Global compliance harness checklist: test-driven, AI-assisted

Companion to October 1: script tags, Functions, the cart, the catalog agents read (https://crm-sync.dev/docs/shopify-october-1-scripts-cart-catalog), section G.

How to use it. Copy this file into your repository. For each item, write the test first, watch it fail, then write the code that makes it pass. Tick the box only when the test runs on every deploy and a failure blocks the release. An item with no test is not done, whatever the code says.

Test kinds. Static reads source or configuration without running it. Unit runs one function in isolation. Integration runs two or more real parts together (worker and database, webhook and handler). E2E drives a real browser through a real page — Playwright or Selenium.

Rule for AI agents in the loop. An agent may draft a test from the rule's text and write code until it passes. It may not edit, skip or weaken a test to make it pass, and it may not add a test to a known-failures list. A person approves every test that states a legal rule, and every change that touches keys or money.

1. The gate itself

Every deploy runs the harness. The deploy command runs the suites before publishing; a manual deploy that skips them is not possible from the standard script. Static.
A failing GREEN test blocks the release. Only tests named in a reviewed known-failures list may fail, and each has an owner and a date. Static.
The known-failures list only shrinks. A listed test that now passes fails the gate until it is removed from the list. Static.
A skipped critical test fails the gate. Skipping is not passing. Static.
Each release is tagged with the commit it came from. Uncommitted changes are marked, so production always maps to a commit. Static.
Each legal test cites its source — the statute, regulation or platform document it encodes — in its name or comment. Static.

No advertising or analytics request before consent. Load the page with no stored choice; assert zero requests to ad and analytics hosts until the visitor accepts. E2E (network).
Consent Mode v2 defaults to denied for ad_storage, analytics_storage, ad_user_data and ad_personalization, and the default is set before any tag loads. E2E / static.
Stored consent replays before tags load on a return visit. E2E.
Rejecting is as easy as accepting: the reject control is on the first layer of the banner. E2E.
A browser opt-out preference signal is honoured. Send Sec-GPC: 1 and assert sale and sharing are off for the session without any click (California regulations §7025; AB 566 adds a browser-level signal from 1 January 2027). E2E.
Withdrawal propagates within a stated time to every downstream system that holds the identifier. Measure it; the test fails past the limit. Integration.

No session-level Consent Mode v2 record, no upload. A purchase's identifiers reach Google or Meta only when the consent event for that purchase's session is on record. Integration.
ad_user_data and ad_personalization are recorded, never derived from analytics consent. Unit.
Audience and conversion uploads refuse records without a market (ISO 3166-1) and consent state. Unit.

4. Jurisdiction: where personal data may go

Korea (PIPA art. 28-8). No Korean buyer's identifier leaves Korea for Google, Meta or any overseas processor until itemised overseas-transfer consent exists with evidence; aggregate counts only until then. Integration.
Korean personal data is processed on Korean-hosted services or the request is refused. Integration.
EU and UK (GDPR). Transfers outside the EEA and UK have a recorded basis per processor. Static (processor register).
Jurisdiction is the data subject's, not the server's or the store's. Unit.

5. Data subject requests

Shopify compliance webhooks exist and answer: customers/data_request, customers/redact, shop/redact. Integration.
Each webhook verifies its HMAC and returns 401 on a bad signature. Unit.
A redaction reaches every copy — database, cache, search index, analytics export. The test reads each back. Integration.
Deletion keeps what the law requires kept (tax and order records) and says so in the response. Integration.

6. Payments

Payment tests run only against test mode: Shopify's Bogus Gateway on a development store, or Stripe test keys. The harness refuses a live key. Static.
Success, decline and gateway failure each have a test. Bogus Gateway card numbers 1 (approved), 2 (declined), 3 (gateway failure); Stripe 4242 4242 4242 4242 (success), 4000 0000 0000 0002 (declined). E2E.
Strong customer authentication has a test. Stripe 4000 0027 6000 3184 requires a 3-D Secure challenge; assert both the completed and the failed challenge. E2E.
Card fields live in the provider's hosted iframe; no card number enters your page's DOM, logs or requests (PCI DSS scope). E2E (network) + static.
No card number, CVC or full token in any log line. Static.
An agent purchase needs a mandate: an AI agent can complete checkout only inside a recorded, scoped, expiring authorisation. Integration.

7. Shopify after 1 October 2026

No code path creates or updates a script tag (scriptTagCreate, scriptTagUpdate, REST script_tags). Static.
Tracking runs in a web pixel that reads consent before sending. Static + E2E.
System data uses double-underscore cart attributes; themes filter single-underscore line item properties. Static + E2E.
No reserved metafield namespace is written by your app. Static.

8. The catalog agents read

Every price carries an ISO 4217 currency. Unit.
Every record carries an ISO 3166-1 market key — uppercase in data, lowercase in URLs. Unit.
One tested mapping between BCP 47 language tags and Shopify's LanguageCode, with a round trip for every language you sell in. Unit.
Products carry GTIN or MPN before an agent may quote them. Integration.
Estimates are labelled as estimates, never as quotes. Unit.

9. Accessibility

Checkout and consent surfaces pass an automated accessibility scan (axe-core in Playwright or Selenium) with zero serious or critical findings — the European Accessibility Act has applied to e-commerce since 28 June 2025. E2E.
The consent banner and payment form work by keyboard alone. E2E.

10. Secrets and the agent

No secret in a test fixture, snapshot or recorded video. Static.
Agents never read raw secrets; privileged steps are run by a person and recorded. Static (process).
Every test the agent drafted was read by a person before it joined the gate. Process.

Licence: CC BY 4.0. Rules are summaries, not legal advice — confirm each against its source and with counsel in the market it covers.