@jmruthers/pace-core 0.6.10 → 0.6.12

package/audit-tool/audits/05-styling.cjs

@@ -41,6 +41,7 @@ function checkAppCssStructure(consumingAppPath) {
       message: 'app.css file not found. Required for pace-core styling.',
       severity: 'error',
       fix: 'Create src/app.css with required imports and @source directives',
+      standardSection: 'Required File: src/app.css (Verification Checklist)',
     });
     return issues;
   }
@@ -67,6 +68,7 @@ function checkAppCssStructure(consumingAppPath) {
         message: `Missing required import: ${name}`,
         severity: required ? 'error' : 'warning',
         fix: `Add ${name}; to app.css`,
+        standardSection: 'Required File: src/app.css; CSS Import Path',
       });
     }
   });
@@ -81,6 +83,7 @@ function checkAppCssStructure(consumingAppPath) {
       message: 'Missing @source directives for Tailwind v4 content scanning',
       severity: 'error',
       fix: 'Add @source directives: @source "./**/*.{js,ts,jsx,tsx}"; @source "../node_modules/@jmruthers/pace-core/src/**/*.{js,ts,jsx,tsx}";',
+      standardSection: 'CRITICAL: @source Directive Paths',
     });
   } else {
     // Check for correct @source paths (relative to CSS file location)
@@ -102,11 +105,12 @@ function checkAppCssStructure(consumingAppPath) {
         message: '@source directive missing for app source files',
         severity: 'error',
         fix: 'Add: @source "./**/*.{js,ts,jsx,tsx}"; (if app.css is in src/)',
+        standardSection: 'CRITICAL: @source Directive Paths',
       });
     }
-    
-    // Check if pace-core source files are included
-    const hasPaceCoreSource = foundSources.some(src => src.includes('@jmruthers/pace-core') || src.includes('pace-core/src'));
+
+    // Check if pace-core source files are included (package path or monorepo packages/core)
+    const hasPaceCoreSource = foundSources.some(src => src.includes('@jmruthers/pace-core') || src.includes('pace-core/src') || src.includes('packages/core/src'));
     if (!hasPaceCoreSource) {
       issues.push({
         type: 'appCss',
@@ -115,6 +119,7 @@ function checkAppCssStructure(consumingAppPath) {
         message: '@source directive missing for pace-core source files',
         severity: 'error',
         fix: 'Add: @source "../node_modules/@jmruthers/pace-core/src/**/*.{js,ts,jsx,tsx}"; (if app.css is in src/)',
+        standardSection: 'CRITICAL: @source Directive Paths',
       });
     }
   }
@@ -129,6 +134,7 @@ function checkAppCssStructure(consumingAppPath) {
       message: 'Missing @theme block for color palettes. Required for pace-core styling.',
       severity: 'error',
       fix: 'Add @theme static { /* color palettes here */ } block to app.css',
+      standardSection: 'Required Color Palettes (@theme static)',
     });
   } else {
     // Check for required color palettes (main, sec, acc)
@@ -151,11 +157,12 @@ function checkAppCssStructure(consumingAppPath) {
           message: `Missing required color palettes in @theme block: ${missing.join(', ')}`,
           severity: 'error',
           fix: `Add ${missing.join(', ')} color palettes to @theme block (all shades 50-950)`,
+          standardSection: 'Required Color Palettes (main, sec, acc)',
         });
       }
     }
   }
-  
+
   return issues;
 }
 
@@ -189,6 +196,7 @@ function checkTailwindV4Config(consumingAppPath) {
       message: 'Tailwind v4 plugin not found in vite.config.ts. Required for Tailwind v4.',
       severity: 'error',
       fix: 'Add: import tailwindcss from "@tailwindcss/vite"; and add tailwindcss() to plugins array',
+      standardSection: 'Verification Checklist / Tailwind v4 (Troubleshooting)',
     });
   }
   
