breadcrumb-the-shire/agent-system/checks/guard-checklist.md

Guard Checklist

Use this checklist for the guard reviewer. Canonical guard IDs live in agent-system/checks/guard-catalog.json.

Architecture

• GR-CORE-001 no boundary violations against project layering
• GR-CORE-002 no direct bypass of shared factories/services where prohibited
• GR-CORE-003 request input contract is respected (requestInput(), no $_POST/$_GET/$_FILES/REQUEST_METHOD)
• GR-CORE-004 API json body contract is respected
• GR-CORE-008 no direct superglobal access in pages ($_SESSION, $_SERVER, $_COOKIE, $_ENV)
• GR-CORE-009 new Repository list methods use RepoQuery::sanitizeLimitOffset(); no unbounded SELECTs on large tables; maxLimit 100 not raised without justification
• GR-CORE-010 DB schema changes for existing installs shipped as idempotent SQL scripts in db/updates/; db/init/init.sql alone is not sufficient
• GR-CORE-011 new settings stored in DB settings table via settings gateway; config/settings.php is hot-path cache only, not primary storage
• GR-CORE-012 successful mutating POSTs respond with redirect (PRG); flash messages set before redirect via Flash::set()

Security

• GR-CORE-005 auth and permission checks stay intact
• GR-CORE-006 tenant-scope checks stay intact
• GR-SEC-001 CSRF token verified on every POST endpoint before request body processing
• GR-SEC-002 no unredacted PII or secrets in logs and audit metadata
• GR-SEC-003 all SQL goes through Repository with prepared statements; no string-interpolated queries
• GR-SEC-004 no external CDN or remote asset loading; all JS/CSS/fonts must be vendored locally and served via assetVersion()
• GR-SEC-005 encryption only via lib/Support/Crypto.php (AES-256-GCM); no raw openssl_encrypt, no base64-as-encryption, no hand-rolled crypto
• GR-SEC-006 user-uploaded files stored under storage/{type}/{uuid}/ only; never written to web/; served via PHP controller with authz check; MIME + extension validated before storage

Frontend and UX

• GR-UI-001 list initialization standard is preserved
• GR-UI-002 no legacy filter toggle markup introduced
• GR-UI-003 row interaction standard is preserved where applicable
• GR-UI-004 page size standard is preserved where applicable
• GR-UI-005 detail page standard is preserved where applicable
• GR-UI-006 no inline confirm hacks
• GR-UI-007 shared partial usage remains consistent (existing partials reused where applicable)
• GR-UI-016 template structure discipline: new pages use established layout system; blocks reused in ≥2 pages extracted as partial in templates/partials/ with naming app-{context}-{purpose}.phtml; no ad-hoc layout HTML in pages that bypasses the layout system
• GR-UI-008 template RBAC contract remains consistent
• GR-UI-009 no regression in a11y basics (labels, roles, keyboard focus) for touched flows
• GR-UI-013 a11y by design: new interactive components use semantic HTML, are keyboard-operable (Tab/Enter/Escape), use ARIA only where necessary, meet WCAG 2.1 AA contrast
• GR-UI-014 UI state completeness: new views/components define and implement loading, empty, error, and success states before implementation starts
• GR-UI-010 all user-visible strings in phtml views wrapped in t(); no hardcoded display strings
• GR-UI-015 new t() keys present in all language files (de + en) in the same merge; no key missing in any language file
• GR-UI-011 JS reuse-first: existing exports in web/js/core/ and web/js/components/ checked before adding a new function; no logic duplication from core modules
• GR-UI-012 CSS reuse-first: existing app-* classes and layer rules checked before writing new declarations; only additive overrides on top of shared components
• GR-UI-017 lifecycle runtime contract for migrated components is enforced (init(root, config) + destroy(), no component-level auto-init side effects, no legacy wrappers/init alias exports, cleanup of listeners/timers/observers, runtime config via page-config, page-level JS only via web/js/pages/* modules, host-bound components incl. tabs with data-app-component and root-strict selectors, global utilities only via explicit runtime-global registration, no project-specific custom window.* globals, namespaced UI storage without legacy fallback/sync paths)

Testing

• GR-TEST-001 new or changed Service/Gateway logic has accompanying PHPUnit tests (happy path + at least one failure/edge case) in the same merge
• GR-TEST-002 new code uses constructor injection; no static side-effects, hidden global state, or untestable DB/HTTP calls outside Repository/Gateway abstractions

Language and Style

• GR-LANG-001 PSR-4 namespace/directory alignment is intact (verified by QG-003)
• GR-LANG-002 PHP style passes composer cs:check without diff for touched files

Quality Gates

• QG-001 to QG-003 are run unless explicitly out of scope
• QG-004 fast structural checks reported when relevant
• QG-005 JS smoke performed for JS-touching changes; no new unhandled runtime errors
• QG-006 PHP style check run for any PHP-touching changes
• QG-007 composer-unused run periodically; any newly unused package flagged to reviewer

References:

• tools/codex-skills/core-guardrails/references/boundaries-core.md
• tools/codex-skills/core-guardrails/references/boundaries-ui.md
• tools/codex-skills/core-guardrails/references/quality-gates.md
• tools/codex-skills/starterkit-grid-standards/SKILL.md
• tools/codex-skills/starterkit-php-style-ci/SKILL.md