roadmap.json

{
  "roadmap_version": "1.0.4",
  "project": "maatify/security-guard",
  "note": "introduces the new unified SecurityEventDTO architecture and shifts phase numbering forward accordingly.",

  "core_dependencies": {
    "storage_layer": "maatify/data-adapters",
    "fake_layer": "maatify/data-fakes",
    "contracts": "maatify/common",
    "rules": [
      "All MySQL, Redis, and MongoDB access MUST go through AdapterInterface",
      "All real execution MUST use maatify/data-adapters",
      "All fake execution and adapter behavior tests MUST use maatify/data-fakes",
      "Direct PDO, Redis, or MongoDB client usage inside security-guard is forbidden"
    ]
  },

  "phases": [

    {
      "id": "phase1",
      "title": "Environment Setup",
      "version": "0.0.1",
      "status": "completed",
      "summary": "Project bootstrap, Composer setup, testing environment, and namespace preparation.",
      "tracks": {
        "core": {
          "tasks": [
            "Create GitHub repository",
            "Initialize Composer project",
            "Prepare .env.example",
            "Setup autoloading namespaces"
          ],
          "outputs": [
            "composer.json",
            ".env.example"
          ]
        },
        "tests": {
          "tasks": [
            "Setup PHPUnit",
            "Prepare CI environment"
          ],
          "outputs": [
            "tests/bootstrap.php"
          ]
        },
        "examples": {
          "tasks": [],
          "outputs": []
        }
      }
    },

    {
      "id": "phase2",
      "title": "Core Architecture & DTOs",
      "version": "0.0.2",
      "status": "completed",
      "summary": "Finalize core DTO structures, interfaces, and the high-level Facade.",
      "tracks": {
        "core": {
          "tasks": [
            "Create LoginAttemptDTO",
            "Create SecurityBlockDTO (final int-based timestamps version)",
            "Design SecurityGuardDriverInterface",
            "Create AbstractSecurityGuardDriver",
            "Create SecurityGuardService (Facade)",
            "IdentifierStrategy integration",
            "Normalization + block encoding/decoding",
            "Prepare config loader"
          ],
          "outputs": [
            "src/DTO/LoginAttemptDTO.php",
            "src/DTO/SecurityBlockDTO.php",
            "src/Contracts/SecurityGuardDriverInterface.php",
            "src/Drivers/AbstractSecurityGuardDriver.php",
            "src/Service/SecurityGuardService.php",
            "src/Identifier/Contracts/IdentifierStrategyInterface.php",
            "src/Config/SecurityConfigLoader.php"
          ]
        },
        "tests": { "tasks": [], "outputs": [] },
        "examples": { "tasks": [], "outputs": [] }
      }
    },

    {
      "id": "phase3",
      "title": "Driver Implementations",
      "version": "0.0.3",
      "status": "completed",
      "summary": "Implement all Security Guard storage drivers on top of maatify/data-adapters.",
      "tracks": {
        "core": {
          "tasks": [
            "Implement RedisSecurityGuard using RedisClientProxy",
            "Implement PdoMySQLDriver",
            "Implement DbalMySQLDriver",
            "Implement MySQLSecurityGuard",
            "Implement MongoSecurityGuard",
            "Create SecurityGuardResolver",
            "Fix PHPStan generics + safe casting",
            "Unify block/unblock/cleanup behavior",
            "Normalize identifier using strategy"
          ],
          "outputs": [
            "src/Drivers/RedisSecurityGuard.php",
            "src/Drivers/MySQL/PdoMySQLDriver.php",
            "src/Drivers/MySQL/DbalMySQLDriver.php",
            "src/Drivers/MySQL/MySQLSecurityGuard.php",
            "src/Drivers/Mongo/MongoSecurityGuard.php",
            "src/Drivers/Support/RedisClientProxy.php",
            "src/Resolver/SecurityGuardResolver.php"
          ],
          "changes": [
            "RedisSecurityGuard now fully uses RedisClientProxy abstraction",
            "PdoMySQLDriver: fixed fetchColumn|false logic + strict int timestamps",
            "DbalMySQLDriver: safe casting + consistent SQL + REPLACE INTO support",
            "MySQLSecurityGuard delegates to PDO/DBAL transparently",
            "MongoSecurityGuard rewritten with proper Collection handling + indexes",
            "Resolver fixed to match MongoDatabase instead of MongoClient",
            "Resolver refactored to remove unreachable conditions",
            "Redis proxy unified commands: hGet, hSet, hDel, hGetAll, expire, del, info",
            "Abstract driver now strictly validates block payload during decodeBlock()"
          ]
        },
        "tests": { "tasks": [], "outputs": [] },
        "examples": { "tasks": [], "outputs": [] }
      }
    },

