ทำให้ AI เขียนโค้ดอย่างมีวินัย ไม่เดา ไม่หลุดขอบเขต

อ่าน .csproj → ดึง TargetFramework + PackageReference | อ่าน angular.json + package.json → Angular version + project names | ตรวจ app.config.ts vs app.module.ts เพื่อแยก standalone/NgModule | สร้าง .kiyo/ ตาม stack ที่ detect ได้

[kiyo-dev] Detected stack:
  .NET target:     net8.0       ← MyApi.csproj
  EF Core version: 8.0.4        ← PackageReference
  Angular version: 17.3.2       ← package.json
  Solution name:   MySolution   ← .sln
  Angular mode:    standalone   ← app.config.ts found

FILES CREATED:
  .kiyo/INDEX.md      ← stack snapshot
  .kiyo/PATTERNS.md   ← team coding patterns
  .kiyo/MEMORY.md     ← bug + root cause history
  .kiyo/MISSION.md    ← active work context

เลือก checklist ตาม extension → dispatch audit-specialist → verifier pass บังคับก่อน output

// /kiyo-review OrderController.cs

[high] OrderController.cs:42 — .Result() call blocks thread
  Evidence: "var result = _mediator.Send(query).Result;"
  Checklist: Async — no .Result or .Wait() calls
  Fix: await _mediator.Send(query, cancellationToken)

[medium] OrderController.cs:15 — Missing CancellationToken
  Inferred from: async action without cancellationToken param
  Fix: Add CancellationToken cancellationToken to signature

[unsure] Program.cs — CORS AllowAnyOrigin scope unclear
  Question: Is AllowAnyOrigin intentional for production?
  Options: A) Restrict origins  B) Add env check  C) Investigate

git log --grep → git log -S → ROOT CAUSE declaration → minimal patch (ข้ามไม่ได้)

ROOT CAUSE ANALYSIS
  Symptom:    NullReferenceException ใน OrderService.CreateOrder()
  Root cause: commit a3f9c21 เปลี่ยน Customer.Address เป็น nullable
              แต่ไม่ได้ null-check ก่อนใช้
  Confidence: [high]
  Evidence:   git show a3f9c21 — "-public string Address"
                                  "+public string? Address"
  Prior fix:  no

// BEFORE:
var city = customer.Address.City;  // crash ถ้า Address เป็น null

// AFTER (minimal patch):
var city = customer.Address?.City ?? string.Empty;

3 specialists พร้อมกัน → OWASP mapping ทุก finding → verifier pass บังคับ

// /kiyo-security ProductsController.cs

[high] A01 Broken Access Control — ProductsController.cs:55
  Evidence: confirmed — Delete action has no [Authorize] attribute
  Fix: Add [Authorize(Roles = "Admin")]

[high] A03 Injection — appsettings.json:12
  Evidence: found in — ConnectionString uses string interpolation
  "Server={host};Database={db}"
  Fix: Use SqlConnectionStringBuilder

[medium] A02 Cryptographic Failures — AuthService.cs:30
  Inferred: MD5 usage detected for password hashing
  Fix: Replace with ASP.NET Core Identity PasswordHasher<T>

Design-first contract table → auth ทุก route → sealed record DTO → OpenAPI annotations

// DTO จาก /kiyo-api design Products
public sealed record CreateProductRequest(
    [Required][StringLength(200, MinimumLength = 1)]
    string Name,
    [Required][Range(0.01, double.MaxValue)]
    decimal Price,
    [Required][Range(0, int.MaxValue)]
    int Stock
);

// Controller action ที่ครบ
[HttpPost]
[Authorize(Roles = "Admin")]
[ProducesResponseType(typeof(ProductResponse), 201)]
[ProducesResponseType(typeof(ValidationProblemDetails), 422)]
public async Task<IActionResult> Create(
    CreateProductRequest request,
    CancellationToken cancellationToken) { ... }

อ่านครบก่อน → REST naming → 4 areas: Auth / DTOs / Async safety / OpenAPI

// /kiyo-api review UsersController.cs

[high] UsersController.cs:67 — Deadlock risk
  Evidence: "_userService.GetAllAsync().Wait();"
  Fix: await _userService.GetAllAsync(cancellationToken)

[medium] UsersController.cs:20 — Route uses verb
  Found: [Route("api/users/create")]
  Fix: POST /api/users  (verb belongs in HTTP method, not path)

[medium] UsersController.cs:33 — Missing CancellationToken
  Actions affected: GetById(), Create(), Delete()