ts' --include='*.js' \
+  src/ | grep -i 'email\|ssn\|password\|credit\|card\|cvv\|dob\|mrn'
+
+# Python
+grep -rn 'logging\.\|logger\.' --include='*.py' src/ | grep -i 'email\|ssn\|password\|credit'
+```
+
+## Crypto Misuse
+
+```bash
+# Weak or prohibited algorithms
+grep -rn \
+  -e '\bmd5\b' -e 'createHash.*md5' \
+  -e '\bsha1\b' -e 'createHash.*sha1' \
+  -e '\bdes\b' -e '\b3des\b' -e '\brc4\b' \
+  -e 'Math\.random.*token\|Math\.random.*secret\|Math\.random.*key' \
+  --include='*.ts' --include='*.js' --include='*.py' \
+  src/
+
+# Hardcoded secrets near crypto calls
+grep -rn \
+  -e 'AES.*["\x27][A-Za-z0-9+/=]\{16,\}["\x27]' \
+  -e 'secret\s*=\s*["\x27][^"$\x27]\{8,\}["\x27]' \
+  --include='*.ts' --include='*.js' \
+  src/
+```
+
+## IaC Compliance Globs and Indicators
+
+### Terraform (`**/*.tf`)
+
+```bash
+# Public storage exposure
+grep -rn 'acl\s*=\s*"public' --include='*.tf' .
+grep -rn 'publicly_accessible\s*=\s*true' --include='*.tf' .
+
+# No encryption
+grep -rn 'encrypted\s*=\s*false' --include='*.tf' .
+grep -l 'aws_s3_bucket' --include='*.tf' -r . | \
+  xargs grep -L 'server_side_encryption_configuration'
+
+# Wildcard IAM
+grep -rn '"Action"\s*:\s*"\*"\|"Resource"\s*:\s*"\*"' --include='*.tf' .
+
+# Disabled access logging
+grep -l 'aws_s3_bucket' --include='*.tf' -r . | xargs grep -L 'logging'
+```
+
+### Kubernetes (`**/k8s/**/*.yaml`, `**/kubernetes/**/*.yaml`)
+
+```bash
+grep -rn 'runAsRoot\|privileged:\s*true\|allowPrivilegeEscalation:\s*true' \
+  --include='*.yaml' k8s/
+# Missing securityContext is a finding if the workload handles regulated data
+```
+
+### Dockerfiles
+
+```bash
+# Secrets in ENV instructions
+grep -rn '^ENV.*\(SECRET\|TOKEN\|PASSWORD\|KEY\|API_KEY\)' Dockerfile*
+# Running as root
+grep -rn '^USER root\|^RUN.*su -' Dockerfile*
+```
+
+### CI/CD (`.github/workflows/*.yml`)
+
+```bash
+grep -rn 'echo.*\(SECRET\|TOKEN\|PASSWORD\)' .github/workflows/
+# Plaintext secrets echoed in run steps
+grep -A3 'env:' .github/workflows/*.yml | grep -v '\${{' | grep -i 'secret\|token\|key'
+```
+
+## 0.0.0.0/0 Network Exposure
+
+```bash
+grep -rn '0\.0\.0\.0/0\|::/0' --include='*.tf' --include='*.yaml' --include='*.json' .
+```

package/src/assets/skills/compliance/references/sources.md

@@ -0,0 +1,28 @@
+# Primary Sources
+
+Authoritative references for the compliance skill. All framework-specific controls are grounded in these documents.
+
+## Regulatory and Standards
+
+| Source | Version / Date | Access |
+|--------|---------------|--------|
+| **GDPR** — General Data Protection Regulation | Regulation (EU) 2016/679 | https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679 |
+| **HIPAA** — Health Insurance Portability and Accountability Act | 45 CFR Parts 160, 162, 164 | https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html |
+| **PCI DSS** — Payment Card Industry Data Security Standard | v4.0.1 (June 2024) | https://www.pcisecuritystandards.org/document_library/ |
+| **SOX** — Sarbanes-Oxley Act | Pub.L. 107-204 (2002) §404, §802 | https://www.congress.gov/107/plaws/publ204/PLAW-107publ204.pdf |
+| **ISO/IEC 27001** | 2022 edition (incl. Amd 1:2024), Annex A | https://www.iso.org/standard/82875.html |
+| **AICPA Trust Services Criteria** | 2017 (updated 2022) | https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria |
+
+## Engineering Frameworks
+
+| Source | Version | Access |
+|--------|---------|--------|
+| **NIST SSDF** — Secure Software Development Framework | SP 800-218 (Feb 2022) | https://csrc.nist.gov/publications/detail/sp/800-218/final |
+| **OWASP ASVS** — Application Security Verification Standard | 5.0 | https://owasp.org/www-project-application-security-verification-standard/ |
+
+## Framework-to-Control Mapping Notes
+
+- GDPR Art. 25 (data protection by design) and NIST SSDF PO.1.3 overlap: both require security/privacy embedded in design, not bolted on
+- PCI DSS Req 6.x and OWASP ASVS V14 (configuration) address the same secure-development lifecycle concerns; ASVS gives more code-level specifics
+- SOC 2 CC8.1 and SOX ITGC change-management controls are substantively equivalent; SOX adds criminal liability and the 7-year retention anchor
+- ISO/IEC 27001 A.14.2 (secure development) and NIST SSDF are complementary; SSDF is more prescriptive at the build-pipeline level