    {
      "id": "phase4",
      "title": "Unified Security Events (NEW)",
      "version": "0.0.4",
      "status": "completed",
      "summary": "Introduce unified SecurityEventDTO and event normalization across all security actions.",
      "tracks": {
        "core": {
          "tasks": [
            "Create SecurityEventDTO (action/platform/userId/userType/context)",
            "Create SecurityEventTypeEnum",
            "Refactor LoginAttemptDTO to extend SecurityEventDTO",
            "Introduce SecurityEventFactory",
            "Unify event timestamps",
            "Normalize subject/platform/action rules",
            "Ensure driver compatibility with unified event model"
          ],
          "outputs": [
            "src/DTO/SecurityEventDTO.php",
            "src/Enums/SecurityEventTypeEnum.php",
            "src/DTO/LoginAttemptDTO.php",
            "src/Event/SecurityEventFactory.php"
          ]
        },
        "tests": { "tasks": [], "outputs": [] },
        "examples": {
          "tasks": [],
          "outputs": [
            "docs/phases/README.phase4.md"
          ]
        }
      }
    },

    {
      "id": "phase5",
      "title": "Core Logic & Service Layer",
      "version": "0.0.5",
      "status": "completed",
      "summary": "Main security orchestration logic built on top of unified security events.",
      "tracks": {
        "core": {
          "tasks": [
            "handleEvent() logic",
            "handleAttempt() logic",
            "Reset on success",
            "Block/unblock logic",
            "IP failure counters",
            "Expose isBlocked()",
            "ENV thresholds integration"
          ],
          "outputs": [
            "src/SecurityGuardService.php"
          ]
        },
        "tests": { "tasks": [], "outputs": [] },
        "examples": { "tasks": [], "outputs": [] }
      }
    },


    {
      "id": "phase6",
      "title": "Driver Lifecycle & Resolver Responsibility Contract",
      "version": "0.0.6",
      "status": "blocking",
      "summary": "Formalize driver lifecycle states and strictly define resolver responsibilities to eliminate side effects, duplicated initialization, and implicit infrastructure access.",
      "tracks": {
        "core": {
          "tasks": [
            "Define driver lifecycle states (uninitialized / ready / failed)",
            "Introduce explicit initialization contract in AbstractSecurityGuardDriver",
            "Ensure resolver never triggers side-effectful initialization",
            "Move all connection logic behind lazy initialization barrier",
            "Guarantee drivers do not auto-connect in constructors",
            "Ensure all public driver methods are safe before initialization",
            "Unify lifecycle behavior across Redis, MySQL, and Mongo drivers"
          ],
          "outputs": [
            "src/Drivers/AbstractSecurityGuardDriver.php",
            "src/Drivers/RedisSecurityGuard.php",
            "src/Drivers/MySQL/MySQLSecurityGuard.php",
            "src/Drivers/Mongo/MongoSecurityGuard.php"
          ]
        },
        "tests": {
          "tasks": [
            "Add lifecycle unit tests for all drivers",
            "Ensure resolver tests do not require real infrastructure",
            "Validate resolver is side-effect free",
            "Ensure initialization occurs only on first real operation",
            "Add explicit failure semantics for initialization failures"
          ],
          "outputs": [
            "tests/Drivers/Lifecycle/",
            "tests/Resolver/LifecycleTest.php"
          ]
        },
        "examples": { "tasks": [], "outputs": [] }
      },
      "rules": [
        "Resolver must be side-effect free",
        "Drivers must be lazy-initialized",
        "Initialization logic must exist in exactly one place per driver",
        "Public driver API must be safe before initialization",
        "No real infrastructure access during resolver tests"
      ]
    },


