<!-- This file captures service-specific code review knowledge that only your team knows.
     Write concrete, actionable rules under each heading — the AI reviewer will use these
     as mandatory context for every PR in this repo.
     Keep this file under 200 lines — be specific, not exhaustive. -->

## How to Review in This Service

<!-- List the data rules that must ALWAYS hold in this service — things that would break
     the business or corrupt data if violated.
     For each invariant, state the entity, the constraint, and what to flag in a diff. -->
**Domain invariants**
- Whitelist gates in `constructParam.groovy:getWhitelistedRepos` clone `Meesho/whitelists` fresh on every call (no caching). This is deliberate — each clone captures latest state so a DevOps whitelist change takes effect on the next build without a library release. Reject any caching/memoization that doesn't replace the freshness story.
- The literal `"ringmaster-bot"` userId in `deployRingmaster.groovy:run` is the only signal that distinguishes Ringmaster callbacks from Turbo-Turtle callbacks. Reject any rename of the string without explicit Ringmaster-team coordination.
- `buildObjHelper.groovy:run` falls through to `defaultBuild` silently when no `toolchain` case matches — a mis-spelled toolchain (`golang` vs `go`) produces a no-op build that "succeeds" with no artifact. Flag any new builder added without a match arm, and any toolchain string the dispatcher doesn't recognise.
- JVM `-Xmx`/`-Xms` are auto-calculated in `deployArgoCD.groovy:update_helm_repo` from `memory_request` (`xmx = memory_request * 0.75`, `xms = xmx * 0.5`). Reject hardcoded `-Xmx` in `JAVA_OPTS` unless `jvm_memory_override: true` is also set in the service's `deployment.yaml`.
- Services with `priority_v2: sp0` or `up0` MUST have canary configured — `deployArgoCD.groovy:run` blocks non-canary `prd` deploys for these priorities and there is no bypass. Reject any diff that adds one.
- `environment_map` / `branch_param_map` in `constructParam.groovy` and `deployArgoCD.groovy` may only contain permanent branches (`master`, `main`, `develop`, `gcp-main`). Flag any `feature/...` entry — these propagate to every consumer (P1_FEATURE_BRANCH_IN_ENVIRONMENT_MAP, PR #707).
- `constructTemplate.groovy:_construct()` is `@NonCPS` because it uses Java regex and string interpolation that aren't CPS-serialisable. Reject removal of the annotation or moves of its logic into a CPS context (inlining into `stage` bodies or `parallel` closures).
- The four-step ArgoCD deploy order in `deployArgoCD.groovy` (`update_argo_repo → refresh_app_of_apps → update_helm_repo → refresh_and_sync`) is load-bearing — first-deploy services rely on `refresh_app_of_apps` creating the `Application` object. Steps 2 and 4 are not interchangeable.

<!-- List the high-value request paths a reviewer should trace end-to-end.
     For each workflow, state the entry point (route/controller), the handler chain, and
     why it matters (latency-sensitive, money path, etc.). -->
**Critical workflows**
- `vars/buildPipeline.groovy:call` is the primary entry point invoked by every consuming `Jenkinsfile`. The chain is `constructParam.run → checkOut.run → buildObjHelper.run(build_tool) → notify.run`, wrapped in `try/catch/finally`. The `finally` block is the only thing that guarantees Slack notification on failure — trace any change to ordering, exception handling, or the surrounding `try/catch/finally`.
- `vars/gkeCICD.groovy`, `vars/eksCICD.groovy`, `vars/cloudFunctionCICD.groovy`, `vars/gcpMigration.groovy`, `vars/onlyPushtoJfrog.groovy` are sibling entry points — verify any change to a shared helper (`constructParam`, `notify`, `deployArgoCD`, `buildObjHelper`) is consistent across all of them.
- `deployArgoCD.groovy:run` is the prd-deploy critical path: priority check → 4-step deploy. A break here breaks every service's prd rollout — trace canary enforcement and the deploy-step ordering.
- `deployRingmaster.groovy:run` is the prd callback path: every prd deploy depends on the curl-to-Turbo-Turtle / Ringmaster handoff. Payload is written to a temp file and sent via `curl -d @<file>` to avoid bash escaping — never inline new fields into the curl command.
- `constructParam.groovy:getWhitelistedRepos` is consulted for five gates (`skip-sonar`, `app-config-disabled`, `multizone-enabled`, `allowedNonDevelopPrDeployment`, `ValidateCacConfig`). Any change to gate semantics must be traced end-to-end through all five callers.

