coding-os 0.3.2__py3-none-any.whl

templates/_base/scaffold/docs/engineering/00-index.md

@@ -0,0 +1,9 @@
+<!-- domain:CORE | layer:index | ssot:false | updated:2026-06-06 -->
+# Engineering Rules & References
+
+Purpose: Index of engineering rules, conventions, and reference docs for this project.
+Read when: looking for an engineering rule/reference, or before authoring one with `cos doc-new --layer engineering --path docs/engineering/<slug>.md`.
+
+> Nav: [docs/](../)
+
+Stack-specific engineering docs land here when a stack template is installed. This directory is scaffolded so create-time routing lands somewhere real.

templates/_base/scaffold/docs/governance/00-index.md

@@ -0,0 +1,55 @@
+<!-- domain:DOCS | layer:index | ssot:true | updated:2026-04-28 -->
+# governance Index
+
+Purpose: Auto-generated routing hub for this directory.
+Read when: Locating the canonical doc for the active task.
+Skip when: A higher-level index already routed you to the target file.
+Read next: any of the entries below.
+
+<!-- BEGIN auto-index -->
+
+### Policy (10)
+
+- [Scaffold Boundary Contract](scaffold-boundary-contract.md) — `ssot:true` · updated 2026-04-29
+- [Stack Anatomy Contract](anatomy-contract.md) — `ssot:true` · updated 2026-04-29
+- [Task Lifecycle Policy](task-lifecycle.md) — `ssot:true` · updated 2026-05-08
+- [Documentation System Policy](docs-system.md) — `ssot:true` · updated 2026-05-08
+- [Agent Workflow Policy](agent-workflow.md) — `ssot:true` · updated 2026-05-08
+- [Wrapper Derivation Policy](wrapper-derivation.md) — `ssot:true` · updated 2026-05-10
+- [Docs-First Protocol](docs-first-protocol.md) — `ssot:true` · updated 2026-05-10
+- [Critical Rules — Full Text](critical-rules.md) — `ssot:true` · updated 2026-05-13
+- [GDPR / Privacy Compliance](gdpr-compliance.md) — `ssot:true` · updated {{DATE}}
+- [Risk Register](risk-register.md) — `ssot:true` · updated {{DATE}}
+
+### Reference (2)
+
+- [MCP Tool Inventory](mcp-tool-inventory.md) — `ssot:true` · updated {{DATE}}
+- [Decision Records](decision-records.md) — `ssot:true` · updated {{DATE}}
+
+<!-- END auto-index -->
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+

