feat: Digimental özelleştirmeleri -

[reservelab]

Değişiklikler:

• compliance-reviewer.md: Yeni agent (Türk bankacılık regülasyonları)
• security-reviewer.md: BDDK/MASAK güvenlik kontrolleri eklendi
• patterns.md: Supabase RLS pattern eklendi
• agents.md: Digital Board agent'ları eklendi
• testing.md: Coverage %80 → %70

Summary by CodeRabbit

Release Notes

• New Features

  • Introduced Compliance Reviewer agent for regulatory alignment and KYC/AML controls.

• Documentation

  • Added comprehensive compliance documentation for Turkish regulatory requirements.
  • Added Turkey-specific security guidance and checklist.
  • Documented Supabase Row Level Security and client initialization patterns.

• Updates

  • Adjusted minimum test coverage requirement from 80% to 70%.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[coderabbitai]

📝 Walkthrough

Walkthrough

Changes introduce Turkish regulatory compliance and security documentation (BDDK, MASAK, KVKK standards), expand agent registry with compliance-reviewer role, add Supabase RLS and client initialization patterns, and lower test coverage requirement from 80% to 70%.

Changes

Cohort / File(s)	Summary
Compliance & Security Documentation agents/compliance-reviewer.md, agents/security-reviewer.md	New 257-line compliance reviewer document defines BDDK/MASAK/KVKK controls, KYC/AML checklists, data retention policies, audit trails, and incident protocols in Turkish. Security reviewer expanded with 52 lines of Turkey-specific security requirements, Supabase RLS guidance, and IP range verification examples.
Agent Registry Updates rules/agents.md	Added compliance-reviewer to primary agent table. Introduced "Digital Board Agents (Digimental)" section with agent roles table. Expanded immediate agent usage guidelines with enumerated feature categories and added sections for parallel task execution and multi-perspective analysis.
Technical Patterns rules/patterns.md	Introduced two new pattern sections: Supabase RLS Pattern with SQL policy examples for row-level security on customers table, and Supabase Client Pattern with TypeScript examples for server-side and client-side client initialization with environment variables.
Testing Requirements rules/testing.md	Reduced minimum test coverage threshold from 80% to 70% in "Minimum Test Coverage" heading and MANDATORY workflow verification step. Updated Test-Driven Development section to align with new coverage expectations.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐰 Whiskers twitching with delight,
New rules hop into the light,
Turkish safeguards, patterns spun,
Coverage eased, compliance won!
🌟 Hops ahead with trusty cheer,
Regulations crystal clear. 🏛️

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'feat: Digimental özelleştirmeleri - BDDK/MASAK/KVKK' accurately summarizes the main changes: additions of Turkish regulatory compliance features (BDDK/MASAK/KVKK controls) and Digimental customizations across multiple files.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 3

🤖 Fix all issues with AI agents

In `@agents/compliance-reviewer.md`:
- Around line 66-72: Update the "Eşik Değerler" section in
agents/compliance-reviewer.md by replacing the outdated 150.000 TL threshold
under "Nakit işlem bildirimi" with the current 2026 MASAK thresholds: state that
cash and bank transfer declaration obligation applies at 200.000 TL and above,
and add the higher tiers 2.000.000 TL and 20.000.000 TL with notes that these
trigger the Cash Transaction Declaration Form and require additional
documentation; keep the other bullets (Şüpheli işlem, PEP kontrolü, Yaptırım
taraması) unchanged.

In `@agents/security-reviewer.md`:
- Around line 580-593: The current isTurkeyIP / TURKEY_IP_RANGES approach is
unreliable (false positives/negatives, no CIDR support, stale data); replace it
by using a proper geolocation lookup or validated CIDR matching: update the
isTurkeyIP function to call a maintained geolocation library/service (e.g.,
geoip-lite or MaxMind GeoIP2) or load an authoritative CIDR list and perform
robust CIDR matching (with IPv4/IPv6 parsing and validation) instead of
startsWith; ensure calls from the transaction check (the if that calls
requireAdditionalVerification) handle lookup failures and cache results/refresh
CIDRs periodically for maintainability.

