When I’m asked to “do a security review,” what people usually mean is: “Tell me where this thing can lose money, leak keys, or get bricked.”

For blockchain systems that’s not just smart contracts. It’s keys, APIs, nodes, infra, and the glue logic between them. This is the checklist I walk through as a developer / architect before I even think about calling an external auditor.

I’ll keep it practical and structured so you can literally go through section by section with your own project.

1. Scope and Threat Model

Before diving into details, I sketch this picture:

[ Users ] --web--> [ Frontend ] --API--> [ Backend / Indexers ]
                                 |
                                 v
                        [ Nodes / Validators ]
                                 |
                                 v
                         [ L1 / L2 Contracts ]
                                 |
                                 v
                         [ Custody / Wallets ]

For each box and arrow I ask:

  • What can be stolen, corrupted, or disrupted here
  • Who are the realistic attackers (external, insiders, partners)
  • What happens if this component is fully compromised

OWASP’s Blockchain AppSec Standard and ASVS both push you to start from assets and trust boundaries rather than from tooling.(OWASP Foundation)

If you skip this step, the rest of the checklist degenerates into “random hardening”.

2. Smart Contracts On‑Chain Logic

For EVM‑style or similar smart contracts, my mental checklist is mostly a compression of OWASP Smart Contract Top 10 / SCSVS plus battle‑scars from audits.(OWASP Foundation)

2.1 Core vulnerability classes

Short paragraphs, single focus each.

  • Reentrancy and external calls. Any external call (to another contract or call.value) can reenter you. Check that state changes happen before external calls (checks‑effects‑interactions), or use a reentrancy guard. Treat untrusted callbacks as full code execution.(ethereum-contract-security-techniques-and-tips.readthedocs.io)

  • Integer math and bounds. On modern Solidity versions you get built‑in checked arithmetic, but you can still have logic bugs from unchecked casting, rounding, or custom fixed‑point math. Check any place where a user‑supplied value influences multipliers, divisions, or token amounts.(cobalt.io)

  • Access control. Every privileged function should have a clearly defined role (owner, admin, guardian, pauser). Verify that only those roles can call it, and that the role management itself can’t be hijacked. Inheritance + modifiers + default visibility is where this goes wrong.(Vocal)

  • Insecure randomness. Anything game‑like or lottery‑like that uses block timestamps, blockhash, or predictable sources is suspect. If the outcome is worth money, assume miners / validators / MEV can bias it.(cobalt.io)

  • Front‑running / MEV. Any design where “first tx wins” or “user commits with plain data” is exposed. Check bids, liquidations, DEX orders, auctions. You often need commit‑reveal, off‑chain ordering, or batch auctions to make them robust.(cobalt.io)

  • DoS and griefing. Loops over user lists, unbounded storage growth, or zero‑value actions can turn into gas griefing and DoS vectors. Several recent write‑ups show how “harmless” zero‑amount transactions can freeze governance or lock funds.(Medium)

2.2 Upgradeability and governance

If contracts are upgradeable or governed:

  • Who can change implementation or parameters (and how fast)
  • Is there a time‑lock or veto mechanism
  • Can an attacker with governance majority drain funds or brick the system in one vote

Institutional security papers now explicitly call out governance‑level risk (malicious upgrades, parameter rug‑pulls) alongside code‑level bugs.(Immunefi)

2.3 Testing tooling

For every critical contract I want to see:

  • Unit tests for happy paths and obvious edge cases.
  • Property‑based tests for invariants (“total supply never decreases”, “pool is solvent”).
  • Static analysis (Slither, Mythril, etc.) and at least one run through a smart‑contract security checklist (OWASP SCSTG / SCSVS).(GitHub)

If the contract holds real value and you haven’t had at least one independent audit, you’re playing roulette.

3. Key Management Wallets

Here the question is simple: “What’s the blast radius if this private key leaks?”

I split keys into three tiers:

[ Root / cold ]     – seeds, master keys, staking pool cold keys
[ Hot signing ]     – validators, bridges, custody hot wallets
[ App secrets ]     – API keys, JWT, DB encryption, TLS

Smart papers and custody guidelines are all converging on the same patterns: HSMs, MPC, and multi‑sig to avoid single points of failure.(shudo.net)

3.1 Hard questions I ask

Short, brutal questions.

