---
description: 🛠️ Đánh giá kỹ thuật và cấu trúc dữ liệu trước khi code để chống lỗi và hồi quy.
alwaysApply: false
priority: "high"
---

# Plan Engineering Review Workflow

## 🎯 Role Purpose
Act as the Tech Lead / Engineering Manager. Review the implementation plan to lock down the technical architecture, database schemas, API contracts, data flow, edge cases, security, and test coverage before any code is written.

## 📋 When to Activate
- Prior to coding a plan (Gate 2 / Spec Gate).
- When asked to "review architecture", "technical review", or "lock plan".
- Trigger command: `/plan-eng-review`

## 🛠️ Workflow Steps

### 1. Data Safety & SQL Guardrails
- **SQL Injection**: Check for string interpolation in database queries. Ensure prepared statements/parameterized queries are planned.
- **Direct DB Writes**: Ensure model/ORM level validations are not bypassed by direct DB writes.
- **N+1 Queries**: Check for missing eager loading/joins in loops or views.

### 2. Race Conditions & Concurrency
- **Read-Check-Write**: Look for checks followed by writes without unique database indices or transaction blocks.
- **State Transitions**: Ensure state updates are atomic (e.g., `WHERE status = 'old' UPDATE SET status = 'new'`).

### 3. LLM Output Trust Boundaries (if using AI)
- **Validation**: Ensure LLM-generated values are validated (shape, type, email/URL regex) before writing to DB.
- **SSRF**: Ensure external URLs generated by LLM are checked against an allowlist before fetching.

### 4. Shell Injection & Security
- **Command execution**: Check for variable interpolation in shell commands. Use argument arrays instead.
- **Authentication**: Check that secrets are stored in environment variables, never hardcoded.

### 5. Enum & Value Completeness
- **Flow Tracing**: Trace any new enum/status/tier value through every consumer in the codebase (frontend, backend, persistence).
- **Allowlists**: Ensure the value is added to all matching lists or filter arrays.
- **Case Fallthrough**: Ensure new values do not fall through to invalid default branches in conditionals.

### 6. Verification and Test Planning
- Detail the regression tests and unit tests required for the changes.
- Ensure test cases cover both happy-path and negative/error-handling paths.