    {
      "id": "phase7",
      "title": "IntegrationV2 Contracts & Architectural Decision Lock",
      "version": "0.0.7",
      "status": "in_progress",
      "summary": "Lock IntegrationV2 architectural decisions and define explicit host vs library responsibilities.",
      "tracks": {
        "tests": {
          "tasks": [
            {
              "id": "decision_lock",
              "description": "Lock architectural decision: security-guard must not create or migrate schemas",
              "status": "pending",
              "done_criteria": [
                "No CREATE TABLE logic exists in drivers",
                "No schema auto-bootstrap exists in the library",
                "Decision documented inside IntegrationV2 contract"
              ]
            },
            {
              "id": "integration_v2_contract_doc",
              "description": "Create global IntegrationV2 contract document",
              "status": "pending",
              "outputs": [
                "docs/integration/INTEGRATION_V2_CONTRACT.md"
              ],
              "done_criteria": [
                "Redis expectations documented",
                "MySQL expectations documented",
                "Mongo expectations documented",
                "Host vs library responsibilities clearly separated"
              ]
            }
          ],
          "rules": [
            "IntegrationV2 is the ONLY source of truth for real infrastructure behavior",
            "Infrastructure must be prepared by the host system",
            "Library must fail fast and clearly when contracts are violated"
          ]
        }
      }
    },

    {
      "id": "phase8",
      "title": "IntegrationV2 Real Infrastructure Validation",
      "version": "0.0.8",
      "status": "pending",
      "summary": "Validate Redis, MySQL, and Mongo behavior using real infrastructure with explicit schema contracts.",
      "tracks": {
        "tests": {
          "tasks": [
            {
              "id": "integrationv2_base",
              "description": "Create IntegrationV2 test layer",
              "status": "completed"
            },
            {
              "id": "real_infra_validation",
              "description": "Validate Redis/MySQL/Mongo real behavior using real infrastructure",
              "status": "completed"
            },
            {
              "id": "mysql_schema_contract",
              "description": "Define explicit MySQL schema contract",
              "status": "pending",
              "outputs": [
                "tests/IntegrationV2/MySQL/schema.sql"
              ]
            },
            {
              "id": "mysql_schema_docs",
              "description": "Document MySQL schema expectations",
              "status": "pending",
              "outputs": [
                "tests/IntegrationV2/MySQL/README.md"
              ]
            },
            {
              "id": "mysql_clear_failure",
              "description": "Ensure MySQL tests fail clearly when schema is missing",
              "status": "pending"
            }
          ]
        }
      }
    },

    {
      "id": "phase9",
      "title": "IntegrationV2 Test Governance & CI Stability",
      "version": "0.0.9",
      "status": "pending",
      "summary": "Eliminate risky tests, validate PHPUnit configuration, and enforce CI stability.",
      "tracks": {
        "tests": {
          "tasks": [
            {
              "id": "resolver_enforcement",
              "description": "Enforce resolver-based adapter creation",
              "status": "completed"
            },
            {
              "id": "legacy_deprecation",
              "description": "Deprecate legacy integration tests",
              "status": "completed"
            },
            {
              "id": "phpunit_exclusion",
              "description": "Exclude legacy integration tests from PHPUnit execution",
              "status": "completed"
            },
            {
              "id": "phpunit_config_validation",
              "description": "Validate PHPUnit configuration integrity",
              "status": "pending"
            },
            {
              "id": "risky_test_elimination",
              "description": "Eliminate PHPUnit risky integration tests",
              "status": "pending"
            },
            {
              "id": "ci_gate_validation",
              "description": "Run CI validation gate for IntegrationV2 stability",
              "status": "pending"
            },
            {
              "id": "phase_closure",
              "description": "Close IntegrationV2 architectural contract phase",
              "status": "pending"
            }
          ]
        }
      }
    },

    {
      "id": "phase10",
      "title": "Config Normalization & DTO Injection Layer",
      "version": "0.0.10",
      "status": "pending",
      "summary": "Introduce strict DTO-based configuration model. Eliminate all internal defaults and ensure the library is fully controlled by host-provided configuration.",
      "tracks": {
        "core": {
          "tasks": [
            "Design SecurityGuardConfigDTO as the single configuration entry point",
            "Design ActionRateLimitConfigDTO",
            "Design GlobalRateLimitConfigDTO",
            "Design BackoffPolicyConfigDTO",
            "Remove all internal default configuration logic",
            "Ensure all runtime logic consumes DTOs only"
          ],
          "outputs": [
            "src/Config/DTO/SecurityGuardConfigDTO.php",
            "src/Config/DTO/ActionRateLimitConfigDTO.php",
            "src/Config/DTO/GlobalRateLimitConfigDTO.php",
            "src/Config/DTO/BackoffPolicyConfigDTO.php"
          ]
        },
        "tests": {
          "tasks": [
            "Validate DTO acceptance",
            "Validate resolver wiring using DTOs"
          ],
          "outputs": []
        },
        "examples": {
          "tasks": [
            "Document host-driven configuration injection flow"
          ],
          "outputs": [
            "docs/phases/README.phase6.md"
          ]
        }
      }
    },