templates/_base/scaffold/docs/governance/_templates/doc-cheat-sheet.md

@@ -0,0 +1,202 @@
+<!-- domain:DOCS | layer:reference | ssot:true | updated:{{DATE}} -->
+# Doc Cheat Sheet — Decide Structure Before Writing
+
+Purpose: Single decision guide an agent reads BEFORE creating any new documentation file. Maps task intent → layer → directory → template → token budget.
+Read when: About to create or scaffold a new `.md` file under `docs/`.
+Skip when: Editing an existing doc (use `enforce-doc-sync` + read the existing file).
+Read next: [docs-system.md](../docs-system.md), [decision-records.md](../decision-records.md)
+
+> Nav: [Templates Index](../00-index.md) · [Docs Index](../../00-index.md)
+
+---
+
+## 1. Decision Tree (read first)
+
+```
+What are you documenting?
+
+├─ A binding architecture/technology decision        →  ADR
+│   path: docs/architecture/adr/ADR-NNN-slug.md
+│   template: decision-records.md
+│   token budget: 800–1500
+│
+├─ A repeatable workflow / "how to perform X"        →  playbook
+│   path: docs/playbooks/<kebab>.md
+│   template: playbook-template.md
+│   token budget: 1000–2500
+│
+├─ Operational steps for an alert/incident type      →  runbook
+│   path: docs/ops/runbooks/<kebab>.md
+│   template: runbook-template.md
+│   token budget: 800–2000
+│
+├─ Post-incident review (something broke)            →  post-mortem
+│   path: docs/governance/postmortems/YYYY-MM-DD-<slug>.md
+│   template: post-mortem-template.md
+│   token budget: 1500–3000
+│
+├─ API/contract for an endpoint or service           →  spec
+│   path: docs/api-contracts/<service>-endpoints.md
+│   example: docs/api-contracts/error-format.md
+│   token budget: 1500–4000
+│
+├─ Engineering rule that constrains future code      →  policy/rule
+│   path: docs/engineering/<topic>.md
+│   token budget: 800–2000
+│
+├─ Domain glossary / lexicon                          →  reference
+│   path: docs/governance/glossary.md (single file)
+│   token budget: append rows only
+│
+├─ Security review for a change/feature              →  checklist
+│   path: docs/playbooks/security-review.md (extend)
+│   template: security-review-template.md
+│   token budget: 600–1500
+│
+├─ Architecture overview / system map                →  index/spec
+│   path: docs/architecture/NN-<domain>.md
+│   token budget: 1200–3000
+│
+└─ Task execution log                                →  task
+    path: docs/tasks/TASK-NNN-slug.md
+    template: task-detail.md
+    token budget: ≤1500 (lint warns), <3000 (lint blocks)
+```
+
+If the answer doesn't fit any branch above, the doc probably doesn't belong in `docs/` — it's either code-comment territory, a CHANGELOG entry, or it should be subsumed into AGENTS.md / a CLAUDE.md.
+
+---
+
+## 2. Mandatory Header (every new file)
+
+Two equivalent authoring styles. Pick one per file. Mixing both inside a single doc is allowed but discouraged — pick one and stick with it.
+
+### 2a. Long form (default — readable, ~100 tokens)
+
+```html
+<!-- domain:XXX | layer:LAYER | ssot:true|ref | updated:YYYY-MM-DD -->
+# H1 Title (concise, no decoration)
+
+Purpose: One sentence; what this doc covers and why it exists.
+Read when: One bullet describing the trigger condition.
+Skip when: One bullet describing when NOT to read.
+Read next: 1–3 relative links.
+
+> Nav: [Parent Index](./00-index.md)
+```
+
+### 2b. Short form (token-tight — ~30% smaller, same semantics)
+
+```html
+<!-- domain:XXX | layer:LAYER | ssot:true|ref | updated:YYYY-MM-DD -->
+# H1 Title
+
+> P: One-sentence purpose.
+> R: trigger condition.
+> S: when NOT to read.
+> N: link1, link2, link3
+```
+
+Use short form for high-traffic routing files (`docs/governance/*`, every `00-index.md`, every `references/anatomy.md`) where the same opening block is parsed by every agent on every task. Reserve long form for human-onboarding docs (`getting-started.md`, `README.md`) where prose flow matters.
+
+**Sunset plan:** long form is the legacy default. New files SHOULD prefer short form. Long form remains accepted indefinitely for back-compat — the next breaking-version of `doc-cheat-sheet.md` may flip the default. Migration is opt-in; no auto-rewrites.
+
+Both forms are accepted by `docs-lint`, parsed by `cos_doc_header`, and emit `read_next` graph edges via `md_links` extractor. Mechanical surface is identical — only the byte count differs.
+
+`domain` values: PRODUCT · BACKEND · FRONTEND · AI · SECURITY · OPS · DOCS · DOMAIN.
+`layer` values: index · playbook · spec · policy · reference · adr · task · runbook · postmortem.
+`ssot`: `true` if this file is the source of truth on its topic; `ref` if it points elsewhere.
+
+The four `Purpose / Read when / Skip when / Read next` (or `P/R/S/N`) lines are how agents decide in <100 tokens whether to keep reading.
