Agent tool → prompt: "You are a CTO Technical Review Agent. Read and follow ALL
instructions in .claude/skills/cto-review/SKILL.md. Project root: [cwd].
Review scope: [arguments]. Execute the review. Save the report to
docs/reports/cto-review-[DATE].md. Return an executive summary with top findings."

Step 1: Define the question precisely
  "Is Directus 11 still actively maintained and what are its known security issues?"
  NOT "Is Directus good?"

Step 2: Search authoritative sources first
  WebSearch: "[technology] security advisory [year]"
  WebSearch: "[technology] CVE [year]"
  WebSearch: "[technology] end of life schedule"
  WebSearch: "[technology] vs [alternative] production [year]"

Step 3: Cross-reference with official sources
  WebFetch: Official documentation, GitHub releases page, changelog
  WebFetch: NIST NVD for specific CVEs
  WebFetch: GitHub security advisories

Step 4: Document the finding with source
  Every research-based finding must include:
  - The source URL
  - Date of the information
  - Relevance to our specific setup

# 1. Check for recent CVEs affecting our stack
WebSearch: "Node.js [version] CVE 2025 2026"
WebSearch: "Directus security vulnerability 2025 2026"
WebSearch: "PostgreSQL [version] security advisory 2025 2026"
WebSearch: "Redis [version] vulnerability 2025 2026"

# 2. Check if our dependencies have known exploits
# For each CRITICAL dependency found in package.json / Cargo.toml / go.mod:
WebSearch: "[package-name] [version] vulnerability"
WebSearch: "[package-name] security issue"

# 3. Validate our architecture decisions against current best practices
WebSearch: "microservices schema per service PostgreSQL best practices [year]"
WebSearch: "API gateway Go vs Node.js performance comparison [year]"
WebSearch: "BullMQ production issues alternatives [year]"

# 4. Check deployment platform status
WebSearch: "Coolify production reliability issues [year]"
WebSearch: "Hetzner security compliance certifications"

## Research Investigation: [Topic]

**Trigger:** [What in the codebase prompted this investigation]
**Question:** [Precise question being answered]

### Sources Consulted
1. [URL] — [Key finding] (accessed [date])
2. [URL] — [Key finding] (accessed [date])
3. [URL] — [Key finding] (accessed [date])

### Analysis
[How does this evidence apply to our specific project?]

### Conclusion
[Recommendation with confidence level: HIGH/MEDIUM/LOW]

### Confidence Assessment
- HIGH: Multiple authoritative sources agree, directly applicable to our setup
- MEDIUM: Sources agree but our context differs slightly, or evidence is from analogous situations
- LOW: Limited evidence, extrapolation required, or conflicting sources — flag for human review

Example: When reviewing the full project, spawn these in parallel:

Agent 1: "Research current CVEs and security advisories for Node.js 22, Directus 11,
          PostgreSQL 16, Redis 7, Axum 0.7, and Go 1.22. Report each with severity,
          affected versions, and whether our versions are patched."

Agent 2: "Research current best practices for Fastify in production 2025-2026.
          Focus on: security middleware, request validation, error handling patterns,
          connection management, and common pitfalls. Compare against Express and Hono."

Agent 3: "Research BullMQ production reliability in 2025-2026. Find reported issues,
          alternatives comparison (pg-boss, Temporal, Trigger.dev), and recommended
          configuration for job queues processing AI workloads."

# Search for hardcoded secrets, API keys, tokens in source code
# CRITICAL: These patterns should NEVER match in committed code

# Check for hardcoded API keys
grep -rn "ANTHROPIC_API_KEY\s*=" --include="*.js" --include="*.ts" --include="*.rs" --include="*.go" services/ packages/
grep -rn "OPENAI_API_KEY\s*=" --include="*.js" --include="*.ts" services/ packages/
grep -rn "STRIPE_SECRET\s*=" --include="*.js" --include="*.ts" services/ packages/

