Resilience (Retries & Idempotency) rules

Provide a single idempotency-keyed erasure workflow that scrubs PII in primary DB, caches, search indices, and object storage; emit an audit event with erasure_request_id. (GDPR Art. 17)

Wrap HTTP/SDK calls with timeouts and catch transport/errors; log context and map to domain failures.

Configure Sidekiq retries and dead-lettering; use backoff for transient failures and idempotent jobs.

Surround network and IPC calls with try/catch for IOException and timeouts; map to domain errors and log context.

Wrap network/filesystem/process calls; check status codes/results and add context to failures.

Create daily encrypted backups (KMS keys) with retention and geo-redundancy; run quarterly restore tests and record results in the audit log.

Before approving/merging risky changes, check whether there is an active critical production incident. - If an incident/monitoring MCP is available (PagerDuty, Datadog Monitors): query for active Sev1/Sev2 incidents. - If there is an active incident: warn the author and suggest delaying merges/deploys or using an explicit emergency override process.

If a PR introduces workloads in a namespace that lacks a default-deny NetworkPolicy, add one plus explicit allow rules.

If the change is risky or user-facing, describe the feature flag, rollout plan (stages/segments), monitoring signals, and a clear rollback procedure.

All outbound connections that may carry CHD/PAN tokens must enforce TLS >= 1.2, validate hostname/chain, and optionally pin gateway SPKI. Disable insecure ciphers/versions. (PCI DSS 4.0 Req. 4)

Detect transient vs non-transient DB errors; add context and apply retry policies only where safe (idempotent reads/operations).

For stateful/critical infra (state buckets, databases), create resources with pulumi.Protect(true) to block accidental destroy.

After server-side mutations, call revalidatePath or revalidateTag to refresh cached RSC data.

Wrap PII scrubbing and session invalidation in a single DB transaction; publish a gdpr.erased event with subject ID and timestamp after commit.

Wrap per-item work in try/catch, collect failures, and continue when appropriate; never let one failure abort the entire batch by default.

For Deployments with replicas ≥ 2, include a PodDisruptionBudget with minAvailable or maxUnavailable set.

Set connect, read, and write timeouts for HTTP/DB/queue clients; never rely on indefinite waits.

Use context.WithTimeout for HTTP and DB calls; log request deadlines and results; treat timeouts as audit-worthy events.

Check for hash key lookups without default values. If a missing key is accessed, suggest using `fetch` with a default value.

Functions that perform external calls or long operations should accept a `context.Context` parameter and respect its cancellation. Use context timeouts or cancellation signals to stop work that is no longer needed.

For many independent tasks, prefer Promise.allSettled and handle per-item results.