84 lines
4.9 KiB
Markdown
84 lines
4.9 KiB
Markdown
# Audit Plan & Subagent Roles
|
|
|
|
## Subagent Execution Mode
|
|
**Operational Mode**: `ISOLATED_SEQUENTIAL_ROLE_EXECUTION`
|
|
> [!IMPORTANT]
|
|
> The current workspace environment does not feature independent parallel repository-reading subagents. All audit roles will be executed sequentially with isolated file scopes and strict domain boundaries.
|
|
|
|
---
|
|
|
|
## Mandatory Global Audit Exclusions
|
|
All roles must explicitly exclude generated artifacts, build outputs, and dependencies:
|
|
- `**/node_modules/**`
|
|
- `**/.next/**`
|
|
- `**/dist/**`
|
|
- `**/build/**`
|
|
- `**/coverage/**`
|
|
- `**/.turbo/**`
|
|
- `**/.cache/**`
|
|
- `**/*.tsbuildinfo`
|
|
- `frontend/application/**` (Generated/Placeholder directory)
|
|
- `frontend/admin-panel/**` (Placeholder directory)
|
|
- Generated Prisma client (`.prisma/client`, `@prisma/client`)
|
|
|
|
---
|
|
|
|
## Reconciled Audit Roles & Assignments
|
|
|
|
### 1. Lead Architect / Orchestrator
|
|
- **Scope**: System architecture, cross-cutting contracts, global governance, and Phase 2 report consolidation.
|
|
- **Included Paths**: `package.json`, `README.md`, `BACKEND_INTEGRATION.md`, `DATABASE_SCHEMA.md`, `docs/audit/*`.
|
|
- **Expected Output**: `docs/audit/05-architectural-audit.md`
|
|
|
|
### 2. React / Vite Storefront Auditor
|
|
- **Scope**: Active customer storefront UI, React components, state management (Zustand), client-side routing, styling, and asset management.
|
|
- **Included Paths**: `src/**/*`, `index.html`, `vite.config.ts`, `tsconfig.json`, `package.json`.
|
|
- **Expected Output**: `docs/audit/06-storefront-audit.md`
|
|
|
|
### 3. NestJS Backend Auditor
|
|
- **Scope**: Controller handlers, injectable services, NestJS modules, guards, exception filters, DTO validation, and route structure.
|
|
- **Included Paths**: `backend/src/**/*`, `backend/tsconfig.json`, `backend/nest-cli.json`, `backend/package.json`.
|
|
- **Expected Output**: `docs/audit/07-backend-audit.md`
|
|
|
|
### 4. Admin Features Auditor
|
|
- **Scope**: Backend administrative endpoints (`backend/src/settings`), role-based protection for admin capabilities (`Admin` role guard checks), and backend management DTOs. (Note: Standalone admin frontend is absent; scope focuses on backend admin features).
|
|
- **Included Paths**: `backend/src/settings/**/*`, `backend/src/auth/guards/**/*`, `src/components/**/*` (if admin UI controls exist).
|
|
- **Expected Output**: `docs/audit/08-admin-features-audit.md`
|
|
|
|
### 5. Database & Data Integrity Auditor
|
|
- **Scope**: Schema definitions, relational constraints, indices, migration history, monetary/weight decimal precision (`Decimal(15,2)`), and data seeding logic.
|
|
- **Included Paths**: `backend/prisma/schema.prisma`, `backend/prisma/seed.ts`, `DATABASE_SCHEMA.md`.
|
|
- **Expected Output**: `docs/audit/09-database-audit.md`
|
|
|
|
### 6. Security Auditor
|
|
- **Scope**: Authentication flows, JWT token lifecycle, password hashing (`bcrypt`), Helmet HTTP security headers, rate limiting (`@nestjs/throttler`), CORS, and secret exposure risks.
|
|
- **Included Paths**: `backend/src/auth/**/*`, `backend/src/common/**/*`, `.env.example`, `docker-compose.yml`, `nginx.conf`.
|
|
- **Expected Output**: `docs/audit/10-security-audit.md`
|
|
|
|
### 7. TypeScript & Code Quality Auditor
|
|
- **Scope**: Strict type safety, avoiding `any` assertions, compiler configuration alignment, code formatting compliance, and lint rule enforcement.
|
|
- **Included Paths**: `tsconfig.json`, `backend/tsconfig.json`, `src/**/*`, `backend/src/**/*`.
|
|
- **Expected Output**: `docs/audit/11-code-quality-audit.md`
|
|
|
|
### 8. Testing & Reliability Auditor
|
|
- **Scope**: Unit test suites, integration test setups, spec assertion completeness, mocking strategies, and edge-case handling.
|
|
- **Included Paths**: `src/test/**/*`, `backend/test/**/*`, `backend/src/**/*.spec.ts`, `package.json`, `backend/package.json`.
|
|
- **Expected Output**: `docs/audit/12-testing-audit.md`
|
|
|
|
### 9. DevOps & CI/CD Auditor
|
|
- **Scope**: Multi-stage Docker builds, container orchestration, reverse proxy NGINX rules, Prometheus metrics endpoints, and missing CI/CD pipeline gaps.
|
|
- **Included Paths**: `Dockerfile`, `backend/Dockerfile`, `docker-compose.yml`, `nginx.conf`, `prometheus.yml`, `.dockerignore`, `backend/.dockerignore`.
|
|
- **Expected Output**: `docs/audit/13-devops-audit.md`
|
|
|
|
### 10. Documentation Engineer
|
|
- **Scope**: Synchronization between source implementation and documentation artifacts (Swagger OpenAPI specs, markdown architecture guides).
|
|
- **Included Paths**: `README.md`, `swagger.yml`, `BACKEND_INTEGRATION.md`, `DATABASE_SCHEMA.md`, `backend/README.md`.
|
|
- **Expected Output**: `docs/audit/14-documentation-audit.md`
|
|
|
|
---
|
|
|
|
## Strategy for Deduplication & Consolidation
|
|
- **Strict File Ownership**: Each auditor evaluates code only within their assigned primary directory paths.
|
|
- **Cross-Cutting References**: If an auditor discovers an issue spanning another domain (e.g. security issue inside NestJS controller), they record the specific code location and defer root-cause analysis to the primary domain owner.
|
|
- **Unified Synthesis**: The Lead Orchestrator reviews all auditor outputs to create the final synthesized executive summary.
|