Rule Category TS duplicate-test-bodyDisallow substantial sibling tests with the same body shape; express their differing inputs as a parameterized case table. testing TS enforce-file-structureRequire imports before body statements and require `use server` to be the first statement. correctness TS excessive-commentaryFlag long standalone implementation commentary that should be expressed by code. maintainability TS iac-source-coupled-testDisallow raw IaC source text as a test oracle; inspect a rendered plan, provider state, or runtime behavior. testing TS interface-contract-members-privateRequire methods outside an implemented interface contract to use ECMAScript private names. architecture TS no-bare-return-from-test-catchDisallow a bare return from a test catch block when it skips a later assertion. testing TS no-bespoke-api-case-conversionReview direct snake_case/camelCase mirror mappings on explicitly API-typed adapter values. architecture TS no-broad-return-typeReport explicit broad return annotations that erase a known return value. maintainability TS no-client-side-data-fetchingDisallow direct data fetching inside `useEffect` or `useLayoutEffect`. performance TS no-comment-cruftFlag commented-out code, section-banner comments, and leading file-header comment preambles. maintainability TS no-conditional-empty-object-spreadBuild conditional properties explicitly instead of spreading an empty-object branch. style TS no-cors-wildcard-with-credentialsDisallow wildcard CORS origins when credentials are enabled. security TS no-dangerously-allow-svgNext.js image configuration enables SVG rendering without the required response hardening security TS no-declaration-comment-wallFlag an enum body or class body whose member comments mostly re-spell the members' own names. maintainability TS no-detached-global-fetchKeep the ambient global fetch receiver-safe when storing or explicitly rebinding it. correctness TS no-duplicate-lifecycle-refresh-listenersDo not register one Next.js route-refresh callback for both focus and visibilitychange. performance TS no-dynamic-sqlDisallow runtime values embedded inside quoted SQL values passed to statement-execution methods. security TS no-enumDisallow TypeScript `enum`; use string-literal unions or `as const` objects instead. maintainability TS no-excessive-cognitive-complexityReport an error for function bodies with cognitive complexity above 20. maintainability TS no-fat-try-blocksReview try blocks exceeding the configured count of syntactically selected operations. correctness TS no-first-party-module-mockPrefer injected collaborators over mocking maintained first-party modules in tests. testing TS no-generic-single-export-moduleDisallow generic module stems when one runtime export already names the responsibility. maintainability TS no-hand-rolled-sleepDisallow uncancellable promisified timers and timeout arms. correctness TS no-hand-rolled-spinnerDisallow intrinsic elements styled as Tailwind border-ring spinners outside the design-system implementation. maintainability TS no-impossible-zod-literal-boundsDisallow same-chain literal Zod bounds whose accepted set is mathematically empty. correctness TS no-in-operator-on-built-in-collectionsDo not use the `in` operator to test entries in built-in Map and Set collections. correctness TS no-insecure-random-idDisallow using `Math.random()` to generate identifiers, tokens, or secrets; use `crypto.randomUUID()` or `crypto.getRandomValues(...)` instead. security TS no-json-stringify-errorAvoid generic JSON serialization that can omit native Error details. correctness TS no-json-stringify-object-equalityDo not use JSON serialization as structural object equality. correctness TS no-known-value-wideningPreserve a known value's contract instead of widening a local binding to unknown, object, or an unknown-valued dictionary. maintainability TS no-log-only-catchDisallow `catch` clauses that only log (or silently do nothing) and then swallow the error; rethrow or handle it instead. correctness TS no-long-commentFlag unusually large unstructured JSDoc blocks in implementation code. maintainability TS no-offset-paginationPrefer keyset pagination for embedded SQL queries using OFFSET. performance TS no-positional-tuple-returnDisallow returning a multi-field tuple from a named function; return a named object so call sites cannot mismatch slots. maintainability TS no-production-browser-source-mapsNext.js production browser source maps expose application source security TS no-raw-envDisallow direct `process.env` and `import.meta.env` reads outside validated boundaries. correctness TS no-raw-fetch-outside-clientsDisallow calling the global `fetch` outside the client