  • Are any production signing keys on plain disk of internet‑facing boxes
  • If I compromise one app server, can I sign arbitrary withdrawals or validator blocks
  • Who can export seeds from HSM / wallet, and is that logged and gated
  • How are keys rotated, and when was the last tested rotation
  • If one signer disappears (hardware lost / employee leaves), do you have a safe recovery path

If you don’t have crisp answers, your key management is not done.

3.2 Design signals that make me comfortable

  • Root seeds in cold storage (air‑gapped hardware or HSM) with documented ceremonies.
  • Hot keys either in HSMs or MPC wallets, never in app memory long‑term.(scalablesolutions.io)
  • M‑of‑N policies for anything that moves significant value (multi‑sig or threshold).
  • Per‑key policies: spend limits, whitelists, time‑locks, emergency block/kill switches.(securosys.com)
  • Clear separation between “operations can request” and “governance / security approves”.

4. API Backend Security

Most real‑world incidents I’ve seen didn’t start on‑chain. They started with “it was just an internal API”.

I treat blockchain backends as normal high‑risk web apps plus some chain‑specific twists. OWASP ASVS maps nicely here.(OWASP Foundation)

4.1 Authentication and authz

  • Are your admin / operator APIs fully separate from public APIs
  • Is every “moves value” API both authenticated and authorized by role
  • Are you using proper modern auth (OIDC/OAuth2, short‑lived tokens, MFA for human access)

Admin panels and “withdrawal APIs” deserve bank‑grade auth, not a random API key in an .env.

4.2 Input handling and business logic

  • Do you trust any field that ultimately shapes an on‑chain transaction (destination addresses, amounts, asset IDs)
  • Do you enforce server‑side limits on withdrawals, leverage, swaps, etc.
  • Are address books / whitelists enforced server‑side, not just in the UI

Traditional web vulns still apply: injection, IDOR, broken object‑level auth. Mapping OWASP Top 10 concepts to blockchain APIs is literally a research topic now.(ScienceDirect)

4.3 Rate limiting and abuse

  • Can an attacker spam withdrawal attempts, airdrop claims, or fee‑estimation endpoints to the point of DoS or unexpected gas bills
  • Are “expensive” operations (signing, broadcasting, price quotes) rate‑limited per user and globally

5. Node, Network, and Infrastructure

Auditing infra is where you stop thinking like a Solidity dev and start thinking like an SRE with hostile neighbours. OpenZeppelin’s infra‑auditing write‑ups and independent hardening guides are good reference points.(openzeppelin.com)

5.1 Node security

  • Are your full nodes / validators on dedicated hosts or mixed with app workloads
  • Are RPC interfaces exposed to the internet, or only via authenticated gateways
  • Are you pinning node versions and patching regularly

Node hardening guides consistently recommend:

  • RBAC for node admins, MFA for remote access.
  • Firewalling all but necessary ports.
  • Secure key management for any node keys.(Sherlocked Security)

5.2 Network layout

I like ASCII maps here:

[ Internet ]
     |
 [ Reverse proxy / WAF ]
     |
 [ API layer ]  --private-->  [ wallet / signing svc ]
                                 |
                           [ HSM / MPC cluster ]
                                 |
                           [ nodes / validators ]

Things I look for:

  • Signing services and nodes isolated in private subnets.
  • Only load‑balancers / API gateways directly internet‑facing.
  • VPN or peering for back‑office tools, not random SSH from everywhere.

5.3 Monitoring and logging

  • Do you have alerts for sudden surges in failed signatures, RPC errors, or anomalous withdrawals
  • Are node logs, signing logs, and app logs shipped to a central, tamper‑resistant system
  • Can you go back and reconstruct “who approved what, when” for any on‑chain action

Modern custody whitepapers treat logging and monitoring as core security controls, not nice‑to‑have observability.(Fireblocks)

6. Frontend, Wallet Integration, and UX Attacks

Even if everything behind the scenes is perfect, a compromised frontend can just ask the user’s wallet to sign something malicious.

Checklist items:

  • Are you using eth_signTypedData / EIP‑712 or equivalent structured data, so users see what they sign
  • Do you have a known mapping between frontend actions (“swap X to Y”) and the on‑chain calldata / transaction hash users should see in their wallet
  • Is your dApp served over HTTPS with proper CSP, subresource integrity, and build integrity checks

OWASP’s blockchain guidance highlights that phishing, UI redress, and malicious frontends are still core attack vectors in Web3.(OWASP Foundation)

For Cardano / Cosmos wallet connectors (CIP‑30, Keplr, etc.), the same logic applies: verify which methods you expose, restrict origins, and treat wallet APIs like signing HSMs in the browser.

