Merge pull request #15 from ayim/ayim/overwatch-codebase-rules

Add scoped Overwatch codebase policies

Author: ayim

apps/storefront/src/app/[locale]/checkout/.overwatch/rules.yml

@@ -0,0 +1,11 @@
+version: overwatch-rules-v1
+rules:
+  - id: checkout-money-movement
+    description: Checkout changes can affect money movement and order integrity.
+    owner: payments
+    review: required
+    autoApprove: never
+    requiredTests:
+      - payment idempotency
+      - duplicate-submit protection
+      - failed payment recovery

apps/storefront/src/app/[locale]/product/.overwatch/rules.yml

@@ -0,0 +1,10 @@
+version: overwatch-rules-v1
+rules:
+  - id: catalog-product-experience
+    description: Product-page changes are eligible for risk-based approval with catalog coverage.
+    owner: catalog
+    review: risk_based
+    autoApprove: eligible
+    requiredTests:
+      - unavailable variant behavior
+      - price and currency rendering

apps/storefront/src/app/[locale]/sign-in/.overwatch/rules.yml

@@ -0,0 +1,11 @@
+version: overwatch-rules-v1
+rules:
+  - id: sign-in-critical-path
+    description: The sign-in route is a universal critical path and cannot be auto-approved.
+    owner: identity
+    review: required
+    autoApprove: never
+    requiredTests:
+      - successful and rejected sign-in flows
+      - redirect safety
+      - no credentials or PII in analytics

apps/storefront/src/components/analytics/.overwatch/rules.yml

@@ -0,0 +1,11 @@
+version: overwatch-rules-v1
+rules:
+  - id: analytics-data-contract
+    description: Analytics changes must preserve event contracts and avoid customer PII.
+    owner: data-platform
+    review: risk_based
+    autoApprove: eligible
+    requiredTests:
+      - event name and property contract
+      - synthetic traffic labeling
+      - no customer PII

apps/storefront/src/contexts/.overwatch/rules.yml

@@ -0,0 +1,11 @@
+version: overwatch-rules-v1
+rules:
+  - id: authentication-boundary
+    description: Authentication and session changes always require a human reviewer.
+    owner: identity
+    review: required
+    autoApprove: never
+    requiredTests:
+      - denial-by-default behavior
+      - invalid and expired session handling
+      - login failure without credential leakage

packages/dashboard/src/app/routes/_authenticated/_orders/.overwatch/rules.yml

@@ -0,0 +1,11 @@
+version: overwatch-rules-v1
+rules:
+  - id: operator-order-mutations
+    description: Admin order mutations require an operations reviewer.
+    owner: commerce-operations
+    review: required
+    autoApprove: never
+    requiredTests:
+      - state transition authorization
+      - cancellation and refund safeguards
+      - audit trail preservation