@@ -198,13 +206,17 @@ function checkTailwindV4Config(consumingAppPath) {
 /**
  * Run audit for Standard 5: Styling
  * @param {string} consumingAppPath - Path to consuming app
+ * @param {{ isPaceCorePackage?: boolean }} [auditContext] - When isPaceCorePackage, skip app.css check (package does not have app.css)
  * @returns {object} - Audit results with issues array
  */
-function runStandard5Audit(consumingAppPath) {
+function runStandard5Audit(consumingAppPath, auditContext = {}) {
   const issues = [];
-  
+  const isPaceCorePackage = auditContext.isPaceCorePackage === true;
+
   try {
-    issues.push(...checkAppCssStructure(consumingAppPath));
+    if (!isPaceCorePackage) {
+      issues.push(...checkAppCssStructure(consumingAppPath));
+    }
     issues.push(...checkTailwindV4Config(consumingAppPath));
   } catch (error) {
     return {

package/audit-tool/audits/06-security-rbac.cjs

@@ -2,10 +2,13 @@
  * Standard 6: Security & RBAC Audit
  * @package @jmruthers/pace-core
  * @module Audit/Standard6
- * 
+ *
  * Audits consuming apps for compliance with Standard 6: Security & RBAC.
- * Validates RLS policies in SQL migrations, PagePermissionGuard coverage, and Edge Functions RBAC.
- * 
+ * Validates PagePermissionGuard coverage and Edge Functions RBAC. RLS policy compliance
+ * (naming, super-admin checks, schema-qualification, etc.) is audited by a separate
+ * DB audit tool that connects to the database directly; this file-based audit does
+ * not scan supabase/migrations.
+ *
  * Reference: packages/core/docs/standards/6-security-rbac-standards.md
  */
 
@@ -15,22 +18,22 @@ const { findSQLFiles, findSourceFiles, readFileSafe, getRelativePath, directoryE
 const { getLineNumber, getCodeSnippet, isInCommentOrStringSQL, isInCommentOrString, importsFromPaceCore } = require('../utils/code-utils.cjs');
 
 /**
- * Check RLS policy compliance in SQL migrations
+ * Check RLS policy compliance in SQL migrations.
+ * SKIPPED: This audit does not scan migration files. RLS policy compliance (naming,
+ * super-admin checks, schema-qualification, helper functions) is audited by a separate
+ * DB audit tool that connects to the database directly.
  */
 function checkRLSPolicies(consumingAppPath) {
+  return [];
+  /* Migration-based RLS checks disabled - see DB audit tool
   const issues = [];
-  
-  // Find SQL migration files
   const migrationsPath = path.join(consumingAppPath, 'supabase', 'migrations');
   const altMigrationsPath = path.join(consumingAppPath, 'migrations');
-  
-  const migrationsDir = fs.existsSync(migrationsPath) ? migrationsPath : 
+  const migrationsDir = fs.existsSync(migrationsPath) ? migrationsPath :
                         (fs.existsSync(altMigrationsPath) ? altMigrationsPath : null);
-  
   if (!migrationsDir) {
-    return issues; // No migrations directory, skip check
+    return issues;
   }
-  
   const sqlFiles = findSQLFiles(migrationsDir);
   
   sqlFiles.forEach(filePath => {
@@ -63,6 +66,7 @@ function checkRLSPolicies(consumingAppPath) {
             code: getCodeSnippet(content, policyStart, 0, 100),
             severity: 'error',
             fix: `Rename policy to follow pattern: rbac_${operation}_${tableName}`,
+            standardSection: 'Policy Naming Convention (RLS Policy Patterns)',
           });
         }
         
@@ -83,6 +87,7 @@ function checkRLSPolicies(consumingAppPath) {
             code: getCodeSnippet(content, policyStart, 0, 200),
             severity: 'error',
             fix: 'Replace auth.uid() with helper function like get_effective_user_id(). Helper functions must be STABLE SECURITY DEFINER.',
+            standardSection: 'Forbidden Patterns / Helper Function Requirements',
           });
         }
         