layer; route outbound HTTP through a client module that owns retry, timeout and status handling. architecture TS no-reduce-accumulator-copyReview copies of the accumulated collection inside a built-in reduce callback. performance TS no-redundant-optional-array-defaultRemove `.optional()` immediately inside a Zod array default. maintainability TS no-repeated-string-literalDisallow a long structured string literal repeated across functions; the copies drift when one is edited. Extract a module-level constant. maintainability TS no-restated-commentFlag short standalone comments that repeat the adjacent statement's identifiers. maintainability TS no-restated-jsdocFlag JSDoc prose that appears to repeat declaration names without adding behavioral information. maintainability TS no-restricted-library-loadApply configured library restrictions to literal runtime loads and CommonJS resolution references. architecture TS no-router-refresh-pollingDo not poll by calling a Next.js router's refresh method from a timer. performance TS no-secret-in-logDisallow passing a secret-named value or a raw request/response blob to a logging call; both leak to log sinks. Redact or omit. security TS no-select-starPrefer explicit column projections over SELECT * in embedded SQL. correctness TS no-sentinel-return-on-catchDisallow swallowing a caught error by returning an empty sentinel unless the error is handled or the sentinel is part of the function contract. correctness TS no-server-env-in-client-componentserver-only environment settings imported by a client component correctness TS no-silent-promise-catchDisallow `.catch()` and second-argument `.then()` handlers that silently swallow a rejection; log, rethrow, or handle the error. correctness TS no-sleep-in-test-bodyAvoid fixed timed sleeps directly in test bodies; synchronize on observable behavior or use controlled timers. testing TS no-storage-in-stateless-modulesDisallow SQL or key/value access inside configured stateless modules; derive state from a system of record instead. architecture TS no-string-concat-in-loopPrefer collecting string fragments over repeatedly accumulating a growing string inside a loop. performance TS no-tautological-expectDisallow supported literal-only assertions that are statically known to pass. testing TS no-trailing-value-narrationFlag a trailing comment that repeats the line's numeric value only to name its unit. maintainability TS no-type-member-comment-wallFlag an object type whose member comments mostly re-spell the members' own names and types. maintainability TS no-typed-doc-sectionsReject typed-signature repetition while preserving behavior that types cannot express. maintainability TS no-union-in-commentFlag a comment that lists a `string` field's allowed values instead of the type listing them. maintainability TS no-unlocalized-jsx-attributesRequire translation for literal user-visible JSX attributes in opted-in localized interfaces. correctness TS no-unlocalized-jsx-textRequire translation for literal JSX text in opted-in localized interfaces. correctness TS no-unlocalized-toastRequire translation for literal toast messages in opted-in localized interfaces. correctness TS no-unnecessary-use-clientFlag `'use client'` files with no hooks or event handlers — they could be RSC. performance TS no-unsafe-mock-castingDisallow casting to mock types like `jest.Mock` or `vi.Mock`. Use `vi.mocked()` or `jest.mocked()` instead. testing TS no-unsafe-test-double-castDisallow mock-backed test doubles that bypass collaborator contracts through double assertions. testing TS no-vague-suppression-descriptionRequire suppression descriptions to name the concrete mismatch or invariant instead of a generic non-reason. maintainability TS no-zod-native-enumDisallow `z.nativeEnum()` (and `z.enum()` over a TypeScript enum); use `z.enum(["a", "b"])` with a string-literal union instead. maintainability TS prefer-await-in-async-returnPrefer explicit `await` when an async function directly returns one typed Promise `.then` transform. maintainability TS prefer-constant-time-secret-comparePrefer a supported constant-time comparison primitive for secret-like values. security TS prefer-discriminated-unionFlag flat result objects with a required positive boolean status and optional success/failure payloads. correctness TS prefer-ecmascript-private-membersPrefer ECMAScript `#private` class members over TypeScript-only `private` members. maintainability TS prefer-immutable-module-constantRequire module-level constant collections to expose readonly state. correctness TS prefer-input-group-searchRequire search icons and shared Input controls in the same visual wrapper to use InputGroup. style TS