7. Dependency and Supply‑Chain Risk

This is where modern exploits love to hide.

Questions I want answered:

  • Which critical contracts are based on standard, well‑audited libraries (OpenZeppelin, etc.), and which are bespoke?(ethereum-contract-security-techniques-and-tips.readthedocs.io)
  • Do you pin versions of contract libraries, node software, and infra dependencies
  • Do you vet NPM / Docker images for your build and deploy pipeline, or just “latest”
  • Could a compromised CI/CD pipeline push a malicious contract or backend

There’s increasing research on mapping web‑style supply‑chain issues (malicious packages, build tampering) into blockchain ecosystems. The conclusion is predictable: most patterns carry over.(ScienceDirect)

8. Testing, Audits, and Processes

I treat “security” as a property of the process, not a one‑off event.

8.1 Pre‑deployment checklist

For any major deployment:

- Threat model documented.
- Code freeze before audit.
- At least one external review for contracts that can lose money.
- Coverage reports and fuzzing runs for critical logic.
- Runbooks for pausing / emergency shutdown (if supported).

Security testing guides from OWASP SCSTG and smart‑contract best‑practice docs all emphasise standardised, repeatable test procedures rather than ad‑hoc “we ran one tool”.(GitHub)

8.2 Post‑deployment

  • Is there a public security contact or bug bounty program
  • Do you have a playbook for “critical bug discovered” (who decides, who pauses, who communicates)
  • How quickly can you rotate keys, pause contracts, or move funds if needed

9. Condensed “Whiteboard” Checklist

If you want a one‑screen summary to keep next to you while you review a system:

[1] Smart contracts
    - Known vuln classes checked (reentrancy, math, access control, frontrunning, randomness, DoS)
    - Upgradeability and governance understood and bounded
    - Tests + tools + at least one sane external pair of eyes

[2] Keys and wallets
    - No hot keys in app servers
    - Cold / hot / app secrets separated
    - HSM/MPC/multisig for high-value keys
    - Rotation, recovery, and emergency block plans

[3] APIs and backends
    - Strong authz around anything that moves value
    - Limits, whitelists, and sanity checks on transactions
    - Rate limiting and abuse protection in place

[4] Nodes and infra
    - RPC and admin interfaces locked down
    - Network segmentation around signing + nodes
    - Monitoring + logging with meaningful alerts

[5] Frontend and UX
    - Structured signing (EIP-712-like) and clear UX
    - CI/CD hardened; no one-person “deploy to prod”
    - Phishing / malicious frontend scenarios considered

[6] Process
    - Threat model exists and matches reality
    - Security testing integrated into SDLC
    - Incident response playbooks rehearsed, not theoretical

If the honest answer to any of these bullets is “we don’t know”, that’s where your next sprint should start.

10. Closing Thoughts

Blockchain security auditing isn’t “run Slither and a linter”. It’s:

- Understanding where value and trust actually sit in your design.
- Making keys, contracts, APIs, and infra all fail as safely as they can.
- Having boring, repeatable processes around change and incident response.

The good news is you don’t have to invent this from scratch. OWASP’s blockchain and smart contract standards, modern custody and MPC guidance, and infra‑audit playbooks from serious shops are converging on the same patterns I’ve sketched here.(OWASP Foundation)

Your job as a developer is to make sure your project actually follows them—and that you can answer, without hand‑waving, the simplest audit question of all:

“If this component gets popped, how do we notice, how bad is it, and what do we do next?”

Completion scope and production contract

This completion review turns the earlier conceptual treatment into a release-oriented engineering contract. It treats Blockchain Security Auditing: A Developer’s Checklist as a cryptographic or distributed-security component, follows a key, message, transcript, proof, signature, hash input, or authenticated protocol event through validation and durable state, and separates normative requirements from implementation policy. The normative baseline is the named standard, security definition, test vectors, and maintained library contract; deployment defaults, caching, retry limits, and operator thresholds are explicitly local policy. 17

The intended audience is experienced developers and architects. Readers should understand the surrounding chain or application model, typed data structures, persistence, and basic security engineering. The scope includes correctness, implementation boundaries, deterministic tests, failure recovery, security, performance, and observability. It does not claim that the educational companion is a drop-in replacement for a maintained protocol or cryptographic library. Production adoption requires an independent threat model, compatibility testing against the authoritative implementation, and operational ownership. 18