In `@rules/agents.md`:
- Around line 20-28: The Digital Board section duplicates and fragments agent
definitions (e.g., compliance-reviewer appears twice and cfo-analyst,
cmo-analyst, cto-analyst only exist in the Digital Board table); fix by merging
into a single unified "Available Agents" table with an added "Category" column
(e.g., Core, Regulatory, Digital Board) and move cfo-analyst, cmo-analyst,
cto-analyst into that table, then remove the duplicate compliance-reviewer entry
from the Digital Board subsection; alternatively, if you prefer a hierarchy, add
a clear note under Digital Board stating those agent names are role-specific
configurations of the base agents (reference agent names: cfo-analyst,
cmo-analyst, cto-analyst, compliance-reviewer).

🧹 Nitpick comments (3)

agents/security-reviewer.md (1)

548-548: Add language specifiers to fenced code blocks.

Markdown best practices require language specifiers for fenced code blocks to enable proper syntax highlighting and improve readability.

Based on static analysis hints.

📝 Proposed fix

-```
+```text
 - [ ] Müşteri verileri AES-256 ile şifrelenmiş
 ...

-```
+```text
 - [ ] Şüpheli işlem logları immutable
 ...

Also applies to: 558-558

rules/patterns.md (1)

47-59: Fix code block language identifier.

The code block is tagged as typescript but contains SQL statements. This prevents proper syntax highlighting.

📝 Proposed fix

-```typescript
+```sql
 // ALWAYS enable RLS on tables with user data
 -- Enable RLS
 ALTER TABLE customers ENABLE ROW LEVEL SECURITY;

agents/compliance-reviewer.md (1)

41-64: Add return type annotations to async functions.

The example functions should include explicit return types for better type safety and documentation.

♻️ Proposed improvement

 // ❌ YANLIŞ: Kontrol yok
-async function transfer(from, to, amount) {
+async function transfer(from: string, to: string, amount: number): Promise<void> {
   await executeTransfer(from, to, amount)
 }

 // ✅ DOĞRU: MASAK kontrolü var
-async function transfer(from, to, amount) {
+async function transfer(from: string, to: string, amount: number): Promise<void> {
   const check = await masakCheck({ from, to, amount })

[coderabbitai]

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🌐 Web query:

MASAK Turkish Financial Crimes Investigation Board cash transaction reporting threshold 2026 TL

💡 Result:

MASAK’s draft communiqué sets a declaration obligation for cash and bank transfers of 200,000 Turkish Lira and above, effective January 1, 2026; higher tiers (2,000,000 TL and 20,000,000 TL) trigger completion of a Cash Transaction Declaration Form and additional documentation/explanations. (hurriyetdailynews.com)

Citations:

• 1: https://www.hurriyetdailynews.com/new-regulation-requires-detailed-proof-for-high-value-bank-transfers-217260?utm_source=openai

---

Update MASAK cash transaction reporting thresholds to current 2026 regulations.

The 150,000 TL threshold is outdated. Effective January 1, 2026, MASAK's current regulations set the declaration obligation for cash and bank transfers at 200,000 TL and above. Additionally, higher tiers at 2,000,000 TL and 20,000,000 TL trigger the Cash Transaction Declaration Form and additional documentation requirements. Update the documentation to reflect the current regulatory thresholds and include all applicable tiers.

🤖 Prompt for AI Agents

In `@agents/compliance-reviewer.md` around lines 66 - 72, Update the "Eşik
Değerler" section in agents/compliance-reviewer.md by replacing the outdated
150.000 TL threshold under "Nakit işlem bildirimi" with the current 2026 MASAK
thresholds: state that cash and bank transfer declaration obligation applies at
200.000 TL and above, and add the higher tiers 2.000.000 TL and 20.000.000 TL
with notes that these trigger the Cash Transaction Declaration Form and require
additional documentation; keep the other bullets (Şüpheli işlem, PEP kontrolü,
Yaptırım taraması) unchanged.

[coderabbitai]

⚠️ Potential issue | 🟠 Major

IP-based geolocation is unreliable and overly simplistic.

The current implementation has several issues:

1. False negatives: Turkish IPs outside these prefixes (e.g., mobile carriers, newer allocations) will be rejected.
2. False positives: Some listed prefixes may be allocated to other countries or shared.
3. No CIDR validation: Prefix matching doesn't account for subnet masks.
4. Maintainability: IP allocations change; hardcoded ranges become stale.