+
+### 2c. Optional frontmatter extras
+
+Three optional keys ride along in the same HTML comment when the doc benefits from them:
+
+- `tokens:NNNN` — author's token budget estimate. Surfaces in `00-index.md` so the agent can fan-out costs.
+- `priority:0.X` — float 0.0–1.0. Routes higher-priority docs to the top of `00-index.md` and `cos_doc_headers_by` results.
+- `reads:[a.md, b.md]` — short-form vector that emits one `read_next` graph edge per target (substitute for a long-form `Read next:` line on a doc with no body to host one).
+
+---
+
+## 3. Anti-Patterns (don't write these)
+
+- ❌ Code dumps. If a reader needs the code, link to it; don't paste it. Code rots; links don't.
+- ❌ Step-by-step API call documentation duplicating the source. Document *intent* and *contract*, link to the endpoint code.
+- ❌ "What this function does" prose. Function name + signature is the doc.
+- ❌ Walls of bullet points without structure. If the section is >12 bullets, it's two sections.
+- ❌ Restating CLAUDE.md / AGENTS.md content. Reference back, don't duplicate.
+- ❌ "Future work" sections that are actually just TODOs. Use the Scrumban board.
+- ❌ Diagrams without a one-line caption explaining what to look for.
+- ❌ Versioned files (`feature-v2.md`, `feature-final.md`). Edit the canonical file; let git track history.
+
+---
+
+## 4. Required Sections by Layer
+
+| Layer | H1 → required H2s |
+|---|---|
+| **adr** | Status · Context · Decision · Consequences · Alternatives Considered |
+| **playbook** | When to use · Inputs · Steps · Verification · Failure modes |
+| **runbook** | Trigger / Alert · Pre-conditions · Steps · Verification · Rollback · Escalation |
+| **post-mortem** | Summary · Timeline · Impact · Root cause · Contributing factors · Action items · Lessons |
+| **spec** (API) | Endpoint surface · Request schema · Response schema · Error contract · Examples · Deprecation policy |
+| **policy** | Scope · Rule · Rationale · Enforcement · Exceptions |
+| **reference** | Index of items · Cross-links |
+| **task** | Outcome · Read First · Acceptance · Work Log |
+
+Hooks (`enforce-template`) check ADR / task / PRD / breakthrough structure. Other layers are convention-enforced via review.
+
+---
+
+## 5. Token-Efficiency Rules
+
+- **Compress prose, preserve structure.** "Use the X library to validate input" → "Validates via X."
+- **One concept per sentence.** Multi-clause sentences cost more to parse.
+- **Lead with verbs.** "Returns the user record." not "This function will return the user record."
+- **Tables beat bullets** for matrices (input/output, role/permission, status/transition).
+- **Code blocks only for verbatim contracts.** A function signature, an error envelope, a config schema.
+- **No screenshots in docs/** — link out or describe the state. (Diagrams as `.svg`/`.mermaid` are fine.)
+
+Target: a competent agent who has the codebase + AGENTS.md should be able to act on the doc in **<5 minutes of reading**. If yours takes longer, it's too long.
+
+---
+
+## 6. Where to Link, Where to Inline
+
+| Information | Place |
+|---|---|
+| Decision rationale ("why we chose X") | ADR — link from playbooks/specs |
+| Step-by-step procedure | Playbook — link from runbooks/post-mortems |
+| Domain term definition | Glossary — never re-define inline |
+| Constraint on future code | `docs/engineering/*.md` rule |
+| Error envelope shape | `docs/api-contracts/error-format.md` |
+| Permission/access matrix | `docs/playbooks/security-review.md` |
+| Pricing / external SLA | `docs/ops/external-services.md` |
+| Roadmap / phase plan | `docs/development-roadmap.md` (single file) |
+
+If you find yourself describing the same thing twice, extract to one location and link.
+
+---
+
+## 7. After Writing — Verification Loop
+
+1. `make docs-lint` (frontmatter + nav + dead-link check).
+2. Confirm `cos_doc_search "<your title>"` finds the new file (FTS5 indexed).
+3. Confirm `cos_graph_query "<filename>"` shows the file as a node with link edges.
+4. If the doc spec'd new code, anchor with `bash .claude/hooks/write-state.sh "$COS_AGENT_DIR/.doc-anchor" "<doc path>"` before coding.
+
+---
+
+## 8. Quick Tells: which template am I missing?
+
+If your task is…
+
+- Wiring a third-party service (Stripe, Twilio) → ADR + playbook
+- Adding a new MCP tool → spec + AGENTS.md routing line
+- Hardening an existing flow → security-review checklist
+- Naming a new domain term → glossary row
+- Documenting a recurring failure → runbook + post-mortem (if recent)
+- Capturing a permanent rule (no Postgres, etc.) → policy under `docs/engineering/`
+
+When in doubt, read [docs-system.md](../docs-system.md) and ask which existing doc this belongs INSIDE before creating a new file.