# Check for hardcoded tokens/passwords (common patterns)
grep -rn "password\s*=\s*['\"]" --include="*.js" --include="*.ts" --include="*.rs" --include="*.go" services/ packages/
grep -rn "secret\s*=\s*['\"]" --include="*.js" --include="*.ts" --include="*.rs" --include="*.go" services/ packages/
grep -rn "token\s*=\s*['\"]" --include="*.js" --include="*.ts" --include="*.rs" --include="*.go" services/ packages/

# Check for private keys committed
find . -name "*.pem" -o -name "*.key" -o -name "*.p12" -o -name "*.pfx" | grep -v node_modules | grep -v .git

# Verify .env files are gitignored
git ls-files --cached | grep -i "\.env$" | grep -v "\.env\.example"

# Check for secrets in Docker files
grep -rn "ENV.*KEY\|ENV.*SECRET\|ENV.*PASSWORD\|ENV.*TOKEN" --include="Dockerfile*" infrastructure/ services/

# Check base images — are they pinned to specific versions (not :latest)?
grep -rn "FROM " --include="Dockerfile*" . | grep -v node_modules

# Check for root user (containers should NOT run as root)
# Look for USER directive in Dockerfiles
grep -rn "USER " --include="Dockerfile*" . | grep -v node_modules

# Check for privileged mode or dangerous capabilities
grep -rn "privileged\|cap_add\|SYS_ADMIN\|NET_ADMIN" --include="*.yml" --include="*.yaml" infrastructure/

# Check for exposed ports that shouldn't be public
grep -rn "ports:" -A 5 --include="*.yml" --include="*.yaml" infrastructure/docker/

# Check for health checks defined
grep -rn "healthcheck:" --include="*.yml" --include="*.yaml" infrastructure/docker/

# Check resource limits (prevent container from consuming all host resources)
grep -rn "mem_limit\|cpus\|deploy:" --include="*.yml" --include="*.yaml" infrastructure/docker/

# Check pg_hba.conf or connection configuration
# Verify authentication method (should be scram-sha-256, NOT trust or md5)
grep -rn "trust\|md5" --include="*.conf" --include="*.yaml" --include="*.yml" infrastructure/

# Check for SSL/TLS enforcement on database connections
grep -rn "sslmode\|ssl=" --include="*.js" --include="*.ts" --include="*.rs" --include="*.go" --include="*.yaml" --include="*.yml" services/ infrastructure/

# Check connection strings for plain-text passwords
grep -rn "postgres://.*:.*@" --include="*.js" --include="*.ts" --include="*.rs" --include="*.go" services/ packages/

# Verify schema isolation (each service uses its own schema)
grep -rn "search_path\|SET schema" --include="*.js" --include="*.ts" --include="*.sql" services/ migrations/

# Check for dangerous patterns
grep -rn "eval(" --include="*.js" --include="*.ts" services/ packages/
grep -rn "child_process\|exec(" --include="*.js" --include="*.ts" services/ packages/
grep -rn "Function(" --include="*.js" --include="*.ts" services/ packages/
grep -rn "innerHTML\s*=" --include="*.js" --include="*.ts" --include="*.vue" services/

# Check for prototype pollution vectors
grep -rn "Object\.assign\|__proto__\|constructor\[" --include="*.js" --include="*.ts" services/ packages/

# Check for missing input validation on API endpoints
# Look for req.body/req.params/req.query used without validation
grep -rn "req\.body\.\|req\.params\.\|req\.query\." --include="*.js" --include="*.ts" services/ | head -30

# Check for eslint-plugin-security in configs
find services/ -name ".eslintrc*" -exec grep -l "security" {} \;

# Check for Helmet.js or security headers middleware
grep -rn "helmet\|x-frame-options\|x-content-type\|strict-transport" --include="*.js" --include="*.ts" services/

# Count unsafe blocks — each one needs manual review justification
grep -rn "unsafe " --include="*.rs" services/ packages/

# Check for unwrap() — should use proper error handling in production
grep -rn "\.unwrap()" --include="*.rs" services/ packages/ | wc -l

# Run cargo audit if Cargo.lock exists
if [ -f services/flow/Cargo.lock ]; then
  cd services/flow && cargo audit 2>/dev/null || echo "cargo-audit not installed or failed"
fi