prefer-logical-tailwind-utilitiesPrefer logical Tailwind utilities in explicitly opted-in bidirectional interfaces. correctness TS prefer-millisecond-control-duration-schemaRequire application-owned Zod control-duration fields to use millisecond granularity. correctness TS prefer-module-level-constantHoist literal-only constant collections and regexes out of function bodies to module scope so they are allocated once. performance TS prefer-module-level-refined-schemaDeclare closed Zod scalar, format, and wrapper schemas at module scope. performance TS prefer-module-level-schemaDeclare a Zod schema at module scope when it closes over nothing in the enclosing function performance TS prefer-multi-value-zod-literalUse the Zod 4 multi-value literal API instead of a union of literal schemas. maintainability TS prefer-named-callback-domainName literal-union domains used by callbacks in exported contracts. maintainability TS prefer-named-complex-return-typePrefer a named contract for structurally complex function return types. maintainability TS prefer-native-random-uuidPrefer `globalThis.crypto.randomUUID()` over resolved zero-argument UUID v4 bindings from the `uuid` package. maintainability TS prefer-node-crypto-hashPrefer the modern one-shot node:crypto hash API when streaming state is unnecessary. performance TS prefer-node-fs-promisesPrefer promise-based Node.js filesystem APIs over synchronous calls in production modules. performance TS prefer-non-nullable-collectionSuggest reviewing nullish arrays that use local empty-array defaults or a shared null-or-empty guard. maintainability TS prefer-nullish-filter-predicatePrefer an explicit nullish predicate when `filter(Boolean)` removes only nullish values but does not narrow the result type. correctness TS prefer-schema-for-api-payloadRequire Zod (or similar) schema validation on `response.json()` / `JSON.parse()` results before property access. correctness TS prefer-semantic-colorsEnforce semantic color tokens over raw Tailwind palette classes, arbitrary color values, and inline color literals. style TS prefer-server-actionsPrefer Next.js Server Actions over same-origin API mutations. architecture TS prefer-shadcn-primitivesRequire visible raw JSX controls to use the corresponding shared shadcn primitive. style TS prefer-shared-zod-enumGive repeated literal Zod enum domains one reusable module-level schema. maintainability TS prefer-switch-for-repeated-equalityPrefer switch over long if/else-if chains that compare one value for strict equality. maintainability TS prefer-typed-reflectionPrefer typed access when Reflect.get or Reflect.apply discards a known contract. maintainability TS prefer-whole-object-assertionCollapse consecutive assertions on one object into a whole-object assertion so related mismatches are reported together. testing TS prefer-zod-inferDerive a type from its Zod schema with `z.infer` instead of hand-writing a twin declaration beside it. correctness TS prefer-zod-parse-output-typeDerive a function's return contract from the local Zod schema whose parsed output it returns. correctness TS repeated-static-call-casesReview three or more consecutive static-input call assertions as potential named cases. testing TS require-assert-neverRequire an empty switch default to call `assertNever` so discriminated unions remain exhaustive at compile time. correctness TS require-button-accessible-nameRequire an accessible name on statically unnamed native or configured JSX buttons. correctness TS require-camelcase-propertiesRequire unquoted lower snake_case TypeScript properties and dot access to use camelCase. style TS require-fetch-timeoutRequire an explicit abort signal on locally analyzable global fetch calls. correctness TS require-interface-for-exported-classRequire exported concrete classes with public behavior to declare a contract. architecture TS require-pascal-case-zod-schema-nameRequire confirmed module-level Zod schema contracts to use PascalCase with a `Schema` suffix. style TS require-port-for-serviceAdvise when an exported service with injected collaborators has public methods not covered by its declared ports. architecture TS require-sql-access-classKeep SQL reads and writes inside a class that receives its database dependency. architecture TS require-static-next-matcherRequire Next.js middleware and proxy matcher configuration to contain only build-time literals. correctness TS require-svg-accessible-nameRequire a name or explicit decorative semantics on inline SVG elements. correctness TS require-use-form-default-valuesRequire explicit form-level initialization or a field default for directly bound Controller fields. correctness TS require-use-server-in-actions-fileroute action module missing the use server directive correctness TS require-zod-form-validationRequire Zod validation (`Schema.parse(...)