Walk a web-service security checklist — OWASP Top 10, auth, data exposure, configuration, dependencies. For a service taking untrusted input over a network; on a mobile, embedded, library, or pipeline target it reports cleanly about the wrong threats.
Walk a test-strategy pass — which level each test belongs at, what to cover first, the edge cases that get missed. Verifying a completion claim is verify; chasing one failing test is debug.
Evidence protocol for completion claims (the Seal Test): name the proving command before running it, show the check can fail, bind the result to a tree state, and label every claim executed / read / unverified. Use when: about to say done, fixed, passes, or complete; before a commit; before handing work to the review…
Prose and structure rules for review comments, PR bodies, and reports. Structure rules are language-agnostic; sentence rules are per-language (Korean and English sections — they are independent norms, not mirrors). Use when: writing a review comment, PR body, investigation report, or a reply to another team. NOT for…