The mental model used throughout is deliberately strict: untrusted input crosses entropy, parsing, key custody, verification, protocol, and storage boundaries; a validator derives facts under the named standard, security definition, test vectors, and maintained library contract; accepted transitions update domain-separated cryptographic state and explicitly authenticated protocol state; and observers consume committed facts, never optimistic intermediate mutations. A guarantee is stated only when it follows from those rules and assumptions. Heuristics such as fee selection, caching, peer scoring, timeouts, user messaging, or alert thresholds remain policy and may be tuned without redefining validity. 19

Reader contract and scope

For Blockchain Security Auditing: A Developer’s Checklist, this review makes the exact user decision and the prerequisites needed to make it safely explicit. Start from one key, message, transcript, proof, signature, hash input, or authenticated protocol event and write down its origin, canonical representation, validation context, authority, and durable outcome. The cryptographic or distributed-security component must not infer a stronger fact from transport success, cache presence, or an upstream acknowledgement. Its authoritative state is domain-separated cryptographic state and explicitly authenticated protocol state, and every projection must remain rebuildable or reconcilable from committed facts. This framing distinguishes a protocol guarantee from an operational convenience and gives reviewers a concrete place to challenge an assumption. 17

The principal failure to design against is an attractive example being mistaken for a complete production design. Address it before optimizing by defining a narrow ownership boundary, stable identities, bounded resource use, and a machine-readable outcome for every rejected transition. Record a scope statement, excluded concerns, and a reviewable acceptance criterion. A reviewer should be able to trace each accepted result to input bytes, rule or policy version, prior state, and commit identity without relying on prose logs. When the authority cannot be reached or context is incomplete, return an explicit unavailable or pending state; do not convert uncertainty into acceptance.

Precise vocabulary and authority

Treat precise vocabulary and authority as part of the executable design of Blockchain Security Auditing: A Developer’s Checklist, not as documentation added after coding. The relevant operating envelope includes valid vectors, malformed encodings, chosen inputs, key rotation, retries, and hostile traffic. For each mode, identify which state is authoritative, which work may be retried, what is bounded, and which observation proves progress. This is especially important across entropy, parsing, key custody, verification, protocol, and storage boundaries, where delivery and processing are different events and where local time or arrival order may not reflect authoritative order. 18

A useful review asks how the design behaves under malleability, nonce reuse, biased randomness, side channels, parser differentials, key compromise, and denial of service. The unsafe outcome is teams using the same word for incompatible states or guarantees. Prevent it with explicit preconditions and postconditions, and retain a glossary tied to the normative authority for every overloaded term as release evidence. Use stable codes rather than exception text, keep policy configuration versioned, and attach the accepted policy or rule version to durable results. An security engineer or protocol operator must be able to stop intake, drain or quarantine work, compare local state with authority, and resume without inventing a second side effect.

Trust assumptions

The implementation of Blockchain Security Auditing: A Developer’s Checklist should expose which actors, clocks, stores, libraries, and upstream systems may fail or act maliciously through types and module boundaries. Parse external representations once, preserve the original identity when audit or replay needs it, and pass validated domain values inward. Mutations of domain-separated cryptographic state and explicitly authenticated protocol state belong behind one authoritative transition function or transaction boundary. Network clients, storage adapters, user interfaces, and telemetry exporters must not duplicate consensus or business rules. That separation keeps deterministic logic testable and prevents a library upgrade from silently redefining validity. 19

Assume that an implicit trusted component invalidating the claimed guarantee will eventually occur in a staging fault test or production incident. The control is not a catch-all retry: classify the outcome, decide whether the identical operation is safe to repeat, bound attempts and elapsed time, and surface terminal work for reconciliation. The minimum evidence is a trust-boundary diagram and an assumption register with owners. Keep secret scalars, seeds, nonces, key-encryption keys, authentication tags, and timing behavior out of ordinary logs, and prefer hashes, version identifiers, counts, and sanitized reason codes. Any emergency bypass must be narrow, time-limited, approved, and observable.