package/src/assets/skills/consistency/SKILL.md

@@ -0,0 +1,140 @@
+---
+name: consistency
+description: This skill should be used when reviewing code for naming convention violations, pattern deviations, or inconsistent API styles.
+user-invocable: false
+allowed-tools: Read, Grep, Glob
+---
+
+# Consistency Patterns
+
+Domain expertise for code consistency and unnecessary simplification detection. Use alongside `devflow:review-methodology` for complete consistency reviews.
+
+## Iron Law
+
+> **MATCH EXISTING PATTERNS OR JUSTIFY DEVIATION**
+>
+> New code should look like existing code. If the codebase uses camelCase, use camelCase.
+> If errors return Result types, return Result types. Consistency trumps personal preference.
+> Deviation requires explicit justification and team agreement. One codebase, one style.
+
+---
+
+## Consistency Categories
+
+### 1. Unnecessary Simplification
+
+Content truncation, stripped configuration, removed error context.
+
+```typescript
+// VIOLATION: Oversimplified error messages
+const errorMessages = {
+  INVALID_EMAIL: 'Invalid email',  // Was: detailed format guidance
+  USER_NOT_FOUND: 'Not found',     // Was: helpful next steps
+};
+
+// CORRECT: Preserve helpful context
+const errorMessages = {
+  INVALID_EMAIL: 'Please enter a valid email address in the format user@domain.com',
+  USER_NOT_FOUND: 'We could not find an account with that email. Please check or create a new account.',
+};
+```
+
+### 2. Pattern Violations
+
+Naming conventions, error handling styles, import/export organization.
+
+```typescript
+// EXISTING PATTERN: Result types
+function existingFunction(): Result<User, Error> {
+  if (!valid) return Err(new ValidationError('...'));
+  return Ok(user);
+}
+
+// VIOLATION: Throws instead of Result
+function newFunction(): User {
+  if (!valid) throw new Error('...');  // Different pattern!
+  return user;
+}
+
+// CORRECT: Match existing
+function newFunction(): Result<User, Error> {
+  if (!valid) return Err(new ValidationError('...'));
+  return Ok(user);
+}
+```
+
+### 3. Feature Regression
+
+Removed CLI options, changed return types, removed event emissions.
+
+```typescript
+// VIOLATION: Removed event emissions break listeners
+class OrderService {
+  async createOrder(data: OrderData) {
+    const order = await this.repository.create(data);
+    return order;  // Events removed - listeners won't fire!
+  }
+}
+
+// CORRECT: Preserve all event emissions
+class OrderService {
+  async createOrder(data: OrderData) {
+    const order = await this.repository.create(data);
+    this.events.emit('order.created', order);
+    this.events.emit('inventory.reserve', order.items);
+    return order;
+  }
+}
+```
+
+### 4. Style Inconsistency
+
+Brace style, quote style, trailing commas, naming conventions.
+
+```typescript
+// EXISTING: camelCase for functions
+function getUserById(id: string) { }
+function createOrder(data: OrderData) { }
+
+// VIOLATION: Different naming style
+function Process_Payment(amount: number) { }  // snake_case
+
+// CORRECT: Match existing
+function processPayment(amount: number) { }
+```
+
+---
+
+## Extended References
+
+For extended examples and detection commands, see:
+
+- `references/violations.md` - Extended violation examples by category
+- `references/patterns.md` - Extended correct pattern examples
+- `references/detection.md` - Bash commands for detecting issues
+
+---
+
+## Severity Guidelines
+
+| Severity | Description | Examples |
+|----------|-------------|----------|
+| **CRITICAL** | Breaking changes or significant content loss | API return types changed, CLI options removed, events removed |
+| **HIGH** | Inconsistency requiring attention | Error handling pattern mismatch, naming violations, export pattern change |
+| **MEDIUM** | Style inconsistency | Import organization, brace/quote style, formatting differences |
+| **LOW** | Minor observations | Personal preference territory, linter should catch |
+
+---
+
+## Consistency Checklist
+
+Before approving changes, verify:
+
+- [ ] Naming matches existing patterns (camelCase, PascalCase, etc.)
+- [ ] Error handling matches existing approach (throw vs Result)
+- [ ] Import organization matches existing files
+- [ ] Export style matches existing modules
+- [ ] No user-facing content was unnecessarily shortened
+- [ ] No configuration options were silently removed
+- [ ] No CLI flags/options were removed without deprecation
+- [ ] All removed functionality has explicit justification