` / `Schema.safeParse(...)`) when reading values out of a `FormData` object. security TS sole-export-matches-filenameMake a module filename reflect its sole named public runtime export. maintainability TS source-coupled-testDisallow raw repository source text as a test oracle; parse or execute the artifact instead. testing TS stepdownPlace a private helper below its sole direct same-scope caller. maintainability TS store-insert-requires-on-conflictReview conflict handling for embedded inserts in replay-named callables. correctness TS test-loops-over-literal-casesDisallow assertions over an inline literal case loop in a test; parameterization reports and names every case independently. testing TS test-phase-label-commentTests must not use bare Arrange, Act, Assert, Given, When, or Then phase comments. testing IaC no-comment-cruftCommented-out HCL declarations or decorative divider comments must be removed; retain comments that explain constraints or rationale. maintainability IaC no-dead-environment-inputFind undeclared tfvars assignments and potentially redundant scalar values across discovered Terraform environments. maintainability IaC no-environment-conditionalWarn when Terraform chooses behavior from deployment-identity comparisons; prefer explicit typed capabilities or values. architecture IaC no-mocked-terraform-test-oracleWarn when a Terraform assertion directly reasserts the same literal injected by a resource, data, or module override. testing IaC no-redundant-variable-validationFlag Terraform variable validation conditions already guaranteed by the variable's type constraint. maintainability IaC no-restated-commentFlag a short comment attached to an HCL declaration when it only repeats that declaration's kind, label, or attribute name. maintainability IaC no-terraform-data-conditionDisallow lifecycle conditions attached to terraform_data guard resources. maintainability IaC require-deletion-protectionWarn when a curated stateful Terraform resource lacks a proven provider-native deletion guard or literal lifecycle destroy guard. correctness IaC require-prevent-destroy-on-irreplaceableWarn when a curated durable-data container lacks a literal provider-side deletion guard or Terraform lifecycle destroy guard. correctness Py complex-postgres-query-requires-architecture-reviewComplex executable PostgreSQL query shapes require architecture review. architecture Py defect-xfail-requires-explicit-strictA deterministic known-defect `xfail` must set literal `strict=True` so XPASS fails the suite. testing Py docstring-args-restate-signatureRemove a wholly redundant Google-style Args section when every entry only repeats the function signature. maintainability Py docstring-returns-restate-signatureGoogle-style Returns and Yields documentation must add facts beyond the corresponding annotated result type. maintainability Py excessive-commentaryLong standalone implementation commentary — make the code self-documenting and retain only durable constraints. maintainability Py fakes-in-shared-locationReview named top-level test doubles for shared-support ownership unless they are intentionally scenario-local. testing Py fastapi-class-router-contractFastAPI routers use injected `*Router.build()` owners and explicit named object response models. architecture Py fastapi-explicit-openapi-contractVisible FastAPI operations pin locally reviewable metadata and avoid statically provable OpenAPI gaps. correctness Py iac-source-coupled-testTest uses raw Terraform/HCL text as an infrastructure-behavior oracle. testing Py invalid-pydantic-field-defaultRequire literal Pydantic model-field defaults to satisfy their resolved contract. correctness Py mock-without-specUnrestricted mock permits attributes outside the collaborator contract. testing Py named-record-at-boundariesPublic Python API returns an unnamed fixed-shape record. architecture Py negative-only-http-status-assertionHTTP test assertion only excludes a server error instead of identifying the intended response. testing Py no-analytical-aggregation-in-postgres-storePotentially analytical PostgreSQL store queries require review. architecture Py no-any-mapping-typesString-keyed mapping types must not erase their values with `Any`. correctness Py no-bare-test-phase-commentsTest files must not use bare phase comments such as Arrange, Act, Assert, Given, When, or Then. testing Py no-comment-cruftCommented-out code, mechanical narration, decorative banner, or untracked work marker. maintainability Py no-conftest-test-module-importDo not import individual test modules from