@@ -97,6 +102,7 @@ function checkRLSPolicies(consumingAppPath) {
             code: getCodeSnippet(content, policyStart, 0, 200),
             severity: 'error',
             fix: 'Replace subquery with helper function. Helper functions must be STABLE SECURITY DEFINER SET search_path TO public.',
+            standardSection: 'Forbidden Patterns / Helper Function Requirements',
           });
         }
         
@@ -111,6 +117,7 @@ function checkRLSPolicies(consumingAppPath) {
             code: getCodeSnippet(content, policyStart, 0, 200),
             severity: 'error',
             fix: 'Replace current_setting() with helper function. Helper functions must be STABLE SECURITY DEFINER.',
+            standardSection: 'Forbidden Patterns / Helper Function Requirements',
           });
         }
         
@@ -125,6 +132,7 @@ function checkRLSPolicies(consumingAppPath) {
             code: getCodeSnippet(content, policyStart, 0, 200),
             severity: 'error',
             fix: 'Replace is_super_admin() with is_super_admin(safe_get_user_id_for_rls()) to require explicit parameter passing.',
+            standardSection: 'Standard Helper Functions (is_super_admin)',
           });
         }
         
@@ -149,6 +157,7 @@ function checkRLSPolicies(consumingAppPath) {
               code: getCodeSnippet(content, policyStart, 0, 200),
               severity: 'error',
               fix: 'Add is_super_admin(safe_get_user_id_for_rls()) check. Pattern: (is_super_admin(safe_get_user_id_for_rls()) OR ...other checks...)',
+              standardSection: 'Standard Organisation-Scoped Policy / Policy Best Practices',
             });
           }
         }
@@ -180,6 +189,7 @@ function checkRLSPolicies(consumingAppPath) {
             code: getCodeSnippet(content, policyStart, 0, 200),
             severity: 'error',
             fix: `Replace ${usesEventAccess ? 'check_user_event_access(event_id)' : 'check_user_is_event_creator(event_id)'} with check_rbac_permission_with_context('${operation}:page.{page_name}', '{page_name}', organisation_id, event_id::text, get_app_id('{app_name}')). See RBAC compliance standard for page name mapping.`,
+            standardSection: 'RBAC Permission-Based Policy / Helper Selection Quick Guide',
           });
         }
         
@@ -205,6 +215,7 @@ function checkRLSPolicies(consumingAppPath) {
             code: getCodeSnippet(content, policyStart, 0, 200),
             severity: 'error',
             fix: 'Add event_id IS NOT NULL check to WITH CHECK clause. Pattern: event_id IS NOT NULL AND ...',
+            standardSection: 'Policy Best Practices / Standard Organisation-Scoped Policy',
           });
         }
         
@@ -224,6 +235,7 @@ function checkRLSPolicies(consumingAppPath) {
               code: getCodeSnippet(content, policyStart, 0, 200),
               severity: 'warning',
               fix: 'Add organisation_id IS NOT NULL check. Pattern: organisation_id IS NOT NULL AND ...',
+              standardSection: 'Policy Best Practices / Standard Organisation-Scoped Policy',
             });
           }
         }
@@ -270,6 +282,7 @@ function checkRLSPolicies(consumingAppPath) {
                   code: getCodeSnippet(content, funcStart, 0, 300),
                   severity: 'error',
                   fix: 'Remove DEFAULT NULL parameter and all fallback logic. Function should require explicit parameter and return false if parameter is NULL (fail secure).',
+                  standardSection: 'Security Anti-Patterns / Forbidden Patterns',
                 });
               }
             }
@@ -290,6 +303,7 @@ function checkRLSPolicies(consumingAppPath) {
               code: getCodeSnippet(content, funcStart, 0, 150),
               severity: 'error',
               fix: 'Add STABLE attribute to function definition.',
+              standardSection: 'RLS Policy Performance Requirements / Helper Function Requirements',
             });
           }
           
