id: legacy-php-change
name: Legacy PHP (Yii2) Change
tags: [backend, safety, code-review, pr-time]
audience: dev
summary: Fires on any change to the legacy Yii2 codebase. Enforces small scoped changes, blocks aggressive refactors, escalates auth/payment paths to mandatory human review.
description: |
  Fires on any change to the legacy Yii2 PHP codebase. The legacy guide
  enforces small, scoped changes only — no aggressive refactors, no
  framework upgrades, no architectural changes without explicit human
  buy-in. Auth and payment paths in legacy code escalate to mandatory
  review.

triggered_by:
  - file_change: "superco-consumer/**"
  - file_change: "**/yii2/**"
  - file_change: "**/*.php"

risk:
  score: 7
  blast_radius: medium
  reason: "Legacy code lacks the test coverage and architectural discipline of newer services. Aggressive AI-driven refactors here are the documented failure mode this policy guards against."

required_agents:
  - legacy-php-guide
  - code-reviewer

required_gates:
  - id: no_aggressive_refactor
    description: "Diff stays scoped to the original task — no opportunistic restructuring of surrounding code"
  - id: boundary_check
    description: "Change does not cross module boundaries that the legacy guide marks as fragile"

human_approval_required:
  - condition: "touches.auth_path == true"
  - condition: "touches.payment_path == true"