## Workflow/Process Defects (High)

### Trigger Signals

Start this detection when the following code characteristics appear:
- Multi-step workflows (`step1 → step2 → step3`, `onCreated → onApproved → onShipped`)
- Approval/review processes (submit/approve/reject)
- Async workflow orchestration (message-triggered next step, event-driven flow)
- Workflows involving timeout handling (timeout, scheduled task, cron)

### Judgment Process

1. **Draw workflow diagram**: `find_references` tracks call relationships between workflow step functions, building a step dependency graph (which step calls which, sequential/parallel)
2. **Check step preconditions**: `Read` checks whether each step verifies preconditions:
   - Whether there is a path that bypasses a step to directly call a subsequent step
   - Whether precondition checks are complete (e.g., shipping only after approval)
3. **Check parallel step conflicts**: For parallel steps, `find_references` tracks read/write of shared resources, confirming:
   - Whether there are conflicts from parallel steps modifying the same resource
   - Whether there is a merge strategy or lock protection
4. **Check timeout fallback**: `Read` checks whether steps involving waiting/async have timeout handling:
   - Whether there is state rollback or cleanup logic after timeout
   - Whether there is a risk of the workflow hanging in an intermediate state

### Evidence Construction

After confirming a defect, the output must include:
- Workflow step diagram (dependencies and call relationships between steps)
- Bypassable steps (which step can be skipped, from which path)
- Conflict/hang risk (specific location of parallel conflict or state hang after timeout)
- Business impact (consequences of workflow disruption: approval bypass, resource hanging, deadlock)

### Exclusions

- Purely sequential workflows (no branches/parallelism, no external dependencies between steps)
- Workflows already guaranteed by workflow engines (e.g., Temporal, Camunda, Airflow)
