Backend Rust

OPS-05 · Secrets and credentials do not reach logs, spans or Debug output (no logged secrets, no derived Debug on secret fields, instrument skips them)

OPS-10 · The user confirms credential-named values written as literals or used as fallbacks for secret environment reads

TYP-07 · Settings types holding credentials or connection strings do not derive Default (an empty secret is not a configuration)

TYP-07 · Default implementations do not fabricate credentials, connection strings or identities

API-04 · Tokens are verified before they authenticate (no disabled signature or expiry validation, no insecure decode)

API-05 · Routes added after an authentication layer in an axum Router chain are intentionally unprotected

API-07 · Request payload types do not let clients set server-owned fields (roles, ownership, tenant, verification state)

DB-01/DB-02 · The user confirms SQL text built with format!, concatenation or QueryBuilder::push of non-literal values

OPS-09 · Outbound TLS keeps certificate and hostname verification (no danger_accept_invalid_*, no custom no-op verifier)

QLT-06 · No blanket or crate-wide lint suppression (allow(warnings), clippy::all, unsafe_code, inner

QLT-06/QLT-08 · Item-level lint suppressions name their reason (#[expect(lint, reason = "…")]), dead code included

QLT-10 · The user authorizes lint, test or CI configuration changes that allow lints, skip checks or ignore failures

QLT-06 · unsafe blocks, unsafe impls and unsafe fns state their safety obligation (// SAFETY:,

TYP-02 · A function that needs a value takes it, instead of an Option it silently ignores when None

TYP-03 · Functions do not take several boolean flags that encode modes; use an enum or a configuration type

TYP-05 · Read-only parameters borrow slices, str or Path, not &Vec, &String, &PathBuf or &Box

TYP-06 · Getters return a borrow instead of cloning an owned field on every call

ERR-01 · Request handlers return failures instead of panicking (unwrap, expect, panic!) on request-derived values

ERR-01 · Parsing, decoding and conversions of external data outside startup return errors instead of unwrap/expect

ERR-02 · A fallible result is not erased with a bare `.ok();` statement

ERR-02 · A Result or future bound to `let _` is a justified discard (type from rust-analyzer)

ERR-03 · A catch-all Err arm does not report success with an empty, default or true value

ERR-03 · Errors replaced by a default value (unwrap_or_else(|_| …), .ok().unwrap_or…, Err(_) => default) are a specified fallback

ERR-04 · Callers branch on typed error variants, not on the text of an error's Display

ERR-06 · Fallible tower middleware (timeout, load_shed, buffer) is paired with an error handler that turns its errors into responses

ASY-01 · Async code does not call blocking sleep, file, socket, process or block_on APIs on executor workers

ASY-03 · A synchronous lock guard (std or parking_lot) is released before the next .await in the same scope

ASY-04 · An async mutex guard that never spans an .await should be a short synchronous critical section

ASY-07 · A spawned task has a lifecycle owner that observes its result and stops it on shutdown (no dropped JoinHandle)

ASY-08 · select! branches and timeouts do not cancel operations that are not cancellation-safe (partial reads/writes, commits, executes)

ASY-09 · A timeout or select! around spawn_blocking accounts for the blocking work that keeps running

ASY-05 · The user confirms unbounded channels, which need a demonstrated finite producer and an overload policy

ASY-06 · Tasks and futures created per item of a loop or iterator have an admission limit (semaphore, buffer_unordered, JoinSet cap)

ASY-11 · Retry loops have a bound (attempts or elapsed budget), a delay, and stop on terminal errors

DB-05 · Pools and HTTP/database clients are built at startup and shared, not per request or per loop iteration

DB-06 · fetch_all over a SELECT has a result bound (LIMIT, a key filter, pagination)

DB-09 · Request-driven loops do not issue one database query per item (N+1); batch or join instead

OPS-03 · Outbound HTTP clients have a deadline (reqwest/ureq builders with timeout, no bare Client::new or reqwest::get)

ARC-01 · use paths and Cargo dependencies respect the project's declared dependency map (off until dependencyRules is set)

ARC-02 · Designated domain components do not reach transport, persistence, filesystem or environment APIs (off until domainPaths is set)

API-03 · The user confirms removing or bypassing request body limits (DefaultBodyLimit::disable, to_bytes with usize::MAX, unlimited payload configs)

ASY-10 · A server stops admission and drains in-flight work on shutdown (axum/hyper serve with graceful shutdown)

ERR-05 · Internal failures map to stable public errors; 500 responses do not carry the error's text or Debug output

DB-03 · Several writes in one operation run in one transaction and report success after commit

DB-04 · A transaction that is begun is committed (or deliberately rolled back or handed on), never silently dropped on success

DB-07 · Outbound network calls do not run while a transaction holds a pooled connection

DB-08 · The user confirms editing a migration that already existed before this session (applied history)

DB-08 · A change to persisted Rust models (Diesel table!, SeaORM entities, FromRow/Queryable structs) ends the turn with a new migration

OPS-01 · Environment reads do not fall back to a default for required settings (unwrap_or, unwrap_or_default, unwrap_or_else)

OPS-01 · Configuration is read from the environment and validated once into typed settings, not across the code

OPS-02 · Time settings in configuration types carry a unit (Duration, or an explicit _ms/_secs suffix)

OPS-04 · Production code logs through tracing with structured fields, not println!/eprintln! or values interpolated into the message

OPS-06 · Metric labels have a bounded value set (no user/request IDs, raw paths or error text as labels)

ARC-08 · New Cargo dependencies and features name their capability, enable only needed features and pin git sources

QLT-01 · Tests check an outcome (assert, expected error, unwrap of the result under test), not just run code

QLT-03 · Tests control time and synchronization instead of sleeping on the real clock

QLT-10 · The user confirms new

QLT-10 · The user confirms changes to existing approved snapshots (insta .snap files)

QLT-05 · Production code ships no todo!(), unimplemented!() or dbg!() placeholders

QLT-07 · A final message claiming a passing build, lint or tests needs a successful cargo run after Claude's last edit

QLT-07 · Records, per session, Claude's edits and the cargo build, lint or test runs that succeeded after them

QLT-07 · Claude does not end a turn with compiler errors it introduced in Rust sources or their dependents (rust-analyzer)

Records the work tree when a prompt starts, the baseline of the end-of-turn checks (QLT-07, DB-08)