@@ -318,6 +332,7 @@ function checkRLSPolicies(consumingAppPath) {
                 code: getCodeSnippet(content, funcStart, 0, 150),
                 severity: 'error',
                 fix: 'Add SECURITY DEFINER attribute to function definition. Also ensure SET search_path TO public is present.',
+                standardSection: 'SECURITY DEFINER Requirements & Security',
               });
             } else {
               // Function doesn't query RLS-protected tables, SECURITY DEFINER might not be needed
@@ -334,6 +349,7 @@ function checkRLSPolicies(consumingAppPath) {
               code: getCodeSnippet(content, funcStart, 0, 150),
               severity: 'error',
               fix: 'Add SET search_path TO public to function definition. This is MANDATORY for SECURITY DEFINER functions to prevent search path hijacking.',
+              standardSection: 'Helper Function Template / Security Risks & Mitigations',
             });
           }
           
@@ -367,6 +383,7 @@ function checkRLSPolicies(consumingAppPath) {
                         code: getCodeSnippet(content, funcStart + tableMatch.index, 0, 100),
                         severity: 'error',
                         fix: `Schema-qualify the table reference: public.${tableName}`,
+                        standardSection: 'Security Anti-Patterns / Schema-qualify references',
                       });
                     }
                   }
@@ -394,6 +411,7 @@ function checkRLSPolicies(consumingAppPath) {
                       code: getCodeSnippet(content, funcStart, 0, 200),
                       severity: 'warning',
                       fix: 'Add COMMENT ON FUNCTION explaining why SECURITY DEFINER is needed, or remove SECURITY DEFINER if not required.',
+                      standardSection: 'Required Mitigations (Document rationale)',
                     });
                   }
                 } else if (queriesRLSProtected && !hasComment) {
@@ -408,6 +426,7 @@ function checkRLSPolicies(consumingAppPath) {
                       code: getCodeSnippet(content, funcStart, 0, 200),
                       severity: 'warning',
                       fix: 'Add COMMENT ON FUNCTION documenting that SECURITY DEFINER is required to avoid circular RLS dependencies when querying RLS-protected tables.',
+                      standardSection: 'Required Mitigations (Document rationale)',
                     });
                   }
                 }
@@ -420,8 +439,8 @@ function checkRLSPolicies(consumingAppPath) {
       // Skip files that can't be read
     }
   });
-  
   return issues;
+  */
 }
 
 /**
@@ -470,6 +489,11 @@ function checkPagePermissionGuardCoverage(consumingAppPath) {
       return;
     }
     
+    // Exclude test files - they don't need PagePermissionGuard
+    if (filePath.includes('.test.') || filePath.includes('.spec.')) {
+      return;
+    }
+    
     if (!isPageComponent(filePath, content)) {
       return;
     }
@@ -479,8 +503,13 @@ function checkPagePermissionGuardCoverage(consumingAppPath) {
     
     // Exclude public/error pages that don't need RBAC protection
     // NotFound, 404, Error, Unauthorized, Forbidden, AccessDenied pages are public
+    // Showcase/demo pages (UI, DataTable, Styles, Public, Organisation, Storage, etc.) are intentionally public
     const isPublicPage = /NotFound|not.*found|404|Error|Unauthorized|Forbidden|AccessDenied/i.test(fileName) ||
-                        /public|error|unauthorized|forbidden|access.*denied/i.test(relativePath);
+                        /public|error|unauthorized|forbidden|access.*denied/i.test(relativePath) ||
+                        /Showcase|showcase|StylesShowcase|DataTableShowcase|UIShowcase|OrganisationShowcase|StorageShowcase|PublicPage|CalendarTest|SuperAdmin|HomePage/i.test(fileName) ||
+                        /showcase|public.*page/i.test(relativePath) ||
+                        /PaceLoginPage|Login|login/i.test(fileName) ||
+                        /login/i.test(relativePath);
     