    {
      "id": "phase11",
      "title": "Global Rate Limiter Overlay Enforcement",
      "version": "0.0.11",
      "status": "pending",
      "summary": "Introduce a real global rate limiter overlay that executes before all action-level enforcement using a dedicated DTO-based configuration.",
      "tracks": {
        "core": {
          "tasks": [
            "Introduce GlobalRateLimiter enforcement layer",
            "Ensure global limiter executes before action limiter",
            "Ensure global limiter uses GlobalRateLimitConfigDTO only",
            "Add explicit source attribution for global violations"
          ],
          "outputs": [
            "src/RateLimit/GlobalRateLimiter.php",
            "src/Enforcement/EnforcingRateLimiter.php"
          ]
        },
        "tests": {
          "tasks": [
            "Unit tests for global-before-action enforcement order",
            "Integration tests using Redis adapter"
          ],
          "outputs": []
        },
        "examples": {
          "tasks": [],
          "outputs": []
        }
      }
    },

    {
      "id": "phase12",
      "title": "Backoff Policy Hardening & banTime Integration",
      "version": "0.0.12",
      "status": "pending",
      "summary": "Upgrade exponential backoff logic to a deterministic punishment strategy governed fully by DTO-provided policy, including banTime integration.",
      "tracks": {
        "core": {
          "tasks": [
            "Introduce BackoffPolicyInterface",
            "Implement ExponentialBackoffPolicy using BackoffPolicyConfigDTO",
            "Integrate banTime as a hard cap on calculated delays",
            "Remove any implicit backoff assumptions"
          ],
          "outputs": [
            "src/Backoff/BackoffPolicyInterface.php",
            "src/Backoff/ExponentialBackoffPolicy.php"
          ]
        },
        "tests": {
          "tasks": [
            "Unit tests for backoff calculation",
            "Ensure banTime cap is respected"
          ],
          "outputs": []
        },
        "examples": {
          "tasks": [],
          "outputs": []
        }
      }
    },

    {
      "id": "phase13",
      "title": "Phase 5 Coverage Completion & Validation",
      "version": "0.0.13",
      "status": "pending",
      "summary": "Complete missing tests for Phase 5 core logic and enforcement layers to ensure production-grade stability.",
      "tracks": {
        "core": {
          "tasks": [
            "No production code changes allowed"
          ],
          "outputs": []
        },
        "tests": {
          "tasks": [
            "Cover EnforcingRateLimiter logic",
            "Cover GlobalRateLimiter enforcement",
            "Cover BackoffPolicy behavior",
            "Use real Redis adapter only (no mocks)"
          ],
          "outputs": [
            "tests/RateLimit/",
            "tests/Backoff/"
          ]
        },
        "examples": {
          "tasks": [],
          "outputs": []
        }
      }
    },

    {
      "id": "phase14",
      "title": "Internal API Freeze (No Public Release)",
      "version": "0.14.0",
      "status": "pending",
      "summary": "Freeze internal APIs for stabilization and validation. No public release, no tags, no Packagist publishing.",
      "tracks": {
        "core": {
          "tasks": [
            "Lock public API surface",
            "Prohibit breaking changes without major version bump",
            "Tag stable release"
          ],
          "outputs": [
            "CHANGELOG.md",
            "README.md"
          ]
        },
        "tests": {
          "tasks": [
            "Final CI validation",
            "Coverage threshold enforcement"
          ],
          "outputs": []
        },
        "examples": {
          "tasks": [
            "Final integration documentation"
          ],
          "outputs": [
            "docs/phases/README.phase10.md"
          ]
        }
      }
    },

