- name: action-write-authorization
  where: "app/orders/actions.ts"
  ensure: >-
    cancelOrder must obtain a verified actor and constrain updateMany by that actor tenantId and ownerId before mutating the order.

- name: private-order-cache
  where: "app/api/orders/[id]/route.ts"
  ensure: >-
    The GET handler response for an authenticated order must set Cache-Control to private, no-store. It must never advertise public caching.

- name: same-origin-redirect
  where: "app/continue/route.ts"
  each: method
  ensure: >-
    safeReturnTo must return a URL on the supplied origin. An external URL supplied as returnTo must fall back to the root URL on that origin.