     if (isPublicPage) {
       return; // Skip public/error pages - they don't need PagePermissionGuard
@@ -509,6 +538,7 @@ function checkPagePermissionGuardCoverage(consumingAppPath) {
           message: 'Page component missing PagePermissionGuard wrapper. Pages using RBAC hooks must be protected.',
           severity: 'error',
           fix: 'Wrap page content with <PagePermissionGuard pageName="page-name" operation="read">',
+          standardSection: 'Security Baseline (page protection)',
         });
       } else {
         // Might be a public page, but flag for review
@@ -519,6 +549,7 @@ function checkPagePermissionGuardCoverage(consumingAppPath) {
           message: 'Page component does not use PagePermissionGuard. Verify if this page should be protected.',
           severity: 'warning',
           fix: 'If page should be protected, wrap with <PagePermissionGuard pageName="page-name" operation="read">',
+          standardSection: 'Security Baseline (page protection)',
         });
       }
     }
@@ -545,6 +576,7 @@ function checkPagePermissionGuardCoverage(consumingAppPath) {
             code: guardProps,
             severity: 'error',
             fix: 'Add required props: <PagePermissionGuard pageName="page-name" operation="read">',
+            standardSection: 'Security Baseline (page protection)',
           });
         }
       }
@@ -554,6 +586,62 @@ function checkPagePermissionGuardCoverage(consumingAppPath) {
   return issues;
 }
 
+/**
+ * Check organisation ID resolution in consuming app source.
+ * When both selectedOrganisation and selectedEvent are in scope, RPC/params that pass
+ * organisation context (p_organisation_id, organisation_id, selectedOrganisationId) must use
+ * a derived organisationId (selectedOrganisation?.id ?? selectedEvent?.organisation_id) so that
+ * org is resolved correctly when an event is selected without an explicit org in the context selector.
+ * Reference: Standard 6 data isolation; pace-core Event has organisation_id.
+ */
+function checkOrganisationIdResolution(consumingAppPath) {
+  const issues = [];
+  const srcDir = path.join(consumingAppPath, 'src');
+  if (!directoryExists(srcDir)) {
+    return issues;
+  }
+  const sourceFiles = findSourceFiles(srcDir);
+  const orgParamKeys = ['p_organisation_id', 'organisation_id', 'selectedOrganisationId'];
+  const orgParamKeyPattern = new RegExp(
+    '\\b(' + orgParamKeys.join('|') + ')\\s*:\\s*([^,}\\n]+)',
+    'g'
+  );
+  const usesSelectedOrgIdInValue = /selectedOrganisation\s*(\?\.id|\.id)/;
+
+  sourceFiles.forEach((filePath) => {
+    if (filePath.includes('.test.') || filePath.includes('.spec.')) {
+      return;
+    }
+    const content = readFileSafe(filePath);
+    if (!content) return;
+    const hasOrg = /selectedOrganisation|useOrganisations\s*\(/.test(content);
+    const hasEvent = /selectedEvent|useEvents\s*\(/.test(content);
+    if (!hasOrg || !hasEvent) return;
+
+    let match;
+    orgParamKeyPattern.lastIndex = 0;
+    while ((match = orgParamKeyPattern.exec(content)) !== null) {
+      const key = match[1];
+      const valuePart = match[2].trim();
+      if (!usesSelectedOrgIdInValue.test(valuePart)) continue;
+      if (/organisationId\b/.test(valuePart)) continue;
+      if (isInCommentOrString(content, match.index)) continue;
+      const lineNum = getLineNumber(content, match.index);
+      issues.push({
+        type: 'organisationIdResolution',
+        file: getRelativePath(filePath, consumingAppPath),
+        line: lineNum,
+        message: `Organisation context (${key}) is set from selectedOrganisation?.id while selectedEvent is also in scope. Use a derived organisationId (e.g. selectedOrganisation?.id ?? selectedEvent?.organisation_id) so org is resolved correctly when an event is selected without an explicit org.`,
+        code: getCodeSnippet(content, match.index, 0, 120),
+        severity: 'error',
+        fix: 'Derive organisationId = selectedOrganisation?.id ?? selectedEvent?.organisation_id ?? undefined (in a useMemo with [selectedOrganisation?.id, selectedEvent]) and use organisationId for all p_organisation_id, organisation_id, and selectedOrganisationId values.',
+        standardSection: 'Data isolation (organisation context resolution)',
+      });
+    }
+  });
+  return issues;
+}
+
 /**
  * Check Edge Functions RBAC setup
  */
@@ -615,6 +703,7 @@ function checkEdgeFunctionsRBAC(consumingAppPath) {
         message: 'Edge function uses isPermitted() but does not call setupRBAC(). Must call setupRBAC() before using RBAC functions.',
         severity: 'error',
         fix: 'Add: import { setupRBAC, isPermitted } from \'@jmruthers/pace-core/rbac\'; and call setupRBAC() at the start of the handler.',
+        standardSection: 'Edge Functions and Serverless Functions',
       });
     }
   });
@@ -625,14 +714,16 @@ function checkEdgeFunctionsRBAC(consumingAppPath) {
 /**
  * Run audit for Standard 6: Security & RBAC
  * @param {string} consumingAppPath - Path to consuming app
+ * @param {{ isPaceCorePackage?: boolean }} [auditContext] - Optional context (PaceLoginPage/Login are in public-page list)
  * @returns {object} - Audit results with issues array
  */
-function runStandard6Audit(consumingAppPath) {
+function runStandard6Audit(consumingAppPath, auditContext = {}) {
   const issues = [];
   