package/src/assets/skills/database/SKILL.md

@@ -0,0 +1,134 @@
+---
+name: database
+description: This skill should be used when reviewing database queries, migrations, indexes, or schema changes.
+user-invocable: false
+allowed-tools: Read, Grep, Glob
+---
+
+# Database Patterns
+
+Domain expertise for database design and optimization. Use alongside `devflow:review-methodology` for complete database reviews.
+
+## Iron Law
+
+> **EVERY QUERY MUST HAVE AN EXECUTION PLAN**
+>
+> Never deploy a query without understanding its execution plan. Every WHERE clause needs
+> an index analysis. Every JOIN needs cardinality consideration. "It works in dev" is not
+> validation. Production data volumes will expose every missing index and inefficient join.
+
+## Database Categories
+
+### 1. Schema Design Issues
+
+| Issue | Problem | Solution |
+|-------|---------|----------|
+| Missing Foreign Keys | No referential integrity, orphaned records | Add FK with ON DELETE action |
+| Denormalization | Unnecessary duplication, update anomalies | Normalize unless performance requires |
+| Poor Data Types | VARCHAR for everything, lost precision | Use appropriate types (DECIMAL, BOOLEAN, TIMESTAMP) |
+| Missing Constraints | No data validation at DB level | Add NOT NULL, CHECK, UNIQUE constraints |
+
+**Example - Missing Constraints:**
+```sql
+-- VIOLATION
+CREATE TABLE products (id SERIAL, name VARCHAR(100), price DECIMAL);
+
+-- CORRECT
+CREATE TABLE products (
+  id SERIAL PRIMARY KEY,
+  name VARCHAR(100) NOT NULL CHECK (LENGTH(TRIM(name)) > 0),
+  price DECIMAL(10, 2) NOT NULL CHECK (price >= 0)
+);
+```
+
+### 2. Query Optimization Issues
+
+| Issue | Problem | Solution |
+|-------|---------|----------|
+| N+1 Queries | Query per iteration, O(n) round trips | JOIN or batch with IN/ANY |
+| Missing Indexes | Full table scans on large tables | Add indexes for WHERE/JOIN columns |
+| Full Table Scans | Functions prevent index use | Functional indexes or query rewrite |
+| Inefficient JOINs | Joining before filtering | Filter early, select specific columns |
+
+**Example - N+1 Query:**
+```typescript
+// VIOLATION: 101 queries for 100 users
+for (const user of users) {
+  user.orders = await db.query('SELECT * FROM orders WHERE user_id = ?', [user.id]);
+}
+
+// CORRECT: 2 queries total
+const orders = await db.query('SELECT * FROM orders WHERE user_id = ANY($1)', [userIds]);
+```
+
+### 3. Migration Issues
+
+| Issue | Problem | Solution |
+|-------|---------|----------|
+| Breaking Changes | Data loss, no recovery path | Phased approach with backups |
+| Data Loss Risk | Type changes truncate data | Validate before changing types |
+| Missing Rollback | Cannot undo migration | Always implement down() method |
+| Performance Impact | Table locks during migration | Add columns nullable, backfill in batches |
+
+**Example - Safe Column Addition:**
+```sql
+-- Step 1: Add nullable (instant)
+ALTER TABLE users ADD COLUMN phone VARCHAR(20);
+-- Step 2: Backfill in batches
+UPDATE users SET phone = 'UNKNOWN' WHERE phone IS NULL AND id BETWEEN 1 AND 10000;
+-- Step 3: Add constraint after backfill
+ALTER TABLE users ALTER COLUMN phone SET NOT NULL;
+```
+
+### 4. Security Issues
+
+| Issue | Problem | Solution |
+|-------|---------|----------|
+| SQL Injection | String interpolation in queries | Parameterized queries only |
+| Excessive Privileges | App has GRANT ALL | Minimum required privileges |
+
+**Example - SQL Injection:**
+```typescript
+// VULNERABLE
+const query = `SELECT * FROM users WHERE email = '${email}'`;
+
+// SECURE
+const query = 'SELECT * FROM users WHERE email = $1';
+await db.query(query, [email]);
+```
+
+---
+
+## Extended References
+
+For detailed examples and detection commands, see:
+
+- **[references/violations.md](references/violations.md)** - Extended violation examples with explanations
+- **[references/patterns.md](references/patterns.md)** - Correct patterns and migration strategies
+- **[references/detection.md](references/detection.md)** - Automated detection commands
+
+---
+
+## Severity Guidelines
+
+| Severity | Criteria | Examples |
+|----------|----------|----------|
+| **CRITICAL** | Data integrity or severe performance | SQL injection, N+1 unbounded, data loss migrations, missing FK on critical relations |
+| **HIGH** | Significant database issues | Inefficient JOINs, missing constraints, migrations without rollback |
+| **MEDIUM** | Moderate concerns | Minor denormalization, missing non-critical indexes |
+| **LOW** | Minor improvements | Naming conventions, index organization |
+
+---
+
+## Database Checklist
+
+Before approving database changes:
+
+- [ ] All queries have appropriate indexes
+- [ ] N+1 patterns identified and resolved
+- [ ] Migrations have rollback scripts
+- [ ] Data types are appropriate
+- [ ] Constraints enforce business rules
+- [ ] Foreign keys maintain referential integrity
+- [ ] No SQL injection vulnerabilities
+- [ ] Performance tested with production-like data volume