# Cursor Code-Audit Prompt — Tech Debt Roadmap input

> Paste this whole block into Cursor (Composer / Chat, with "All files" or the repo root indexed). It scopes the read surface, runs the 4-class checklist, and emits a structured report the `techdebt-roadmap` product consumes.

---

```text
You are running a tech-debt audit for a Java Spring Boot backend (monolith, ~400k LOC).
Goal: produce a structured audit the product "Tech Debt Roadmap" will turn into a quarterly governance plan.
Do NOT write fixes yet — only detect, quantify, and rate. Be deterministic; cite file:line for every number.

## 1. SCOPE — read ONLY these (do not guess outside this set)

Build & dependency manifests:
- pom.xml OR build.gradle (and build.gradle.kts)
- settings.gradle*, gradle.properties

Application entry & config:
- **/*Application.java (the @SpringBootApplication class)
- **/*Config*.java, **/*Configuration*.java
- src/main/resources/application*.yml, application*.properties, **/*-config*.yml
- @ConfigurationProperties and @Profile annotated classes

Persistence layer (FOCUS — the highest-debt area):
- **/*Repository.java, **/*Repo.java (Spring Data)
- **/*Mapper.java + **/*Mapper.xml (MyBatis)
- **/*Entity.java, **/*Model.java, **/*DO.java, **/*PO.java (JPA/Hibernate entities)
- any JdbcTemplate / NamedParameterJdbcTemplate / EntityManager usage
- **/migration/** (Flyway/Liquibase change sets)

Service & controller layer:
- **/*Service.java, **/*ServiceImpl.java, **/*Controller.java, **/*RestController.java
- @Transactional annotated methods (note nesting)
- @Autowired fields referencing a Repository/Dao that belongs to ANOTHER domain module

Cross-cutting:
- **/util/**, **/common/**, **/utils/** (god-module candidates)
- feature-flag usages: @ConditionalOnProperty, ToggleClient, FeatureFlag, ff_*, config keys gated but never cleared
- ArchUnit / jQAssistant test specs if present (**/*Test.java referencing com.tngtech.archunit)

## 2. CHECKLIST — 4 classes, detect + quantify + rate

### A. Code debt
- [ ] Duplication: run PMD CPD concept; report duplicated-line % and count of blocks >100 lines. Top-3 duplicate clusters with file:line.
- [ ] Cyclomatic complexity: methods with CC>15; max CC method (name + value + file:line); methods >200 lines.
- [ ] Dead code: unused public methods/classes (IntelliJ/IDEA inspection or `grep` + call-site proof); unused @ConfigurationProperties; feature flags shipped >X months ago but still present (list age).
- [ ] Dependency debt: Spring Boot & JDK version vs vendor EOL; count Critical/High CVEs (note: you cannot scan live CVE DB — flag "run OWASP DC/Snyk" and report pom versions only); deps >2 majors behind latest.

### B. Architecture debt
- [ ] Coupling (CBO): list the top-3 most-coupled modules and their fan-out counts.
- [ ] Module-boundary violations: Service A reads/writes another domain's table (cite file:line of the cross-domain query/entity access).
- [ ] Cross-module direct DB: count @Autowired of ANOTHER module's Repository; count JdbcTemplate bypasses outside the data layer; count SQL JOINs spanning >3 domain tables.
- [ ] Transaction hygiene: nested @Transactional on critical paths (count, file:line); RPC/HTTP calls made inside @Transactional (count).
- [ ] ADRs: does docs/adr/ exist? count; if 0 on a multi-year system, flag 🔴.

### C. Test debt
- [ ] Coverage: if a JaCoCo report (build/reports/jacoco/) or cobertura exists, read line/branch %. If none, state "no coverage report found — run JaCoCo".
- [ ] Key-business branch coverage: estimate from tagged/tested critical paths if measurable.
- [ ] E2E count: grep for @SpringBootTest(endToEndStyle) / Playwright / Cypress / Selenium specs; report count.
- [ ] Flaky rate: cannot compute without CI history — flag "need CI run history".
- [ ] Pyramid shape: ratio unit/integration/E2E from test directory counts.
- [ ] Contract tests: count Pact/Spring Cloud Contract specs for key interfaces.

### D. Documentation debt
- [ ] Architecture doc: last git commit date of docs/architecture* (flag if >2 yr).
- [ ] API doc: OpenAPI/Swagger coverage — count controllers documented vs total.
- [ ] Onboarding: does CONTRIBUTING/ONBOARDING exist? (qualitative).
- [ ] Ops runbook: count incident-type runbooks vs known incident classes.
- [ ] Schema comments: % of tables with COMMENT (from migration DDL if present).
- [ ] ADRs: (covered in B.)

## 3. SEVERITY BANDS (use exactly)
🟢 pass · 🟡 warning · 🔴 critical
Apply the thresholds in the product ROADMAP.md §2–§5 (e.g., duplication >10% = 🔴, line coverage <40% = 🔴, 0 ADR on 6-yr system = 🔴).

## 4. OUTPUT FORMAT (emit as Markdown + a copy-paste JSON block)
### Summary
- overall health score guess (0–100) with 1-line rationale
- 🔴 critical count / 🟡 warning count / 🟢 pass count

### Findings table (one row per detected item)
| # | Class | Item | Metric (value) | Severity | file:line evidence | Suggested first action |

### JSON (machine-readable, for the roadmap generator)
{
  "repo": "<name>",
  "loc_estimate": <int>,
  "health_guess": <int 0-100>,
  "findings": [
    {"class":"code|arch|test|doc","item":"...","metric":"...","value":<num>,"severity":"critical|warning|pass","evidence":"file:line","action":"..."}
  ]
}

## 5. PROHIBITED
- Do NOT invent CVE counts, coverage %, or commit dates you cannot evidence. Mark "needs scan/CI" instead.
- Do NOT write refactoring code in this pass.
- Do NOT omit file:line for any 🔴 finding.
```

---

### How to use
1. Open the target repo in Cursor; ensure the root is indexed.
2. Paste the block above into Composer (or Chat with "All files").
3. Copy the emitted **JSON** into the roadmap generator; it produces `ROADMAP.md` + `radar.html` with your real numbers.
4. For CVE/coverage/flaky data the prompt flags "needs scan", run OWASP Dependency-Check / JaCoCo / CI history, then re-paste.