   try {
     issues.push(...checkRLSPolicies(consumingAppPath));
     issues.push(...checkPagePermissionGuardCoverage(consumingAppPath));
+    issues.push(...checkOrganisationIdResolution(consumingAppPath));
     issues.push(...checkEdgeFunctionsRBAC(consumingAppPath));
   } catch (error) {
     return {

package/audit-tool/audits/07-api-tech-stack.cjs

@@ -2,10 +2,12 @@
  * Standard 7: API & Tech Stack Audit
  * @package @jmruthers/pace-core
  * @module Audit/Standard7
- * 
+ *
  * Audits consuming apps for compliance with Standard 7: API & Tech Stack.
- * Validates RPC naming in SQL migrations, tech stack versions, and Vite configuration.
- * 
+ * Validates tech stack versions and Vite configuration. RPC naming compliance
+ * (data_/app_ prefix, verbs) is audited by a separate DB audit tool that connects
+ * to the database directly; this file-based audit does not scan supabase/migrations.
+ *
  * Reference: packages/core/docs/standards/7-api-tech-stack-standards.md
  */
 
@@ -15,24 +17,22 @@ const { findSQLFiles, findConfigFiles, readFileSafe, getRelativePath, findPaceCo
 const { getLineNumber, getCodeSnippet, isInCommentOrStringSQL } = require('../utils/code-utils.cjs');
 