templates/_base/scaffold/docs/governance/_templates/playbook-template.md

@@ -0,0 +1,81 @@
+<!-- domain:XXX | layer:playbook | ssot:true | updated:{{DATE}} -->
+# Playbook — <Workflow Name>
+
+Purpose: Repeatable procedure for <task>. Optimized so a competent agent or engineer can execute end-to-end without reading sibling docs.
+Read when: <Trigger condition — "before merging X", "when adding a new Y", etc.>
+Skip when: <Negative trigger — "if it's just a typo fix", "if there's already a runbook">.
+Read next: <1–3 most relevant sibling docs>
+
+> Nav: [Playbooks Index](../00-index.md)
+
+---
+
+## When to use
+
+- ✅ <Concrete situation 1>
+- ✅ <Concrete situation 2>
+- ❌ Not for: <out-of-scope situation>
+
+## Inputs
+
+| Name | Type | Source | Required |
+|---|---|---|---|
+| `<input>` | `<type>` | <where it comes from> | ✅ / ❌ |
+| `<input>` | `<type>` | <…> | ✅ / ❌ |
+
+## Pre-conditions
+
+- [ ] <Permission / access ready>
+- [ ] <Dependency in place>
+- [ ] <Branch / state requirement>
+
+## Steps
+
+> Each step states the change, the verification gate, and the rollback. Don't advance without verification.
+
+### Step 1 — <Action verb + target>
+
+```bash
+<exact command>
+```
+
+**Why:** <one-line rationale referencing a rule/spec/ADR>.
+**Verify:** <observable check>.
+**Rollback:** <single command>.
+
+### Step 2 — <next action>
+
+…
+
+### Step N — <Final action>
+
+…
+
+## Verification (full procedure done)
+
+- [ ] <Test command + expected pass>
+- [ ] <Lint / type-check passes>
+- [ ] <Doc updated / reference added>
+- [ ] <Trace event present in logs>
+
+## Failure Modes & Recovery
+
+| Symptom | Likely cause | Action |
+|---|---|---|
+| <error message> | <root> | <fix or escalate path> |
+| <hang / timeout> | <root> | <fix> |
+| <silent no-op> | <root> | <fix> |
+
+## Out-of-scope
+
+- <Things this playbook deliberately does NOT cover, with pointer to where they live>
+
+## Related
+
+- ADR: <link>
+- Runbook: <if there's an alert form>
+- Spec: <if this implements a contract>
+
+---
+
+> Stale playbooks are worse than missing ones. If a step here no longer matches reality, fix it the same day you discover the drift.