conftest.py. testing Py no-copied-inherited-docstringAn override repeats the documentation of the single local base method it actually overrides. maintainability Py no-cors-wildcard-with-credentialsCredentialed CORS must not allow a wildcard origin. security Py no-delete-statementAvoid `del` statements; prefer constructing an immutable replacement value. maintainability Py no-docstring-type-restatementA docstring type label repeats an annotation from the fully typed signature. maintainability Py no-dunder-allmodules should not define or mutate `__all__` maintainability Py no-duplicate-dunder-all-entrystatic module `__all__` declarations should list each exported name once correctness Py no-excessive-cognitive-complexityError on cognitive complexity above 20; scores up to 20 pass. maintainability Py no-fastapi-on-eventDeprecated FastAPI or Starlette on_event lifecycle registration. correctness Py no-file-level-escape-hatch-suppressionFile-level Ruff suppression disables an escape-hatch rule across the entire file. maintainability Py no-first-party-private-importA first-party consumer imports a private name or private module across its package boundary. architecture Py no-frozen-after-validator-field-writeDo not assign declared fields in after-validators on frozen Pydantic models. correctness Py no-generic-single-export-moduleA generic module name should not conceal a single-definition responsibility. architecture Py no-hidden-constructor-fallbackConstructor option silently falls back to application settings when omitted. architecture Py no-invalid-argument-name-suppressionExternal parameter spelling must use framework aliases instead of disabling snake_case naming. maintainability Py no-nested-pydantic-field-validatorOuter-model Pydantic field validator is owned by a nested helper class. correctness Py no-offset-paginationPotentially unbounded `OFFSET` pagination in store SQL. performance Py no-positional-psycopg-row-escapeA positional Psycopg record must not escape its function unchanged. correctness Py no-positional-tuple-recordFixed tuple return records should use named fields instead of positional slots. maintainability Py no-provably-dead-mock-configurationRemove mock behavior configuration proven unable to affect a test. testing Py no-psycopg-execution-outside-injected-ownerPsycopg execution occurs outside a constructor-injected persistence owner. architecture Py no-random-uuid-in-sqlEmbedded SQL generates a random UUIDv4 instead of a time-ordered UUIDv7. performance Py no-raw-connection-in-testsDo not acquire raw database connections in tests. testing Py no-raw-source-text-test-oracleTest uses raw text from a source-like project path as its oracle. testing Py no-redundant-module-alias-exportsDo not manufacture public APIs from private names or replace the current module. maintainability Py no-repeated-structured-string-literalExact SQL or route literals repeated across callable scopes should share one named binding. maintainability Py no-repeated-test-bodySubstantial sibling pytest tests repeat the same structural body. testing Py no-repeated-unseeded-stdlib-random-in-testA collected test may repeatedly sample an unseeded standard-library PRNG. testing Py no-restated-closed-domain-descriptionDo not restate a string Literal or local string Enum domain in its Pydantic description. maintainability Py no-restated-commentShort standalone comment lexically restates the immediately following simple action. maintainability Py no-secret-in-logA direct credential-like reference is passed to a recognized logging call. security Py no-select-starSQL SELECT projections should list explicit result columns instead of wildcards. maintainability Py no-service-behavior-in-settingsSettings and configuration types should not orchestrate injected collaborators. architecture Py no-statically-truthy-assertionA bare assertion condition is statically truthy. testing Py no-string-concat-in-loopAvoid repeatedly growing a proven string accumulator across a loop backedge. performance Py no-trailing-numeric-unit-assignment-commentA trailing comment redundantly labels a numeric assignment with its value and unit. maintainability Py no-unique-violation-message-matchDo not make unique-violation control flow depend on rendered exception text. correctness Py no-unnecessary-docstringNo docstring consumer detected — delete it; make author-controlled names, types, and structure explain the code. maintainability Py no-unused-value-markerDo not use standalone assignments to `_` to discard values. maintainability Py no-vague-suppression-descriptionGeneric suppression descriptions do not make the exception auditable. maintainability Py no-whole-request-response-payload-in-logWhole