Backend Kotlin

BE-15 · Ktor and Spring configuration files reference secrets through environment placeholders, not literal values

BE-15 · Credential-named values are not initialized with string literals in production code (review)

BE-15 · Credential parameters and properties (password, secret, API key, signing key) never receive a literal in production code

BE-16 · Logs never receive passwords, tokens, keys, Authorization or Cookie headers

BE-03 · Routes and controller endpoints in declared protected paths require authentication (off until protectedEndpointPaths is set)

BE-05 · The user approves removing authenticate { }, @PreAuthorize/@Secured/@RolesAllowed or making authentication optional

BE-05 · The user approves broad permit-all rules, disabled CSRF and credentialed wildcard CORS

BE-01 · Request bodies bound by Spring or Ktor are validated before use (@Valid, RequestValidation, require/validate) (review)

BE-02 · Request bodies bind dedicated input models, not persistence entities (definition from kotlin-lsp) (review)

BE-06 · Request parameters are never interpolated or concatenated into SQL text (Ktor call parameters, Spring request parameters)

BE-06 · The user confirms SQL text built by interpolating or concatenating non-constant values

BE-18 · Outbound HTTP destinations are not taken from request parameters without a destination check (SSRF)

QA-06/QA-08 · The user approves build or CI changes that skip tests, lint or warnings-as-errors, ignore failures or widen opt-ins

QA-07 · No new file-level @file:Suppress/@file:OptIn or ktlint-disable; declaration-level suppressions name their reason

KT-03 · New '!!' assertions are replaced by a validated contract, an explicit failure or safe nullable handling (review)

KT-04 · No new unchecked cast reported by the Kotlin compiler (UNCHECKED_CAST, kotlin-lsp)

KT-05 · Declarations do not expose a type inferred from a Java platform call (HasPlatformType, kotlin-lsp)

KT-06 · Stable contracts (DTOs, API and event models) use named types instead of Any, Pair/Triple or string-keyed Any maps

BE-09 · A retry around a side effect (write, send, charge, publish) shows how a replay stays safe (review)

ER-02 · A broad catch does not turn an unexpected failure into null, zero or empty data without a declared contract (review)

ER-02 · A catch never swallows a failure silently nor reports success after it

ER-03 · A translated exception keeps the original as its cause

ER-04 · No return inside finally overrides the pending result or exception

ER-05 · Application logic catches specific recoverable failures, not Exception or Throwable (outside error boundaries)

ER-06 · Failures are thrown as specific types, not bare Exception, RuntimeException or Throwable

CO-01 · Coroutines are not launched in GlobalScope or in a detached CoroutineScope(...) nobody can cancel (resolved by kotlin-lsp)

CO-02 · Coroutines started from request-owned code keep their parent instead of a new Job, SupervisorJob or NonCancellable (review)

CO-03 · Scopes, dispatchers and executors a component creates are cancelled or shut down by it; shared dispatchers are never closed

CO-04 · An explicit catch of CancellationException rethrows it

CO-04 · A catch around suspending calls does not swallow CancellationException (SuppressedCancellationException, kotlin-lsp)

CO-04 · A broad catch around suspending calls does not translate CancellationException into an application exception (suspend calls resolved by kotlin-lsp)

CO-05 · Standard runCatching does not wrap suspending work whose cancellation it then consumes (SuppressedCancellationException, kotlin-lsp)

CO-06 · runBlocking is not called from suspend functions or coroutine bodies (RunBlockingInSuspendFunction, kotlin-lsp)

CO-07 · Coroutine code waits with delay(), not Thread.sleep()

CO-08 · Blocking JDBC, file and HTTP calls (resolved by kotlin-lsp) do not run on Dispatchers.Default or a declared event loop

CO-09 · Long-running loops inside coroutines check for cancellation or suspend (review)

CO-11 · Supervised children have an observed failure path (handler, try/catch or result)