templates/_base/scaffold/docs/governance/_templates/post-mortem-template.md

@@ -0,0 +1,85 @@
+<!-- domain:OPS | layer:postmortem | ssot:true | updated:{{DATE}} -->
+# Post-Mortem — <YYYY-MM-DD> <Incident Title>
+
+Purpose: Blameless retrospective for <incident>. Records what happened, why, and what changes prevent recurrence.
+Read when: Investigating a similar failure, or onboarding to incident response in this domain.
+Skip when: Looking for the runbook (use [runbook-template.md](./runbook-template.md) family).
+Read next: [risk-register.md](../risk-register.md), <related ADR>
+
+> Nav: [Post-Mortems Index](../postmortems/00-index.md)
+
+---
+
+## Summary
+
+- **What happened:** <one sentence>
+- **User impact:** <one sentence with concrete numbers — N users, X minutes, $Y revenue>
+- **Status:** Resolved · Mitigated · Investigating
+- **Severity:** P1 / P2 / P3
+- **Detected by:** monitoring · user report · internal · audit
+
+## Timeline (UTC)
+
+| Time | Actor | Event |
+|---|---|---|
+| HH:MM | system | <metric crosses threshold> |
+| HH:MM | <person> | acknowledges alert |
+| HH:MM | <person> | identifies root cause |
+| HH:MM | <person> | applies mitigation |
+| HH:MM | system | metric returns to baseline |
+| HH:MM | <person> | declares resolved |
+
+Total user impact window: HH:MM → HH:MM.
+Total response time: <minutes from detection to resolution>.
+
+## Impact
+
+- **Users affected:** <number / cohort / region>
+- **Requests failed:** <number or %>
+- **Data integrity:** <none lost · N records replayed · <other>>
+- **Revenue / SLA:** <if applicable>
+- **Internal cost:** <pages, hours, distraction>
+
+## Root Cause
+
+One paragraph. The technical cause, stated factually.
+
+## Contributing Factors
+
+- <Factor 1 — process, tooling, monitoring gap, etc.>
+- <Factor 2>
+- <Factor 3>
+
+## What Went Well
+
+- <Things that worked: alert fired, runbook covered, rollback fast>
+
+## What Went Poorly
+
+- <Things that didn't: detection latency, missing dashboard, paged the wrong person>
+
+## Action Items
+
+> Each action has an owner, a deadline, and a tracking ID. No "we should consider…" entries.
+
+| ID | Action | Owner | Due | Status |
+|---|---|---|---|---|
+| AI-1 | <concrete change> | @user | YYYY-MM-DD | open |
+| AI-2 | <concrete change> | @user | YYYY-MM-DD | open |
+| AI-3 | <concrete change> | @user | YYYY-MM-DD | open |
+
+## Lessons Learned
+
+- <Generalizable insight 1>
+- <Generalizable insight 2>
+
+## Related Records
+
+- ADR: <if a decision came out of this>
+- Runbook: <created or updated>
+- Risk register: <new entry id>
+- Tracking task: TASK-NNN
+
+---
+
+> This is a **blameless** post-mortem. Names appear only in the timeline as actors, never as causes. Systems and processes fail; people work the systems.

