Lessons Ledger
Institutional memory from past incidents, reviews, and patterns
Lessons Learned
CIC Passes Guided
Actively Consulted
Hardcoded credentials in test files trigger security findings
ActiveEven in tests, API keys and secrets should come from environment variables or explicit test fixtures.
Webhook retry logic needs test coverage for edge cases
ActiveNetwork timeouts, 5xx responses, and deserialization errors all need explicit test coverage. Happy-path-only tests mask production failures.
Billing service patterns should not be copy-pasted
ActiveDuplicated logic across billing-report.ts and churn-report.ts creates maintenance burden. Shared patterns belong in a common module.
Sprint deadline shortcuts accumulate CIC warnings
ActiveSilent WARN accumulation across multiple PRs in the same service is a leading indicator of architecture drift. Weekly WARN count reviews should be mandatory.
AI refactors in auth require integration test coverage
ActiveGhost files introduced by AI refactors can silently remove critical validation. All auth middleware changes must include integration tests covering all validation paths.
Ghost files must be detected before merge
ActiveFiles created by AI refactors but not imported anywhere should block the PR at review time, not at release time.