# Check for proper error types (not just String errors)
grep -rn "Result<.*String>" --include="*.rs" services/ packages/

# Check rate limiting configuration
grep -rn "rate.limit\|rateLimit\|throttle" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" services/

# Check CORS configuration — should NOT be wildcard in production
grep -rn "cors\|Access-Control-Allow-Origin" --include="*.js" --include="*.ts" --include="*.go" --include="*.yaml" services/ infrastructure/

# Check for API key validation middleware
grep -rn "x-api-key\|authorization\|bearer" -i --include="*.js" --include="*.ts" --include="*.go" services/

# Check request size limits (prevent DoS via large payloads)
grep -rn "bodyLimit\|limit.*mb\|maxBodyLength\|max_body_size" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" services/

# Check schema usage — each service should ONLY write to its own schema
# cms → cms.*, ai-api → ai.*, formula-api → formula.*, flow → flow.*, gateway → gateway.*

# Look for cross-schema writes
grep -rn "INSERT INTO\|UPDATE\|DELETE FROM" --include="*.js" --include="*.ts" --include="*.rs" --include="*.go" services/ | grep -v node_modules | grep -v test

# Check direct imports between services (should use shared packages instead)
grep -rn "require.*\.\./\.\./services\|from.*\.\./\.\./services" --include="*.js" --include="*.ts" services/

# Check for shared state (global variables, shared Redis keys without namespace)
grep -rn "global\.\|process\.\(env\)\@!" --include="*.js" --include="*.ts" services/

# Verify Redis namespace compliance
grep -rn "redis\.\(get\|set\|del\|hget\|hset\)" --include="*.js" --include="*.ts" --include="*.rs" services/ | head -20
# Each should use prefixed keys: gw:, ai:, fa:, fl:, cms:, rl:

# Check shared package usage — are common queries properly extracted?
cat packages/*/package.json 2>/dev/null | grep -A 5 '"name"'

# Check for duplicated utility code across services
# Look for similar function names in different services
for func in "getAccount" "validateToken" "checkRateLimit" "hashPassword"; do
  echo "--- $func ---"
  grep -rn "$func" --include="*.js" --include="*.ts" --include="*.rs" --include="*.go" services/ packages/ 2>/dev/null
done

# Check node_modules sizes (bloated dependencies)
for dir in services/*/; do
  if [ -d "$dir/node_modules" ]; then
    echo "$dir: $(du -sh "$dir/node_modules" 2>/dev/null | cut -f1)"
  fi
done

# Check for API versioning
grep -rn "v1\|v2\|api-version" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" services/

# Check response format consistency
# All APIs should return consistent error shapes: { error: { code, message, details? } }
grep -rn "res\.status\|reply\.code\|reply\.status" --include="*.js" --include="*.ts" services/ | head -20

# Check for OpenAPI/Swagger definitions
find services/ -name "openapi*" -o -name "swagger*" -o -name "*.openapi.*" | grep -v node_modules

WebSearch: "[technology] production issues 2025 2026"
WebSearch: "[technology] vs alternatives performance comparison"

# Check for overly long files (>500 lines = review candidate, >1000 = split required)
find services/ packages/ -name "*.js" -o -name "*.ts" -o -name "*.rs" -o -name "*.go" | \
  grep -v node_modules | grep -v target | \
  xargs wc -l 2>/dev/null | sort -rn | head -20

# Check for deeply nested code (>4 levels of indentation)
grep -rn "^                    " --include="*.js" --include="*.ts" services/ | grep -v node_modules | head -20

# Check for TODO/FIXME/HACK/XXX comments (unresolved technical debt)
grep -rn "TODO\|FIXME\|HACK\|XXX\|WORKAROUND\|TEMP\|KLUDGE" --include="*.js" --include="*.ts" --include="*.rs" --include="*.go" services/ packages/ | grep -v node_modules

# Check for empty catch blocks (swallowed errors)
grep -rn "catch.*{" -A 1 --include="*.js" --include="*.ts" services/ | grep -B 1 "^.*}$" | grep -v node_modules | head -20

# Check for console.log in production code (should use structured logger)
grep -rn "console\.log\|console\.error\|console\.warn" --include="*.js" --include="*.ts" services/ | grep -v node_modules | grep -v test | wc -l

# Check for proper HTTP status code usage
grep -rn "\.status(200)" --include="*.js" --include="*.ts" services/ | grep -v node_modules | head -10
# POST endpoints returning 200 instead of 201? DELETE returning 200 instead of 204?