    {
      "id": "phase15",
      "title": "Rate Limiter Bridge",
      "version": "0.15.0",
      "status": "pending",
      "summary": "Integration with maatify/rate-limiter using unified event pipeline.",
      "tracks": {
        "core": {
          "tasks": [
            "Design event hooks",
            "Implement bridge listener",
            "Forward rate-limit violations as SecurityEventDTO"
          ],
          "outputs": [
            "src/Bridge/RateLimiterBridge.php"
          ]
        },
        "tests": {
          "tasks": [
            "Flood attack testing"
          ],
          "outputs": []
        },
        "examples": {
          "tasks": [
            "Manual integration support",
            "Documentation"
          ],
          "outputs": [
            "docs/phases/README.phase6.md"
          ]
        }
      }
    },

    {
      "id": "phase16",
      "title": "Audit DTO & Storage",
      "version": "0.16.0",
      "status": "pending",
      "summary": "Introduce audit event DTO and base storage abstraction.",
      "tracks": {
        "core": {
          "tasks": [
            "Create AuditEventDTO",
            "Define AuditStorageInterface",
            "Implement base audit repository via maatify/data-adapters"
          ],
          "outputs": [
            "src/Audit/AuditEventDTO.php",
            "src/Audit/Contracts/AuditStorageInterface.php"
          ]
        },
        "tests": { "tasks": [], "outputs": [] },
        "examples": { "tasks": [], "outputs": [] }
      }
    },

    {
      "id": "phase17",
      "title": "Mongo Audit Forwarding",
      "version": "0.17.0",
      "status": "pending",
      "summary": "Forward unified audit events into MongoDB collections.",
      "tracks": {
        "core": {
          "tasks": [
            "Create Mongo audit driver",
            "TTL index setup",
            "Fallback handling via resolver"
          ],
          "outputs": [
            "src/Audit/Drivers/MongoAuditDriver.php"
          ]
        },
        "tests": { "tasks": [], "outputs": [] },
        "examples": { "tasks": [], "outputs": [] }
      }
    },

    {
      "id": "phase18",
      "title": "Audit History API",
      "version": "0.18.0",
      "status": "pending",
      "summary": "Expose security audit history.",
      "tracks": {
        "core": {
          "tasks": [
            "Audit query service",
            "Pagination",
            "Date range filtering"
          ],
          "outputs": [
            "src/Audit/AuditHistoryService.php"
          ]
        },
        "tests": { "tasks": [], "outputs": [] },
        "examples": { "tasks": [], "outputs": [] }
      }
    },

    {
      "id": "phase19",
      "title": "Audit Filters & Indexes",
      "version": "0.19.0",
      "status": "pending",
      "summary": "Advanced filtering and indexing.",
      "tracks": {
        "core": {
          "tasks": [
            "IP filtering",
            "User type filtering",
            "Composite indexes"
          ],
          "outputs": [
            "docs/phases/README.phase10.md"
          ]
        },
        "tests": { "tasks": [], "outputs": [] },
        "examples": { "tasks": [], "outputs": [] }
      }
    },

    {
      "id": "phase20",
      "title": "PSR Logger Integration",
      "version": "0.20.0",
      "status": "pending",
      "summary": "Structured logging for security actions.",
      "tracks": {
        "core": {
          "tasks": [
            "Inject PSR logger",
            "Log block/unblock actions",
            "Log suspicious patterns"
          ],
          "outputs": [
            "src/Logging/SecurityLogger.php"
          ]
        },
        "tests": { "tasks": [], "outputs": [] },
        "examples": { "tasks": [], "outputs": [] }
      }
    },

    {
      "id": "phase21",
      "title": "Telegram Alerts",
      "version": "0.21.0",
      "status": "pending",
      "summary": "Real-time alerts via Telegram bot.",
      "tracks": {
        "core": {
          "tasks": [
            "Telegram notifier",
            "Configurable alert channels",
            "Critical alert levels"
          ],
          "outputs": [
            "src/Alerts/TelegramAlertService.php"
          ]
        },
        "tests": { "tasks": [], "outputs": [] },
        "examples": { "tasks": [], "outputs": [] }
      }
    },

    {
      "id": "phase22",
      "title": "Webhook Dispatcher",
      "version": "0.22.0",
      "status": "pending",
      "summary": "Generic webhook dispatcher.",
      "tracks": {
        "core": {
          "tasks": [
            "Webhook payload schema",
            "POST dispatcher",
            "Async retry policy"
          ],
          "outputs": [
            "src/Webhook/WebhookDispatcher.php"
          ]
        },
        "tests": { "tasks": [], "outputs": [] },
        "examples": { "tasks": [], "outputs": [] }
      }
    },