Architecture and ownership

Verification for Blockchain Security Auditing: A Developer’s Checklist must demonstrate component responsibilities and the direction in which facts and commands move at several layers. Small tests cover deterministic transforms and boundary values; contract tests pin serialized forms; integration tests exercise real adapters; replay tests compare state roots or projections; and fault tests interrupt work at every commit boundary. The dataset must include normal history, malformed input, duplicates, reordering, maximum-size values, and changes of rule or schema version. A passing example is evidence about that environment and dataset, not a universal performance claim. 17

Make two components both believing they own the same transition a named negative test. The release packet should retain a context diagram, ownership table, and dependency rule, exact dependency and tool versions, the deterministic command, and its result. For performance work, report warm-up, repetitions, concurrency, percentiles, resource limits, and the point where backpressure begins. For security work, include abuse cases and independent review. A change is ready only when failures leave domain-separated cryptographic state and explicitly authenticated protocol state safe, recovery is rehearsed, and telemetry explains both user-visible outcome and operator action.

Canonical representation

For Blockchain Security Auditing: A Developer’s Checklist, this review makes the byte-level or schema-level representation used for hashing, comparison, storage, and transport explicit. Start from one key, message, transcript, proof, signature, hash input, or authenticated protocol event and write down its origin, canonical representation, validation context, authority, and durable outcome. The cryptographic or distributed-security component must not infer a stronger fact from transport success, cache presence, or an upstream acknowledgement. Its authoritative state is domain-separated cryptographic state and explicitly authenticated protocol state, and every projection must remain rebuildable or reconcilable from committed facts. This framing distinguishes a protocol guarantee from an operational convenience and gives reviewers a concrete place to challenge an assumption. 18

The principal failure to design against is semantically equal values producing different identifiers or verification outcomes. Address it before optimizing by defining a narrow ownership boundary, stable identities, bounded resource use, and a machine-readable outcome for every rejected transition. Record golden encodings, round-trip tests, and rejection of non-canonical forms. A reviewer should be able to trace each accepted result to input bytes, rule or policy version, prior state, and commit identity without relying on prose logs. When the authority cannot be reached or context is incomplete, return an explicit unavailable or pending state; do not convert uncertainty into acceptance.

State-machine model

Treat state-machine model as part of the executable design of Blockchain Security Auditing: A Developer’s Checklist, not as documentation added after coding. The relevant operating envelope includes valid vectors, malformed encodings, chosen inputs, key rotation, retries, and hostile traffic. For each mode, identify which state is authoritative, which work may be retried, what is bounded, and which observation proves progress. This is especially important across entropy, parsing, key custody, verification, protocol, and storage boundaries, where delivery and processing are different events and where local time or arrival order may not reflect authoritative order. 19

A useful review asks how the design behaves under malleability, nonce reuse, biased randomness, side channels, parser differentials, key compromise, and denial of service. The unsafe outcome is an impossible intermediate state becoming durable after interruption. Prevent it with explicit preconditions and postconditions, and retain a transition table exercised by positive, negative, and replay tests as release evidence. Use stable codes rather than exception text, keep policy configuration versioned, and attach the accepted policy or rule version to durable results. An security engineer or protocol operator must be able to stop intake, drain or quarantine work, compare local state with authority, and resume without inventing a second side effect.

Invariants

The implementation of Blockchain Security Auditing: A Developer’s Checklist should expose properties that must hold before and after every accepted operation through types and module boundaries. Parse external representations once, preserve the original identity when audit or replay needs it, and pass validated domain values inward. Mutations of domain-separated cryptographic state and explicitly authenticated protocol state belong behind one authoritative transition function or transaction boundary. Network clients, storage adapters, user interfaces, and telemetry exporters must not duplicate consensus or business rules. That separation keeps deterministic logic testable and prevents a library upgrade from silently redefining validity. 17

Assume that local success concealing corruption in a related aggregate or index will eventually occur in a staging fault test or production incident. The control is not a catch-all retry: classify the outcome, decide whether the identical operation is safe to repeat, bound attempts and elapsed time, and surface terminal work for reconciliation. The minimum evidence is executable assertions at the narrowest authoritative boundary. Keep secret scalars, seeds, nonces, key-encryption keys, authentication tags, and timing behavior out of ordinary logs, and prefer hashes, version identifiers, counts, and sanitized reason codes. Any emergency bypass must be narrow, time-limited, approved, and observable.