request or response payloads passed to logging calls require review. security Py opaque-parametrize-case-needs-idOpaque static pytest parameter cases rely on argument-name-and-index fallback IDs. testing Py over-mocked-testTests should not use more than five independently rooted test doubles or collaborator substitutions. testing Py prefer-class-rowAvoid fetching a Psycopg dictionary row only to construct the same model manually. maintainability Py prefer-collection-comprehensionSingle-purpose fresh collection builder loop — prefer a direct comprehension. style Py prefer-constant-time-secret-compareExternally supplied authenticators are compared with timing-sensitive equality. security Py prefer-fstring-over-concatPrefer f-strings for short human-readable interpolation when they make the result clearer. style Py prefer-immutable-module-constantNonempty uppercase module collections allow top-level membership or keys to change at runtime. maintainability Py prefer-injected-dependency-over-monkeypatchTests should inject dependencies instead of replacing attributes through ambient patching. testing Py prefer-library-fakePrefer a maintained fake, emulator, recorder, or test service for substantial third-party protocols. testing Py prefer-match-assert-neverTyped enum dispatch must not silently ignore unhandled members. correctness Py prefer-match-exception-dispatchPrefer guarded match/case for refined exception type dispatch. maintainability Py prefer-match-type-dispatchPrefer `match` for structural runtime type dispatch. maintainability Py prefer-match-value-dispatchPrefer match/case for repeated dispatch on one value with a fallback. maintainability Py prefer-module-level-constantHoist repeatedly read static values when an immutable module representation preserves behavior. performance Py prefer-monkeypatch-for-process-state-in-testTest mutates process-wide state without a restoring test scope. testing Py prefer-nominal-id-typesPython boundaries should distinguish swappable identifier roles with nominal types. correctness Py prefer-non-nullable-collectionAvoid nullable list parameters that are immediately collapsed to an empty list. maintainability Py prefer-or-patternMerge adjacent `case` arms with identical bodies into one or-pattern. maintainability Py prefer-pydantic-json-valueRecursive JSON value alias duplicates `pydantic.JsonValue`. correctness Py prefer-self-documenting-constantEncode a constant's units or HTTP status meaning in its name, type, or value. maintainability Py prefer-self-type-annotationPrefer `Self` for self-returning methods and alternate constructors. maintainability Py prefer-set-isdisjointPrefer `set.isdisjoint` when a built-in set intersection is used only as a boolean predicate. style Py prefer-str-enumPrefer `StrEnum` for application-owned string domains with explicit closed-set evidence. maintainability Py prefer-struct-over-namedtuplePrefer typed declarations for static application-owned `collections.namedtuple` records. maintainability Py prefer-walrus-awaited-none-guardBind a compact awaited lookup in its immediately following terminal None guard. style Py prefer-walrus-comprehension-filterThe same call runs in a comprehension filter and its result. performance Py prefer-walrus-regex-matchA proven regex Match-or-None result is assigned only for the following condition. style Py prefer-walrus-stream-loopCollapse a compact producer assignment and immediate sentinel break into a named-expression loop. style Py production-derived-test-casesWarn when pytest membership-contract cases are derived only from the first-party production collection. testing Py pytest-fixture-returns-bare-tuplePytest fixture exposes a fixed positional record as an unnamed tuple. testing Py redundant-class-docstringUndecorated base-free class docstring only repeats the class name. maintainability Py redundant-docstringFunction or plain-method docstring only repeats its declaration. maintainability Py redundant-module-docstringModule docstring only repeats the filename and, optionally, its immediate parent package. maintainability Py repeated-kwarg-heavy-call-in-testTests repeat at least seven explicit keyword names across calls to the same callee. testing Py repeated-static-call-casesThree same-shape literal call assertions may be independent parameter cases. testing Py replay-contract-insert-requires-duplicate-policyA literal INSERT in a replay-named store callable must declare duplicate behavior. correctness Py require-keyword-only-swap-prone-paramsRisky-name positional parameters sharing a primitive annotation may be confused. correctness Py require-nodecode-for-splitting-settings-fieldWarn when an unconditional raw-string splitter