<!-- List bugs, outage patterns, or recurring mistakes this service has hit before.
     For each pattern, describe the failure, root cause, and what to watch for in diffs. -->
**Known failure patterns**
- Debug tunnel hostnames (`*.lhr.life`, `*.ngrok.io`, `*.tunnel.*`) merged into `deployRingmaster.groovy` after local testing (PRs #596, #664) — flag any tunnel literal in any `.groovy` or YAML (P0_DEBUG_URL_IN_PRODUCTION_CONFIG).
- SSH private-key contents printed to Jenkins console via `cat ./id_github_jenkins` in `addSSHKey.groovy` (PR #634). Jenkins console is readable by anyone with job-read access — flag any `cat`/`echo`/`print`/`ls -al` of credential paths (P0_SENSITIVE_DEBUG_PRINT_IN_PIPELINE).
- Bare IPs (`172.x.x.x`, `10.x.x.x`) shipped as build-callback endpoints in `notify.groovy` (PR #681). IPs break silently when infra is rebalanced — flag any IP literal, replace with DNS (P0_HARDCODED_IP_IN_PIPELINE).
- Dockerfiles mutated at build time via `sh "echo '...' >> Dockerfile-${artifactId}"` (PR #707). Runtime mutation makes the actual image instructions invisible in code review — use `ARG`/multi-stage or a dedicated template (P1_DYNAMIC_DOCKERFILE_MUTATION_VIA_SHELL).
- Test failures swallowed via `if (testExitCode != 0) { echo 'pipeline continues' }` patterns (PR #643). Broken code packaged and deployed while CI appears to pass — flag any test-exit-code suppression (P1_TEST_FAILURE_MUST_FAIL_PIPELINE).
- Shipped typos and copy-paste bugs that Groovy/Jenkins doesn't catch at compile time: `chekoutSubmodule` in `checkOut.groovy:22`, `catch (Exceptione)` in `helmGenerator.groovy:102`, duplicate `buildRegistry` map key in `buildPython.groovy:76-79`, hard-coded `branch_name = 'repo'` in `buildGradle.groovy:252`. Reviewer is the only gate — read identifier names and map keys carefully.
- New language support created by copy-pasting an existing language's template without auditing every field (PR #650 left `GOMAXPROCS` in `rust-values.yaml`; PR #707 duplicated `validate_configs_v2.py` into `validate_configs_node.py`). Flag any new template file that mirrors an existing one — every env var, ARG, and shared script must be audited.

<!-- List hot paths, SLA-sensitive operations, resource constraints, and performance
     conventions specific to this service. Mention concrete thresholds where they exist. -->
**Performance considerations**
- `getWhitelistedRepos` does up to 5 fresh `git clone` of `Meesho/whitelists` per build under GitHub rate-limiting. Do not add a sixth gate without coordinating with infra; do not add caching without a replacement freshness story (see Domain invariants).
- Per-build downloads of `sonar-scanner`, Go toolchain, `pnpm`, `librdkafka` add external-network dependency to the critical path and re-fetch on every build (PRs #306, #643). Bake into the builder base image (P1_TOOLS_IN_BASE_IMAGE_NOT_BUILD_STEP, P1_EXTERNAL_BINARY_DOWNLOAD_IN_BUILD).
- Dockerfile layer caching: dependency manifests (`Cargo.toml`/`Cargo.lock`, `package.json`/`package-lock.yaml`, `go.mod`/`go.sum`, `pom.xml`) must be `COPY`-ed and dependencies fetched before `COPY . .` in every Dockerfile under `resources/com/meesho/` (P1_DOCKER_LAYER_CACHING_DEPENDENCY_FIRST, PR #650).
- Non-prd node pools are BU-shared (`nodePoolSelection.groovy:run` → `{BU}-shared`). A memory leak or CPU spike on one staging/dev service degrades every other service in the same BU — flag any material increase in `requests`/`limits` on a non-prd values.yaml without BU-owner sign-off.
- Any externally downloaded binary must have hash verification (`sha256sum -c <expected>`) or be replaced by an Artifactory-hosted artifact with controlled provenance (P1_DOWNLOADED_BINARY_HASH_VERIFICATION, PR #643).
- Registry base URLs (`asia-southeast1-docker.pkg.dev/meesho-central-dev-0622/toolchain`) must be referenced via a shared constant in `src/com/meesho/utilities/`, not repeated inline across stage files (P1_SHARED_CONSTANTS_FOR_REGISTRY_PATHS, PR #681).

<!-- List external systems this service talks to and the contracts/quirks a reviewer
     should know. Include auth, messaging, config backends, and their failure modes. -->
**Integration boundaries**
- ArgoCD (`deployArgoCD.groovy`): 4-step deploy order is load-bearing; `argocd login --password ${ARGO_PASSWORD}` leaks the password via process list — prefer stdin or env-var injection. Flag any new `--password <literal>` style invocation.
- Turbo-Turtle / Ringmaster callbacks (`deployRingmaster.groovy`): canonical internal DNS endpoint (e.g. `turbo-turtle.meeshogcp.in`); payload sent via `curl -d @<tempfile>`; discriminated by `getCause(UserIdCause).getUserId() == "ringmaster-bot"`; temp file deleted in a `finally` block.
- GitHub SCM: `env.CHANGE_ID` from the GitHub Branch Source plugin is the canonical PR-build detector; never use `env.BRANCH_NAME =~ /PR-/` — it breaks on non-GitHub SCMs and on re-triggered builds. `Meesho/whitelists` is cloned freshly per gate.
- JFrog / S3 artifact targets: `push_to_jfrog` / `push_to_s3` are the boolean params that allow non-master branches to push — verify any new pusher honours both flags.
- Sonar: `skip_sonar` whitelist via `skip-sonar-whitelist.yaml`; uses the per-call `Meesho/whitelists` clone. Never overload `skip_sonar` (or `hot_fix`) for unrelated semantics — introduce a new, clearly named flag instead (P1_SEMANTIC_FLAG_REUSE, PRs #495, #578).
- Slack `#ci-cd-status` (default; override via `notify_channel`): notification fired from `notify.run` inside the top-level `finally` block of `buildPipeline.groovy`. Verify the `maintainer` Slack username is honoured on failure paths.
- GCP Artifact Registry `asia-southeast1-docker.pkg.dev/meesho-central-dev-0622/toolchain`: canonical toolchain registry. A project or region migration requires updating one constant — flag any inline duplicate of the URL.