Backend C#

BCS-65 · Tracked appsettings and config files reference secrets (user secrets, environment, vault) instead of literal passwords, keys or tokens

BCS-72 · Log calls never receive passwords, tokens, API keys, authorization headers or connection strings

BCS-56 · The user approves removing [Authorize]/RequireAuthorization or making an endpoint anonymous

BCS-56 · Controllers and endpoints in declared protected paths require authorization (off until protectedEndpointPaths is set)

BCS-59 · The user approves disabling antiforgery validation on state-changing endpoints

BCS-60 · A CORS policy allowing credentials never accepts arbitrary origins (wildcard or accept-all predicates)

BCS-12 · Write endpoints bind request contracts (DTOs), not persistence entities (definition from csharp-ls; review)

BCS-45 · Raw SQL APIs (FromSqlRaw, ExecuteSqlRaw, SqlCommand, Dapper) never receive interpolated or concatenated text

BCS-55 · MVC actions binding a request body validate it before side effects ([ApiController] or a ModelState check) (review)

BCS-02 · Project files keep nullable analysis enabled; new production projects enable it; sources do not add '#nullable disable'

BCS-03 · No '#pragma warning disable' without a diagnostic ID (it silences every warning that follows)

BCS-03 · A new '#pragma warning disable <ID>' or [SuppressMessage] says why (comment or Justification) and is restored

BCS-03 · The user approves project or EditorConfig changes that silence diagnostics, lower analyzer severity or stop treating warnings as errors

BCS-02/BCS-04/BCS-05/BCS-06 · New nullable, dead-code, readonly and repository-style diagnostics in dotnet build output are fixed (warn)

BCS-28/BCS-30/BCS-31/BCS-38 · A dotnet build reporting CA2016, CS4014, CA2012 or CA2200 on lines this turn added is fixed before going on

BCS-80/BCS-03 · The user approves CI or project changes that drop dotnet build/test steps, filter tests out or stop treating warnings as errors in CI

BCS-38 · A caught exception is rethrown with 'throw;' (or wrapped with its cause), never 'throw ex;' (CA2200)

BCS-39 · No empty catch block; a catch recovers, translates at a boundary or adds context, and says so

BCS-40 · A catch-all around cancellable async work lets cooperative cancellation through instead of turning it into a failure (review)

BCS-41 · Expected invalid input is reported as a validation result, not thrown and caught in the same method

BCS-42 · Controllers do not translate every exception into their own error response; unexpected errors go through central handling (ProblemDetails)

BCS-24 · No blocking wait on a task (.Result, .Wait(), GetAwaiter().GetResult(), Task.WaitAll) outside startup code (typed by csharp-ls)

BCS-25 · Async methods call the asynchronous database, file, stream and HTTP APIs, not their blocking overloads (typed by csharp-ls)

BCS-26 · Asynchronous methods return Task or ValueTask; async void only for event-handler signatures

BCS-27 · Request handlers do not wrap work in Task.Run just to await it (it only moves the work to another pool thread)

BCS-28 · A method holding a CancellationToken passes it to every call that accepts one (overloads resolved by csharp-ls; CA2016)

BCS-29 · Public async I/O entry points of controllers, repositories, clients and services accept a CancellationToken

BCS-30 · A call returning Task or ValueTask is awaited, returned or explicitly supervised, never dropped (typed by csharp-ls)

BCS-31 · A ValueTask is consumed once (awaited, .Result, .AsTask()), never twice (typed by csharp-ls; CA2012)

BCS-32 · No await while holding a monitor (lock statement or Monitor.Enter/Exit); use SemaphoreSlim for async exclusion

BCS-33 · Work that is not awaited (Task.Run, StartNew, thread pool, timers) does not capture HttpContext or request objects

BCS-34 · Parallel work (Parallel.ForEach, Task.WhenAll over lambdas) does not touch the same HttpContext concurrently

BCS-36 · Streams, connections, commands, scopes, contexts and transactions created by an operation are disposed on every exit path

BCS-37 · Rented buffers, semaphore slots and monitors are returned or released in a finally block

BCS-46 · A provider-backed query is filtered, projected and limited before ToList/AsEnumerable, not after (typed by csharp-ls)

BCS-47 · HTTP endpoints do not materialize a whole table; list reads are paginated or explicitly limited (typed by csharp-ls; review)

BCS-50 · EF Core queries and navigation loads are not issued once per item of a loop (N+1; typed by csharp-ls; review)

BCS-51 · Read-only entity queries use AsNoTracking when the method never saves (typed by csharp-ls)