# Rust: check for proper Result/Option handling
grep -rn "\.unwrap()\|\.expect(" --include="*.rs" services/ | grep -v test | head -20

# Test-to-code ratio
CODE_LINES=$(find services/ packages/ -name "*.js" -o -name "*.ts" -o -name "*.rs" -o -name "*.go" | \
  grep -v node_modules | grep -v target | grep -v test | grep -v __tests__ | grep -v spec | \
  xargs wc -l 2>/dev/null | tail -1 | awk '{print $1}')
TEST_LINES=$(find services/ packages/ -name "*.test.*" -o -name "*.spec.*" -o -name "*_test.*" | \
  grep -v node_modules | grep -v target | \
  xargs wc -l 2>/dev/null | tail -1 | awk '{print $1}')
echo "Code lines: $CODE_LINES"
echo "Test lines: $TEST_LINES"
echo "Test-to-code ratio: $(echo "scale=2; $TEST_LINES / $CODE_LINES" | bc 2>/dev/null || echo 'N/A')"

# Check for test coverage configuration
find services/ -name "*.config.*" -exec grep -l "coverage\|istanbul\|c8\|nyc" {} \;
find services/ -name ".nycrc*" -o -name ".c8rc*"

# Check test quality — are there assertions or just smoke tests?
grep -rn "assert\|expect\|should\|test(" --include="*.test.*" --include="*.spec.*" services/ | wc -l

# Check for integration/e2e tests
find services/ -path "*/test/integration*" -o -path "*/test/e2e*" -o -path "*/__tests__/integration*" | grep -v node_modules

# Check for README files in each service
for svc in services/*/; do
  if [ -f "$svc/README.md" ]; then
    echo "OK: $svc/README.md exists ($(wc -l < "$svc/README.md") lines)"
  else
    echo "MISSING: $svc/README.md"
  fi
done

# Check for inline documentation (JSDoc, rustdoc, godoc)
grep -rn "/\*\*" --include="*.js" --include="*.ts" services/ | grep -v node_modules | wc -l
grep -rn "///" --include="*.rs" services/ | wc -l
grep -rn "// [A-Z]" --include="*.go" services/ | wc -l

# Check for API documentation
find services/ -name "*.openapi.*" -o -name "*.swagger.*" -o -name "api-docs*" | grep -v node_modules

# Verify architecture docs exist and are recent
for doc in docs/evolution-plan.md docs/database-strategy.md docs/migration-safety.md docs/architecture-diagram.html; do
  if [ -f "$doc" ]; then
    MOD=$(stat -c %Y "$doc" 2>/dev/null || stat -f %m "$doc" 2>/dev/null)
    echo "OK: $doc (modified: $(date -d @$MOD 2>/dev/null || date -r $MOD))"
  else
    echo "MISSING: $doc"
  fi
done

# Check for health check endpoints
grep -rn "health\|ready\|alive\|ping" --include="*.js" --include="*.ts" --include="*.rs" --include="*.go" services/ | grep -i "route\|get\|handler\|endpoint" | grep -v node_modules | grep -v test

# Check for graceful shutdown handling
grep -rn "SIGTERM\|SIGINT\|graceful\|shutdown" --include="*.js" --include="*.ts" --include="*.rs" --include="*.go" services/ | grep -v node_modules

# Check for structured logging
grep -rn "pino\|winston\|bunyan\|tracing\|slog\|log\." --include="*.js" --include="*.ts" --include="*.rs" --include="*.go" services/ | grep -v node_modules | head -20