CO-12 · Business logic receives its dispatcher instead of hard-coding Dispatchers.IO/Default (tests control scheduling)

CO-13 · State mutated from launch/async bodies is synchronized, atomic or confined (review)

CO-13 · A @Volatile property is not updated with a non-atomic read-modify-write (++, +=, x = x + …)

CO-14 · Functions returning a cold Flow are not suspend; setup runs inside the flow builder

BE-10 · Retries are bounded (attempts or deadline); no endless Flow.retry, retryWhen { true } or catch-and-loop

BE-11 · HTTP clients and requests are built with finite timeouts

BE-12 · Caller-controlled limit, size and page parameters are capped before use (review)

BE-13 · HTTP clients, connection pools and executors are created once and shared, not per call

BE-14 · Owned connections, statements, streams and responses are closed on every path (use, finally) or handed to an owner

CO-10 · Fan-out over an input collection (launch/async per item) has a concurrency bound

AR-01 · Gradle dependencies respect the declared module boundaries (off until gradleDependencyRules is set)

AR-01 · Imports respect the project's declared code boundaries (off until importRules is set)

AR-02 · A new Gradle project dependency does not close a cycle in the module graph (followed three hops deep)

AR-04 · Public declarations of declared library APIs state their return and property types (off until libraryApiPaths is set)

AR-05 · Public classes and functions of declared library APIs carry KDoc (off until libraryApiPaths is set)

AR-06 · Business code receives collaborators explicitly instead of resolving them from a service locator

AR-07 · Declared pure domain code imports no transport, persistence or I/O packages (off until domainPaths is set)

KT-09 · Collaborators arrive through the constructor, not as lateinit fields set after construction

KT-01 · A local var that is never reassigned is declared val

KT-02 · Classes expose read-only collections and state flows; mutable ones stay private to their owner

KT-07 · Calls passing several Boolean literals positionally name them

KT-08 · A when over a sealed or enum type handles its variants without an else that hides new cases (definition from kotlin-lsp)

KT-10 · Nested lambdas name their parameters instead of shadowing the outer implicit 'it' (kotlin-lsp)

BE-17 · Error responses carry no stack traces, and no messages of unexpected exceptions (StatusPages, catch-all handlers)

QA-10 · The user confirms regenerating API dumps (apiDump, updateLegacyAbi) instead of reviewing the API change

QA-10 · The user approves changes that remove or alter signatures in published API dumps (binary-compatibility-validator .api files)

BE-07 · A function with several database writes runs them in one transaction or states its consistency protocol (review)

BE-08 · Work inside a thread-bound transaction does not hop to another thread or coroutine (review)

BE-19 · Production failures go through the logging system, not println or printStackTrace

AR-08 · A new Gradle dependency or version-catalog library names the changed code that uses it (review)

QA-11 · Reminds Claude to use the checked-in wrapper when gradle or mvn runs in a form the rewrite leaves alone (paths, chains, wrappers)

QA-11 · Builds run through the checked-in Gradle or Maven wrapper (gradle → ./gradlew, mvn → ./mvnw)

QA-01/QA-02 · A turn that changes production Kotlin code changes tests too, or says why none applies (review, once per stop)

QA-04 · Coroutine unit tests use runTest and virtual time, not runBlocking or Thread.sleep

QA-06 · The user approves newly disabled, ignored or skipped tests

QA-06 · The user approves edits that remove tests or assertions from a Kotlin test file

ER-01 · Production code does not ship kotlin.TODO() or a thrown NotImplementedError (resolved by kotlin-lsp)

QA-09 · A final message claiming a passing build, tests or lint needs a successful Gradle or Maven run after Claude's last edit

QA-09 · Records, per session, Claude's edits and the Gradle or Maven checks that succeeded after them

QA-09 · Claude does not end a turn with compiler errors it introduced in Kotlin sources or the files that use them (kotlin-lsp)

Records the work tree when a prompt starts, the baseline of the end-of-turn checks (QA-01, QA-09)