templates/_base/scaffold/docs/governance/_templates/runbook-template.md

@@ -0,0 +1,88 @@
+<!-- domain:OPS | layer:runbook | ssot:true | updated:{{DATE}} -->
+# Runbook — <Alert / Incident Type>
+
+Purpose: Step-by-step remediation when <trigger> fires. Optimized for an on-call engineer at 3am, not a leisurely read.
+Read when: <Alert name> fires, OR a user reports symptom matching this runbook.
+Skip when: The fault is upstream of this service — escalate per §6.
+Read next: [post-mortem-template.md](./post-mortem-template.md), [<related runbook>](./<related>.md)
+
+> Nav: `Runbooks Index`
+
+---
+
+## 1. Trigger
+
+- **Alert name:** `<exact alert id from monitoring system>`
+- **Source:** `<dashboard / alertmanager / sentry / on-call queue>`
+- **Severity ladder:** `P1: …` · `P2: …` · `P3: …`
+- **Symptom phrasing (for user reports):** "<what user sees>"
+
+## 2. Pre-conditions
+
+Before executing the steps below, verify:
+
+- [ ] You have <permission set> (e.g. prod read on the database).
+- [ ] No deployment is in flight (`<deploy dashboard link>`).
+- [ ] Active incident channel does not already own this alert.
+
+If any pre-condition fails → §6 Escalation.
+
+## 3. Steps
+
+> Run in order. Each step has a verification gate; do not advance without it.
+
+### Step 1 — <Identify the failing component>
+
+```bash
+<exact command>
+```
+
+**Verify:** <what output proves it worked>.
+**If empty / different:** stop, escalate (this runbook does not apply).
+
+### Step 2 — <Stabilize>
+
+```bash
+<exact command>
+```
+
+**Verify:** <metric returns to baseline within N minutes>.
+**Rollback:** `<one-line revert command>`.
+
+### Step 3 — <Confirm recovery>
+
+- Check `<dashboard URL>` — <metric> below threshold for ≥5 minutes.
+- Run `<smoke test command>`; expect `<output>`.
+
+## 4. Verification
+
+- [ ] Alert is acknowledged AND auto-resolved within 10 minutes.
+- [ ] No follow-on alerts in the same family fired within 30 minutes.
+- [ ] User-reported symptoms (if any) confirmed gone.
+
+## 5. Rollback
+
+If steps 1–3 fail or made things worse:
+
+1. `<exact rollback command>` — restores previous known-good state.
+2. Notify `<channel>` with rollback timestamp.
+3. Open a P1 ticket linking this runbook + observed failure mode.
+
+## 6. Escalation
+
+| Symptom | Escalate to |
+|---|---|
+| Database is the root cause | DBA on-call (`<channel>`) |
+| Upstream provider degradation | Vendor support (`<contact>`) |
+| Code regression suspected | Service owner (`<owner>`) |
+| Security indicators | Security on-call (`<channel>`) |
+
+## 7. Aftermath
+
+- If incident lasted >15 minutes OR caused user-visible impact → write a post-mortem within 48 hours using [post-mortem-template.md](./post-mortem-template.md).
+- If this runbook missed a step → file a PR updating it the same week.
+- If the alert was false-positive → tune threshold per [alerting-policy.md](../../engineering/alerting-policy.md).
+
+---
+
+> Last drilled: <YYYY-MM-DD> — runbooks are stale unless practiced. Re-drill quarterly or after any structural change to the underlying system.