# Check for metrics/observability (Prometheus, OpenTelemetry)
grep -rn "prometheus\|opentelemetry\|otel\|metrics\|histogram\|counter" --include="*.js" --include="*.ts" --include="*.rs" --include="*.go" services/ | grep -v node_modules

# Check database backup configuration
ls -la infrastructure/db-snapshots/ 2>/dev/null || echo "No snapshots directory"

# Check for migration rollback scripts
find migrations/ -name "*rollback*" -o -name "*down*" -o -name "*revert*"

# Verify disaster recovery documentation
find docs/ -name "*disaster*" -o -name "*recovery*" -o -name "*backup*" -o -name "*incident*"

# Check for connection pooling
grep -rn "pool\|Pool\|connectionLimit\|max_connections\|pool_size" --include="*.js" --include="*.ts" --include="*.rs" --include="*.go" --include="*.yaml" --include="*.yml" services/ infrastructure/ | grep -v node_modules

# Check for caching strategy
grep -rn "cache\|Cache\|TTL\|ttl\|expire" --include="*.js" --include="*.ts" --include="*.rs" --include="*.go" services/ | grep -v node_modules | head -20

# Check for N+1 query patterns (multiple DB calls in a loop)
grep -rn "for.*await\|\.forEach.*await\|\.map.*await" --include="*.js" --include="*.ts" services/ | grep -v node_modules | grep -v test

# Check for memory leak patterns
grep -rn "setInterval\|addEventListener\|on(" --include="*.js" --include="*.ts" services/ | grep -v node_modules | grep -v test | head -20

# Check for CI configuration
find . -name ".github" -o -name ".gitlab-ci*" -o -name "Jenkinsfile" -o -name ".circleci" -o -name "bitbucket-pipelines*" | head -5

# Check Coolify configuration
ls -la infrastructure/coolify/ 2>/dev/null || echo "No Coolify config"

# Check for environment-specific configs
find services/ infrastructure/ -name "*.live.*" -o -name "*.prod.*" -o -name "*.production.*" | grep -v node_modules

# Check for database migration runner
find scripts/ -name "migrate*" -exec head -5 {} \;

# Node.js services
for svc in services/cms services/ai-api services/formula-api; do
  if [ -f "$svc/package.json" ]; then
    echo "=== $svc ==="
    cd "$svc"
    npm audit --omit=dev 2>/dev/null || echo "npm audit failed"
    # Check for outdated packages
    npm outdated 2>/dev/null | head -10
    cd -
  fi
done

# Rust services
for svc in services/flow; do
  if [ -f "$svc/Cargo.toml" ]; then
    echo "=== $svc ==="
    cd "$svc"
    cargo audit 2>/dev/null || echo "cargo-audit not installed"
    cd -
  fi
done

# Go services
for svc in services/gateway; do
  if [ -f "$svc/go.mod" ]; then
    echo "=== $svc ==="
    cd "$svc"
    go list -m -u all 2>/dev/null | head -10
    cd -
  fi
done

# Check for GPL or other copyleft licenses in dependencies
# (Important if the project has commercial distribution plans)
for svc in services/*/; do
  if [ -f "$svc/package.json" ]; then
    echo "=== $svc ==="
    npx license-checker --production --failOn "GPL-2.0;GPL-3.0" 2>/dev/null | tail -5 || echo "license-checker not available"
  fi
done

# CTO Technical Review Report

**Date:** [DATE]
**Reviewer:** CTO Review Agent
**Scope:** [Full / Service-specific / Security-only]
**Branch:** [current branch]
**Commit:** [HEAD commit hash]

---

## Executive Summary

[2-3 sentences: Overall assessment. Is this project production-ready? What's the biggest risk?]