Consider using a proper IP geolocation service (MaxMind GeoIP2, IP2Location) or at minimum, expanding to full CIDR ranges with regular updates.

🌍 Recommended alternatives

Option 1: Use a geolocation service

import geoip from 'geoip-lite'

function isTurkeyIP(ip: string): boolean {
  const geo = geoip.lookup(ip)
  return geo?.country === 'TR'
}

Option 2: If staying with prefix matching, use comprehensive CIDR ranges

// Maintain updated CIDR blocks from RIPE/ARIN databases
const TURKEY_CIDR_BLOCKS = [
  '78.160.0.0/11',
  '85.96.0.0/13',
  // ... comprehensive list from regional registries
]

import { IpSubnetCalculator } from 'ip-subnet-calculator'

function isTurkeyIP(ip: string): boolean {
  return TURKEY_CIDR_BLOCKS.some(cidr => {
    // Proper CIDR matching logic
  })
}

🤖 Prompt for AI Agents

In `@agents/security-reviewer.md` around lines 580 - 593, The current isTurkeyIP /
TURKEY_IP_RANGES approach is unreliable (false positives/negatives, no CIDR
support, stale data); replace it by using a proper geolocation lookup or
validated CIDR matching: update the isTurkeyIP function to call a maintained
geolocation library/service (e.g., geoip-lite or MaxMind GeoIP2) or load an
authoritative CIDR list and perform robust CIDR matching (with IPv4/IPv6 parsing
and validation) instead of startsWith; ensure calls from the transaction check
(the if that calls requireAdditionalVerification) handle lookup failures and
cache results/refresh CIDRs periodically for maintainability.

[coderabbitai]

🛠️ Refactor suggestion | 🟠 Major

Clarify agent taxonomy and avoid duplication.

The "Digital Board Agents" section creates organizational confusion:

1. Duplication: compliance-reviewer appears in both the main table (line 14) and the Digital Board table (line 27).
2. Missing entries: cfo-analyst, cmo-analyst, and cto-analyst are only in the Digital Board table, not in the main "Available Agents" table.
3. Unclear distinction: It's not clear whether Digital Board agents are a subset, aliases, or separate entities.

Consider one of these approaches:

Option 1: Single unified table - Merge all agents into the main table with a "Category" column.

Option 2: Clear hierarchy - Add a note explaining that Digital Board agents are role-specific configurations of base agents.

Option 3: Separate sections - Clearly document that Digital Board agents are project-specific and reference the main agents where applicable.

💡 Example: Option 1 (unified table)

| Agent | Purpose | Category | When to Use |
|-------|---------|----------|-------------|
| planner | Implementation planning | Core | Complex features, refactoring |
| architect | System design | Core | Architectural decisions |
| ...
| compliance-reviewer | BDDK/MASAK/KVKK uyum | Regulatory | RegTech projelerinde |
| cfo-analyst | Finansal analiz | Digital Board | Maliyet/ROI hesaplaması |
| cmo-analyst | Pazarlama | Digital Board | Marketing stratejisi |
| cto-analyst | Teknik | Digital Board | architect + code-reviewer |

🤖 Prompt for AI Agents

In `@rules/agents.md` around lines 20 - 28, The Digital Board section duplicates
and fragments agent definitions (e.g., compliance-reviewer appears twice and
cfo-analyst, cmo-analyst, cto-analyst only exist in the Digital Board table);
fix by merging into a single unified "Available Agents" table with an added
"Category" column (e.g., Core, Regulatory, Digital Board) and move cfo-analyst,
cmo-analyst, cto-analyst into that table, then remove the duplicate
compliance-reviewer entry from the Digital Board subsection; alternatively, if
you prefer a hierarchy, add a clear note under Digital Board stating those agent
names are role-specific configurations of the base agents (reference agent
names: cfo-analyst, cmo-analyst, cto-analyst, compliance-reviewer).

[affaan-m]

Teşekkürler! (Thanks!) This PR adds Turkish banking regulations and compliance configs which are very specific to your use case. This repo aims to stay general-purpose. Consider maintaining a fork for your Turkish banking-specific configurations! 🙏