BCS-62 · Request-body limits are not removed or raised to unbounded, and request bodies are not read to the end without a limit (review)

BCS-68 · HttpClient instances come from IHttpClientFactory or a long-lived instance, never 'new HttpClient()' per operation

BCS-69 · Outbound HTTP clients keep a finite timeout and calls are not detached from cancellation (review)

BCS-70 · HTTP retry policies are limited to idempotent requests unless the side effect is deduplicated (review)

BCS-08 · Using directives respect the project's declared code boundaries (off until namespaceRules is set)

BCS-08 · Project and package references respect the declared project boundaries (off until projectReferenceRules is set)

BCS-09 · A new ProjectReference does not close a cycle in the project graph (followed three references deep)

BCS-10 · Declared pure-domain code does not import ASP.NET Core, HTTP or persistence namespaces (off until domainPaths is set)

BCS-13 · Public application contracts do not return IQueryable outside an approved query abstraction

BCS-17 · Business code receives dependencies through its constructor, not GetService/GetRequiredService at run time

BCS-18 · A hosted service (a singleton) does not take a DbContext in its constructor; it creates a scope or a context per operation (type from csharp-ls)

BCS-19 · Registration code does not build a second service provider (BuildServiceProvider) while configuring services

BCS-20 · Classes do not dispose services the container injected into them (the container owns their lifetime)

BCS-21 · A hosted service resolves services from a per-operation scope, not from the root provider

BCS-22 · Static (process-wide) collections are not mutated outside a lock; concurrent requests share them (review)

BCS-23 · Conventional middleware takes scoped services (a DbContext) in InvokeAsync, not its constructor (type from csharp-ls)

BCS-74 · Business logic takes time from an injected TimeProvider, not DateTime.Now/UtcNow, so expiry and scheduling are testable

BCS-58 · The pipeline keeps UseRouting, UseCors, UseAuthentication, UseAuthorization and endpoint mapping in the required order

BCS-61 · Production error responses carry no stack traces or raw exceptions; the developer exception page is Development-only

BCS-63 · Status code and headers are not set after the response body started (WriteAsync, CopyToAsync, SendFileAsync)

BCS-64 · Request.Form and the request body are read asynchronously (ReadFormAsync), not synchronously; AllowSynchronousIO stays off

BCS-43 · A DbContext is never static or registered as a singleton; each unit of work gets its own (type from csharp-ls)

BCS-44 · Task.WhenAll does not run two EF Core operations on the same DbContext concurrently (typed by csharp-ls)

BCS-48 · Offset pagination (Skip) on a database query orders by a declared unique key (typed by csharp-ls)

BCS-52 · A method calling SaveChanges more than once runs the writes in one transaction (or one SaveChanges) (review)

BCS-66 · Business code takes typed options (IOptions<T>), not IConfiguration with ad-hoc keys; composition roots and options classes may

BCS-67 · Options bound from configuration are validated at startup (ValidateOnStart), not on first use

BCS-71 · Log messages use constant templates with named placeholders, not interpolated or concatenated strings (CA2254)

BCS-07 · A new NuGet package names the changed feature or build tooling that uses it (review)

BCS-54 · Tests of provider-specific queries and constraints run against the production database engine, not EF Core InMemory

BCS-75/BCS-76 · A turn that changes production C# code changes tests too, or says why none applies (review, once per stop)

BCS-76 · Tests assert an observable outcome; no test without assertion and no tautological assertion (Assert.True(true))

BCS-77 · HTTP contracts (routing, binding, authorization, errors) are tested through the application host, not by calling controllers directly

BCS-78 · Test classes do not share mutable static state between tests (order and parallelism dependence) (review)

BCS-79 · Asynchronous tests wait for events or bounded conditions, not fixed sleeps (Thread.Sleep, Task.Delay)

BCS-80 · The user approves edits that remove test methods or assertions from a test file

BCS-80 · The user approves newly skipped or ignored tests

Records the work tree when a prompt starts, the baseline of the end-of-turn and build-output checks (BCS-01, BCS-05, BCS-28, BCS-75)

BCS-01 · Claude does not end a turn with compiler errors it introduced in C# sources or the files that use them (csharp-ls)

BCS-81 · Production code ships implemented behavior, not NotImplementedException, TODO-only bodies or TODO stub returns

BCS-83 · A final message claiming a passing build or tests needs a successful dotnet run after Claude's last edit

BCS-83 · Records, per session, Claude's edits and the dotnet build, test or format runs that succeeded after them