
# Security: secrets and redaction ## Checklist - [ ] Secrets only via env/secret store - [ ] Logs redact sensitive content by default - [ ] Tool outputs avoid raw sensitive data unless explicit flags - [ ] Retention guidance documented
# DB schema and migrations ## Checklist - [ ] Entities and relationships - [ ] Identity keys + dedupe invariants - [ ] Index plan - [ ] Migration strategy - [ ] Audit logging (if required)
# IMAP sync and parsing ## Checklist - [ ] Cursor strategy (UID/UIDVALIDITY) - [ ] Folder selection and backfill behavior - [ ] Dedupe keys and idempotency - [ ] Parsing into canonical DTOs - [ ] Retry/backoff rules
# Review: layer boundaries ## Checklist - [ ] No integration-native objects outside integration layer - [ ] Tool layer uses repositories only - [ ] Business logic does not do network I/O - [ ] Vector store is non-authoritative (if used)
# Rules DSL and regex safety ## Checklist - [ ] Rule schema (conditions/actions) - [ ] Priority ordering and conflict rules - [ ] Explain output format - [ ] Regex safety constraints - [ ] Rule testing workflow
# Testing fixtures and mocks ## Checklist - [ ] Fixture corpus covers edge cases - [ ] Prefer offline/replayable tests - [ ] Success + failure tests for tools - [ ] Smoke integration test per milestone
# Vector store ops ## Checklist - [ ] Embedding text recipe - [ ] Metadata fields and filters - [ ] Upsert cadence and rebuild plan - [ ] Query patterns and evaluation - [ ] Outage handling