lacks a pydantic-settings decoding policy. correctness Py require-port-for-serviceConsider a consumer-owned port when visible service structure suggests a substitution boundary. architecture Py require-pydantic-for-external-jsonProven external JSON record fields are consumed before runtime schema validation. correctness Py require-pydantic-for-structured-payloadStructured nested FastAPI payloads must be parsed into a named Pydantic model before field access. correctness Py require-pydantic-ordinal-lower-boundA Pydantic ordinal field maps its first position to N but accepts smaller integers. correctness Py require-typed-http-test-responseHTTP tests must validate JSON response bodies into named models before asserting fields. testing Py restated-test-docstringCollected test docstring only repeats names and visible code. testing Py stepdownA private helper used by one caller should be defined below that caller. maintainability Py store-get-delegates-to-bulk-readA store singleton operation should reuse its equivalent bulk implementation. maintainability Py timestamp-order-requires-tiebreakerBounded store SQL whose final result-order key looks like a `*_at` timestamp should include a deterministic secondary key. correctness Py typed-error-reasonsReview joined exception strings for fixed reason identities versus dynamic context. architecture Py unused-test-factory-optionA private test factory exposes a literal option that visible callers never vary. testing enforce-timestamptzTIMESTAMP without TIME ZONE — use TIMESTAMPTZ. correctness excess-migration-index-requires-justificationRequire a structured local justification for excess explicit indexes in an authored migration. performance existing-table-check-or-foreign-key-requires-not-validCHECK and foreign-key constraints added to existing PostgreSQL tables should defer validation. performance idempotent-ddlDDL without IF [NOT] EXISTS — migrations must be safe to re-run. correctness index-concurrentlyCREATE INDEX without CONCURRENTLY — locks the table against writes. performance insert-requires-replay-policyEvery INSERT must declare replay-safe upsert behavior or explicitly document intentional insert-only semantics. correctness mixed-migration-phasesReview existing-table migrations that combine backfill, enforcement, and contract phases. architecture no-application-schema-checkKeep JSON shape and closed application value sets out of database CHECK constraints. architecture no-database-triggersKeep behavioral logic in application code, not database triggers. architecture no-duplicate-indexReport duplicate and conservatively covered indexes that remain active in one authored migration. performance no-long-migration-narrationLong migration comments narrate implementation instead of recording durable constraints. maintainability no-migration-comment-cruftCommented-out SQL, decorative banners, and untracked debt markers must be removed. maintainability no-offset-paginationDynamic OFFSET pagination in query SQL should use a stable cursor. performance no-pg-enumCREATE TYPE ... AS ENUM — use TEXT with an application enum instead. maintainability prefer-jsonbJSON column type or table-DDL cast — use JSONB. performance prefer-text-over-varcharVARCHAR(n) — use TEXT (+ CHECK length if needed). maintainability prefer-uuidv7-default`gen_random_uuid()` emits a random UUIDv4 — use `uuidv7()` so keys are time-ordered. performance require-fk-indexCascading or set-value FOREIGN KEY action lacks a child-table index. performance require-lock-timeoutDDL migration missing positive SET [LOCAL] lock_timeout or statement_timeout prior to DDL. correctness commented-out-configunexplained disabled config blocks or adjacent alternatives maintainability config-comment-wallfour or more nearby configuration comments mostly repeat their entries maintainability declarative-deployment-boundaryrecognized control-plane commands mutate infrastructure outside Terraform architecture ephemeral-execution-artifactephemeral execution brief, audit report, or change diary maintainability exact-config-comment-restatementYAML or TOML comment exactly repeats the adjacent scalar assignment maintainability hidden-markdown-headingHTML comment hides a Markdown heading maintainability iac-source-coupled-testshell test asserts on raw IaC source text testing large-shell-programshell program contains at least 200 substantive lines architecture no-unsafe-command-argument-interpolationraw Claude command argument interpolated into an executable shell or query fence security no-wildcard-secret-read-permissionClaude settings grant wildcard access to secret values security workflow-embedded-programGitHub workflow run: embeds procedural logic architecture