Validation pipeline

Verification for Blockchain Security Auditing: A Developer’s Checklist must demonstrate cheap structural checks, contextual checks, authoritative verification, and commit order at several layers. Small tests cover deterministic transforms and boundary values; contract tests pin serialized forms; integration tests exercise real adapters; replay tests compare state roots or projections; and fault tests interrupt work at every commit boundary. The dataset must include normal history, malformed input, duplicates, reordering, maximum-size values, and changes of rule or schema version. A passing example is evidence about that environment and dataset, not a universal performance claim. 18

Make expensive or stateful work running before malformed input is rejected a named negative test. The release packet should retain ordered validation stages with stable machine-readable rejection codes, exact dependency and tool versions, the deterministic command, and its result. For performance work, report warm-up, repetitions, concurrency, percentiles, resource limits, and the point where backpressure begins. For security work, include abuse cases and independent review. A change is ready only when failures leave domain-separated cryptographic state and explicitly authenticated protocol state safe, recovery is rehearsed, and telemetry explains both user-visible outcome and operator action.

Error semantics

For Blockchain Security Auditing: A Developer’s Checklist, this review makes the distinction between invalid input, conflict, unavailable dependency, retryable interruption, and internal defect explicit. Start from one key, message, transcript, proof, signature, hash input, or authenticated protocol event and write down its origin, canonical representation, validation context, authority, and durable outcome. The cryptographic or distributed-security component must not infer a stronger fact from transport success, cache presence, or an upstream acknowledgement. Its authoritative state is domain-separated cryptographic state and explicitly authenticated protocol state, and every projection must remain rebuildable or reconcilable from committed facts. This framing distinguishes a protocol guarantee from an operational convenience and gives reviewers a concrete place to challenge an assumption. 19

The principal failure to design against is blind retries amplifying a permanent failure or changing user intent. Address it before optimizing by defining a narrow ownership boundary, stable identities, bounded resource use, and a machine-readable outcome for every rejected transition. Record typed errors mapped consistently across logs, metrics, APIs, and queues. A reviewer should be able to trace each accepted result to input bytes, rule or policy version, prior state, and commit identity without relying on prose logs. When the authority cannot be reached or context is incomplete, return an explicit unavailable or pending state; do not convert uncertainty into acceptance.

Concurrency control

Treat concurrency control as part of the executable design of Blockchain Security Auditing: A Developer’s Checklist, not as documentation added after coding. The relevant operating envelope includes valid vectors, malformed encodings, chosen inputs, key rotation, retries, and hostile traffic. For each mode, identify which state is authoritative, which work may be retried, what is bounded, and which observation proves progress. This is especially important across entropy, parsing, key custody, verification, protocol, and storage boundaries, where delivery and processing are different events and where local time or arrival order may not reflect authoritative order. 17

A useful review asks how the design behaves under malleability, nonce reuse, biased randomness, side channels, parser differentials, key compromise, and denial of service. The unsafe outcome is a check-then-act race accepting two individually plausible operations. Prevent it with explicit preconditions and postconditions, and retain a linearization argument plus stress tests at the chosen contention boundary as release evidence. Use stable codes rather than exception text, keep policy configuration versioned, and attach the accepted policy or rule version to durable results. An security engineer or protocol operator must be able to stop intake, drain or quarantine work, compare local state with authority, and resume without inventing a second side effect.

Idempotency and replay

The implementation of Blockchain Security Auditing: A Developer’s Checklist should expose how duplicate delivery, process restart, and historical backfill preserve the same result through types and module boundaries. Parse external representations once, preserve the original identity when audit or replay needs it, and pass validated domain values inward. Mutations of domain-separated cryptographic state and explicitly authenticated protocol state belong behind one authoritative transition function or transaction boundary. Network clients, storage adapters, user interfaces, and telemetry exporters must not duplicate consensus or business rules. That separation keeps deterministic logic testable and prevents a library upgrade from silently redefining validity. 18

Assume that at-least-once delivery creating a second side effect will eventually occur in a staging fault test or production incident. The control is not a catch-all retry: classify the outcome, decide whether the identical operation is safe to repeat, bound attempts and elapsed time, and surface terminal work for reconciliation. The minimum evidence is stable operation identities, deduplication state, and deterministic replay fixtures. Keep secret scalars, seeds, nonces, key-encryption keys, authentication tags, and timing behavior out of ordinary logs, and prefer hashes, version identifiers, counts, and sanitized reason codes. Any emergency bypass must be narrow, time-limited, approved, and observable.

References