[illia-romanenko]

Second layer: charges a fee for late cancellations and no-shows, using the classification from the layer below.

[coance-ai]

🔴 Critical risk · Payments

Charges cards and issues refunds. Read every changed line, run it
locally, and check the tests cover declined, partial and repeated payments.

Standards: PCI DSS v4.0.1 Req. 6.2.3 (custom code reviewed before
release) and 6.2.3.1 (reviewer is not the author)
Docs: Payments review checklist ·
Card data flow

Approvals: 2 needed · Who can approve: anyone with write access
Resolve this thread or reply /approve once you're done.

Why this file is governed

lib/payments/cancellation_fee.dart matched path /lib/payments/ (level payments). 40 lines changed.

[coance-ai]

Coance review

0 of 2 files approved

File	Level	Why	Approvals	Approved by	At commit
lib/payments/cancellation_fee.dart	payments	path /lib/payments/	0/2	—	—
test/payments/cancellation_fee_test.dart	app	path *.dart	0/1	—	—

Risk levels

payments: 2 approvals, not counting the author's own

🔴 Critical risk · Payments

Charges cards and issues refunds. Read every changed line, run it
locally, and check the tests cover declined, partial and repeated payments.

Standards: PCI DSS v4.0.1 Req. 6.2.3 (custom code reviewed before
release) and 6.2.3.1 (reviewer is not the author)
Docs: Payments review checklist ·
Card data flow

patient-records: 2 approvals, not counting the author's own

🔴 Critical risk · Patient records

Reads or writes health records. Check every access is logged, every
query is scoped to the patient's care team, and nothing leaks into logs.

Standards: HIPAA Security Rule 45 CFR 164.312(b) audit controls,
164.312(c)(1) integrity
Docs: PHI handling guide

auth: 1 approval, not counting the author's own

🟠 High risk · Sign-in and permissions

Check every new endpoint enforces authorization, and tokens and
sessions expire as documented.

Standards: OWASP ASVS 5.0 V6–V8; SOC 2 CC6.1
Docs: Auth review checklist

infrastructure: 1 approval, not counting the author's own

🟠 High risk · Infrastructure and migrations

Runs against production. Read the plan output, check nothing new is
exposed, and that migrations are safe on existing rows.

Standards: ISO/IEC 27001:2022 A.8.9, A.8.32; SOC 2 CC8.1
Docs: Infrastructure change runbook

app: 1 approval

🟡 Standard · App code

Read the file as a whole. Does the change make sense?

Lines changed: 56 in total · payments 40 · patient-records 0 · auth 0 · infrastructure 0 · app 16

_{Policy: .github/coance.yml at bd7529f · This comment and the coance check record who approved each file, at which commit · View in Coance}

[coance-ai]

🟡 Standard · App code

Read the file as a whole. Does the change make sense?

Approvals: 1 needed · Who can approve: anyone with write access
Resolve this thread or reply /approve once you're done.

Why this file is governed

test/payments/cancellation_fee_test.dart matched path *.dart (level app). 16 lines changed.