templates/_base/scaffold/docs/governance/_templates/security-review-template.md

@@ -0,0 +1,111 @@
+<!-- domain:SECURITY | layer:checklist | ssot:ref | updated:{{DATE}} -->
+# Security Review — <Feature / Change Title>
+
+Purpose: Per-change security checklist mapped to OWASP Top-10 (2025) + project-specific risks. Filed alongside the PR/ADR for traceability.
+Read when: Before merging a change that touches auth, data exposure, external services, file upload, secret handling, or trust boundaries.
+Skip when: Pure refactor with no behavior change AND no new external surface area.
+Read next: [security-review.md](../../playbooks/security-review.md), [error-format.md](../../api-contracts/error-format.md)
+
+> Nav: [Templates Index](../00-index.md)
+
+---
+
+## Change Context
+
+- **PR / ADR:** <link>
+- **Author:** @user
+- **Date:** YYYY-MM-DD
+- **Reviewer:** @user
+- **Scope:** <one sentence: what's changing, what's the trust boundary>
+
+## Threat Surface (fill in only what applies)
+
+| Surface | Touched? | Notes |
+|---|---|---|
+| New endpoint or RPC | ☐ | <which> |
+| Auth flow / session | ☐ | <which> |
+| Authorization / permission rules | ☐ | <which> |
+| User input (form / API / file upload) | ☐ | <which fields> |
+| External service call | ☐ | <which provider> |
+| Secret / credential handling | ☐ | <which> |
+| Schema migration | ☐ | <table / column> |
+| Logging / telemetry | ☐ | <what gets logged> |
+| Crypto operation | ☐ | <hash / encrypt / sign> |
+| Background job / scheduled task | ☐ | <which> |
+
+## Checklist (OWASP-aligned)
+
+### A01 — Broken Access Control
+- [ ] Every new endpoint verifies authentication.
+- [ ] Every new endpoint verifies the caller is authorized for the target resource (not just authenticated).
+- [ ] Permission rules trace to the project Permission Matrix (link).
+- [ ] No IDOR: object IDs are scoped to the caller (no `/users/{id}` without ownership check).
+- [ ] Server-side rules duplicate any client-side rules — never trust the UI.
+
+### A02 — Cryptographic Failures
+- [ ] Passwords hashed with bcrypt/argon2/scrypt (never MD5/SHA1).
+- [ ] Tokens signed with a key stored outside source.
+- [ ] TLS used for every external call (no plain HTTP).
+- [ ] Sensitive data not stored in logs / error messages.
+
+### A03 — Injection
+- [ ] DB access uses parameterized queries / ORM (no string concatenation).
+- [ ] HTML output is escaped at render time.
+- [ ] Shell commands use argument arrays, not interpolated strings.
+- [ ] Template injection not possible (Jinja autoescape on, etc.).
+
+### A04 — Insecure Design
+- [ ] State machine covers expired/revoked/abuse states, not just happy path.
+- [ ] Rate limits on enumeration-prone endpoints (login, password reset, token redemption).
+- [ ] Multi-step flows resistant to step skipping or replay.
+
+### A05 — Security Misconfiguration
+- [ ] No default credentials.
+- [ ] Stack traces / ORM errors not returned to users.
+- [ ] CORS list explicit (no `*` for credentialed origins).
+- [ ] Security headers set: HSTS, CSP (or framework default), X-Frame-Options or `frame-ancestors`.
+- [ ] Debug mode off in non-dev environments.
+
+### A06 — Vulnerable & Outdated Components
+- [ ] No new dependencies added without checking advisories.
+- [ ] Existing deps have a known patch path if a CVE drops.
+
+### A07 — Identification & Authentication Failures
+- [ ] Sessions invalidated on password change.
+- [ ] Brute-force protected (rate limit / captcha / lockout).
+- [ ] Password reset tokens single-use, short TTL (≤30 min).
+- [ ] No password length cap below 64 chars.
+
+### A08 — Software & Data Integrity
+- [ ] No deserialization of untrusted data without a strict allow-list.
+- [ ] Webhook payloads verified by signature, not just shared secret.
+- [ ] CI artifacts pinned by hash, not floating tags.
+
+### A09 — Logging & Monitoring
+- [ ] Failed authentication logged with caller IP + identifier.
+- [ ] Privilege changes logged.
+- [ ] Logs do not contain passwords, tokens, full PANs, or full PII.
+- [ ] Alerts wired for anomaly thresholds (link to runbook).
+
+### A10 — Server-Side Request Forgery (SSRF)
+- [ ] Outbound URL inputs validated against an allow-list or DNS rebound on each fetch.
+- [ ] Cloud metadata endpoints (`169.254.169.254`) blocked.
+- [ ] Internal-only services not reachable from user-controlled inputs.
+
+### Project-Specific
+- [ ] Doc anchor recorded (Rule 0) — code traces to a spec.
+- [ ] Permission Matrix updated if new role/action introduced.
+- [ ] Test added covering the negative case (unauthorized user blocked).
+- [ ] Threat-model entry added to [risk-register.md](../risk-register.md) if a new risk class.
+
+## Reviewer Sign-off
+
+- [ ] Security checklist complete or every unchecked box has an explicit waiver below.
+- [ ] PR description names this review.
+
+**Waivers (with justification):**
+- <item> — <why this is safe to skip>
+
+---
+
+> Skipped boxes are accepted risk. The reviewer owns the waiver and the runbook for it.