**Overall Risk Level:** CRITICAL / HIGH / MEDIUM / LOW

---

## Findings Summary

| Severity | Count | Top Categories |
|----------|-------|----------------|
| CRITICAL | X | [categories] |
| HIGH     | X | [categories] |
| MEDIUM   | X | [categories] |
| LOW      | X | [categories] |
| INFO     | X | [categories] |

---

## Critical & High Findings (Immediate Action Required)

### [FINDING-001] [Title]
- **Severity:** CRITICAL/HIGH
- **Category:** Security/Architecture/...
- **Location:** `path/to/file:line`
- **Description:** [What's wrong]
- **Evidence:** [Exact code/output showing the issue]
- **Impact:** [What happens if this isn't fixed]
- **Recommendation:** [Specific fix]
- **Effort:** [Small/Medium/Large]

### [FINDING-002] ...

---

## Medium & Low Findings

### [FINDING-NNN] [Title]
[Same format but grouped for easier prioritization]

---

## Architecture Assessment

### Service Boundary Compliance
| Service | Schema Ownership | Boundary Violations | Coupling Score |
|---------|-----------------|---------------------|----------------|
| bl-cms | cms.* | X violations | LOW/MED/HIGH |
| bl-ai-api | ai.* | X violations | LOW/MED/HIGH |
| bl-formula-api | formula.* | X violations | LOW/MED/HIGH |
| bl-flow | flow.* | X violations | LOW/MED/HIGH |
| bl-gateway | gateway.* | X violations | LOW/MED/HIGH |

### Technology Fitness
| Technology | Verdict | Notes |
|------------|---------|-------|
| Directus 11 | APPROPRIATE/REVIEW/REPLACE | [reasoning] |
| Fastify | APPROPRIATE/REVIEW/REPLACE | [reasoning] |
| Axum/Tokio | APPROPRIATE/REVIEW/REPLACE | [reasoning] |
| Go net/http | APPROPRIATE/REVIEW/REPLACE | [reasoning] |
| PostgreSQL | APPROPRIATE/REVIEW/REPLACE | [reasoning] |
| Redis | APPROPRIATE/REVIEW/REPLACE | [reasoning] |
| BullMQ | APPROPRIATE/REVIEW/REPLACE | [reasoning] |

---

## Security Posture

### OWASP Top 10 Compliance
| # | Risk Category | Status | Details |
|---|--------------|--------|---------|
| A01 | Broken Access Control | PASS/FAIL/PARTIAL | ... |
| A02 | Security Misconfiguration | PASS/FAIL/PARTIAL | ... |
| ... | ... | ... | ... |

### Secrets Management: PASS / NEEDS WORK / CRITICAL
### Docker Security: PASS / NEEDS WORK / CRITICAL
### Database Security: PASS / NEEDS WORK / CRITICAL

---

## Code Quality Metrics

| Metric | Value | Target | Status |
|--------|-------|--------|--------|
| Test-to-code ratio | X:1 | >0.5:1 | OK/LOW |
| Files >500 lines | X | 0 | OK/REVIEW |
| Unresolved TODOs | X | <10 | OK/HIGH |
| Empty catch blocks | X | 0 | OK/REVIEW |
| console.log in prod | X | 0 | OK/CLEANUP |
| unwrap() in Rust | X | <5 | OK/REVIEW |
| Test coverage | X% | >70% | OK/LOW |

---

## Operational Readiness

| Capability | Status | Notes |
|-----------|--------|-------|
| Health checks | YES/NO/PARTIAL | ... |
| Graceful shutdown | YES/NO/PARTIAL | ... |
| Structured logging | YES/NO/PARTIAL | ... |
| Metrics/Observability | YES/NO/PARTIAL | ... |
| Database backups | YES/NO/PARTIAL | ... |
| Migration rollbacks | YES/NO/PARTIAL | ... |
| Disaster recovery plan | YES/NO/PARTIAL | ... |
| CI/CD pipeline | YES/NO/PARTIAL | ... |

---

## Recommendations (Priority Order)

### Must Fix Before Production
1. [Most critical finding with specific action]
2. ...

### Should Fix Soon
1. [Important improvements]
2. ...

### Nice to Have
1. [Quality of life improvements]
2. ...

---

## Next Review

**Recommended in:** [X days/weeks]
**Focus areas:** [What to check next time]
**Triggered by:** [What events should trigger an immediate re-review]