 /**
- * Check RPC naming in SQL migrations (data_* for reads, app_* for writes)
+ * Check RPC naming in SQL migrations (data_* for reads, app_* for writes).
+ * SKIPPED: This audit does not scan migration files. RPC naming compliance is
+ * audited by a separate DB audit tool that connects to the database directly.
  */
 function checkRPCNaming(consumingAppPath) {
+  return [];
+  /* Migration-based RPC checks disabled - see DB audit tool
   const issues = [];
-  
-  // Find SQL migration files
   const migrationsPath = path.join(consumingAppPath, 'supabase', 'migrations');
   const altMigrationsPath = path.join(consumingAppPath, 'migrations');
-  
-  const migrationsDir = fs.existsSync(migrationsPath) ? migrationsPath : 
+  const migrationsDir = fs.existsSync(migrationsPath) ? migrationsPath :
                         (fs.existsSync(altMigrationsPath) ? altMigrationsPath : null);
-  
   if (!migrationsDir) {
-    return issues; // No migrations directory, skip check
+    return issues;
   }
-  
   const sqlFiles = findSQLFiles(migrationsDir);
-  
   sqlFiles.forEach(filePath => {
     try {
       const content = readFileSafe(filePath);
@@ -76,6 +76,7 @@ function checkRPCNaming(consumingAppPath) {
             code: getCodeSnippet(content, functionStart, 0, 100),
             severity: 'error',
             fix: `Rename function to follow pattern: data_${functionName} (for read) or app_${functionName} (for write)`,
+            standardSection: 'API & RPC Naming Conventions (RPC Naming Pattern / Naming Rules)',
           });
           continue;
         }
@@ -97,6 +98,7 @@ function checkRPCNaming(consumingAppPath) {
             code: getCodeSnippet(content, functionStart, 0, 100),
             severity: 'error',
             fix: `Rename RPC to use valid verb: ${functionName.replace(verb, validVerbs[0])}`,
+            standardSection: 'API & RPC Naming Conventions (RPC Naming Pattern / Naming Rules)',
           });
           continue;
         }
@@ -116,9 +118,10 @@ function checkRPCNaming(consumingAppPath) {
             code: getCodeSnippet(content, functionStart, 0, 100),
             severity: 'error',
             fix: `Rename to app_${functionName.replace('data_', '')}`,
+            standardSection: 'API & RPC Naming Conventions (RPC Naming Pattern / Naming Rules)',
           });
         }
-        
+
         if (hasAppPrefix && isReadOperation) {
           issues.push({
             type: 'rpcNaming',
@@ -128,6 +131,7 @@ function checkRPCNaming(consumingAppPath) {
             code: getCodeSnippet(content, functionStart, 0, 100),
             severity: 'error',
             fix: `Rename to data_${functionName.replace('app_', '')}`,
+            standardSection: 'API & RPC Naming Conventions (RPC Naming Pattern / Naming Rules)',
           });
         }
       }
@@ -135,8 +139,8 @@ function checkRPCNaming(consumingAppPath) {
       // Skip files that can't be read
     }
   });
-  
   return issues;
+  */
 }
 
 /**
@@ -163,6 +167,11 @@ function checkTechStackVersions(consumingAppPath) {
     ...(packageJson.dependencies || {}),
     ...(packageJson.devDependencies || {}),
   };
+
+  // When auditing the pace-core package, its peerDependencies satisfy required dependency check
+  if (packageJson.name === '@jmruthers/pace-core' && packageJson.peerDependencies) {
+    Object.assign(allDeps, packageJson.peerDependencies);
+  }
   
   // Get pace-core package.json for peer dependencies
   const paceCorePath = findPaceCorePackageJson(consumingAppPath);
@@ -185,6 +194,7 @@ function checkTechStackVersions(consumingAppPath) {
         message: `Missing required dependency: ${dep}. Required version: ${peerDeps[dep] || 'latest'}`,
         severity: 'error',
         fix: `Install ${dep}: npm install ${dep}@${peerDeps[dep] || 'latest'}`,
+        standardSection: 'Required Tech Stack / Version Requirements',
       });
     }
   });
@@ -202,6 +212,7 @@ function checkTechStackVersions(consumingAppPath) {
         message: `React version ${reactVersion} is below required version 19+. pace-core requires React 19+.`,
         severity: 'error',
         fix: 'Upgrade React: npm install react@^19.0.0 react-dom@^19.0.0',
+        standardSection: 'Required Tech Stack (React 19+)',
       });
     }
   }
@@ -239,6 +250,7 @@ function checkViteConfig(consumingAppPath) {
       message: 'vite.config.ts missing optimizeDeps.exclude. Should exclude @jmruthers/pace-core and react-router-dom to prevent React context mismatches.',
       severity: 'warning',
       fix: 'Add: optimizeDeps: { exclude: [\'@jmruthers/pace-core\', \'react-router-dom\'] }',
+      standardSection: 'Tech Stack Configuration (Vite Configuration)',
     });
   } else {
     // Check if pace-core is excluded
@@ -251,6 +263,7 @@ function checkViteConfig(consumingAppPath) {
         message: 'vite.config.ts optimizeDeps.exclude should include @jmruthers/pace-core to prevent React context mismatches.',
         severity: 'warning',
         fix: 'Add \'@jmruthers/pace-core\' to optimizeDeps.exclude array',
+        standardSection: 'Tech Stack Configuration (Vite Configuration)',
       });
     }
   }
@@ -304,6 +317,7 @@ function checkViteConfig(consumingAppPath) {
               message: 'vite.config.ts resolve.dedupe is missing required dependencies. Should include: react, react-dom, react-router-dom',
               severity: 'warning',
               fix: 'Update resolve.dedupe to include: [\'react\', \'react-dom\', \'react-router-dom\']',
+              standardSection: 'Tech Stack Configuration (Vite Configuration)',
             });
           }
         }
@@ -319,6 +333,7 @@ function checkViteConfig(consumingAppPath) {
       message: 'vite.config.ts missing resolve.dedupe. Should dedupe React dependencies to prevent context mismatches.',
       severity: 'warning',
       fix: 'Add: resolve: { dedupe: [\'react\', \'react-dom\', \'react-router-dom\'] }',
+      standardSection: 'Tech Stack Configuration (Vite Configuration)',
     });
   }
   