    {
      "id": "phase23",
      "title": "Retry Engine & Delivery Tests",
      "version": "0.23.0",
      "status": "pending",
      "summary": "Reliable delivery system.",
      "tracks": {
        "core": {
          "tasks": [
            "Retry queue",
            "Backoff strategy",
            "Failure simulations"
          ],
          "outputs": []
        },
        "tests": {
          "tasks": [],
          "outputs": [
            "tests/Webhook/RetryTest.php"
          ]
        },
        "examples": { "tasks": [], "outputs": [] }
      }
    },

    {
      "id": "phase24",
      "title": "Monitoring APIs",
      "version": "0.24.0",
      "status": "pending",
      "summary": "Monitoring endpoints and admin API controls.",
      "tracks": {
        "core": {
          "tasks": [
            "Health endpoint",
            "Stats endpoint",
            "Manual unblock API"
          ],
          "outputs": [
            "src/Monitoring/SecurityMetricsService.php"
          ]
        },
        "tests": { "tasks": [], "outputs": [] },
        "examples": { "tasks": [], "outputs": [] }
      }
    },

    {
      "id": "phase25",
      "title": "Unit Consistency Tests",
      "version": "0.25.0",
      "status": "pending",
      "summary": "Validate driver parity.",
      "tracks": {
        "core": { "tasks": [], "outputs": [] },
        "tests": {
          "tasks": [
            "Driver parity tests",
            "Edge case consistency"
          ],
          "outputs": [
            "tests/Consistency/"
          ]
        },
        "examples": { "tasks": [], "outputs": [] }
      }
    },

    {
      "id": "phase26",
      "title": "Attack Simulations",
      "version": "0.26.0",
      "status": "pending",
      "summary": "Simulate distributed and burst attacks.",
      "tracks": {
        "core": { "tasks": [], "outputs": [] },
        "tests": {
          "tasks": [
            "Multi-IP brute force",
            "Burst login attempts"
          ],
          "outputs": [
            "tests/Simulation/"
          ]
        },
        "examples": { "tasks": [], "outputs": [] }
      }
    },

    {
      "id": "phase27",
      "title": "Redis & Mongo Stress",
      "version": "0.27.0",
      "status": "pending",
      "summary": "High-load performance stress tests.",
      "tracks": {
        "core": { "tasks": [], "outputs": [] },
        "tests": {
          "tasks": [
            "Redis load",
            "Mongo TTL stress"
          ],
          "outputs": [
            "tests/Stress/"
          ]
        },
        "examples": { "tasks": [], "outputs": [] }
      }
    },

    {
      "id": "phase28",
      "title": "Coverage Hardening",
      "version": "0.28.0",
      "status": "pending",
      "summary": "Achieve stable 85%+ coverage.",
      "tracks": {
        "core": { "tasks": [], "outputs": [] },
        "tests": {
          "tasks": [
            "Coverage gap analysis",
            "Critical path coverage enforcement"
          ],
          "outputs": [
            "coverage/"
          ]
        },
        "examples": { "tasks": [], "outputs": [] }
      }
    },

    {
      "id": "phase29",
      "title": "Documentation & Packagist Release",
      "version": "0.29.0",
      "status": "pending",
      "summary": "Finalize documentation & release.",
      "tracks": {
        "core": {
          "tasks": [
            "README.md",
            "CHANGELOG.md",
            "Phase documentation",
            "Packagist publishing",
            "Integration validation"
          ],
          "outputs": [
            "README.md",
            "CHANGELOG.md"
          ]
        },
        "tests": { "tasks": [], "outputs": [] },
        "examples": { "tasks": [], "outputs": [] }
      }
    }

  ],

  "testing_policy": {
    "phpunit": "latest",
    "phpstan": "level-max",
    "psr": ["PSR-4", "PSR-12", "PSR-3", "PSR-14 (events)"],
    "rules": [
      "Legacy integration tests must not run in CI",
      "IntegrationV2 tests require real infrastructure",
      "Unit tests may use data-fakes",
      "Coverage tests must not rely on real infrastructure",
      "No test exists to make CI green; tests exist to protect production"
    ]
  }
}