@@ -328,9 +343,10 @@ function checkViteConfig(consumingAppPath) {
 /**
  * Run audit for Standard 7: API & Tech Stack
  * @param {string} consumingAppPath - Path to consuming app
+ * @param {{ isPaceCorePackage?: boolean }} [auditContext] - Optional context (peerDeps satisfy required deps when package is pace-core)
  * @returns {object} - Audit results with issues array
  */
-function runStandard7Audit(consumingAppPath) {
+function runStandard7Audit(consumingAppPath, auditContext = {}) {
   const issues = [];
   
   try {

package/audit-tool/audits/08-testing-documentation.cjs

@@ -47,6 +47,7 @@ function checkTestTimeoutConfig(consumingAppPath) {
           message: 'vitest.config.ts missing test timeout configuration. Tests may hang indefinitely without timeouts.',
           severity: 'error',
           fix: 'Add: test: { testTimeout: 10000, hookTimeout: 10000, teardownTimeout: 5000 }',
+          standardSection: 'Test Timeouts',
         });
       }
     }
@@ -74,6 +75,7 @@ function checkTestTimeoutConfig(consumingAppPath) {
           message: 'Test scripts missing timeout configuration. Tests may hang indefinitely without timeouts.',
           severity: 'error',
           fix: 'Add --test-timeout=10000 to test scripts or configure in vitest.config.ts',
+          standardSection: 'Test Timeouts',
         });
       }
     } catch (error) {
@@ -125,6 +127,7 @@ function checkTestingTools(consumingAppPath) {
         message: `Missing required testing tool: ${name} (${description})`,
         severity: 'warning',
         fix: `Install: npm install --save-dev ${name}`,
+        standardSection: 'Testing Tools',
       });
     }
   });
@@ -165,6 +168,7 @@ function checkTestStructure(consumingAppPath) {
         message: 'Test file uses .spec extension. Should use .test extension for consistency.',
         severity: 'warning',
         fix: `Rename to ${testFile.replace('.spec.', '.test.')}`,
+        standardSection: 'Test Structure / Test File Naming',
       });
     }
   });
@@ -175,14 +179,18 @@ function checkTestStructure(consumingAppPath) {
 /**
  * Run audit for Standard 8: Testing & Documentation
  * @param {string} consumingAppPath - Path to consuming app
+ * @param {{ isPaceCorePackage?: boolean }} [auditContext] - When isPaceCorePackage, skip checkTestingTools (vitest may be at workspace root)
  * @returns {object} - Audit results with issues array
  */
-function runStandard8Audit(consumingAppPath) {
+function runStandard8Audit(consumingAppPath, auditContext = {}) {
   const issues = [];
-  
+  const isPaceCorePackage = auditContext.isPaceCorePackage === true;
+
   try {
     issues.push(...checkTestTimeoutConfig(consumingAppPath));
-    issues.push(...checkTestingTools(consumingAppPath));
+    if (!isPaceCorePackage) {
+      issues.push(...checkTestingTools(consumingAppPath));
+    }
     issues.push(...checkTestStructure(consumingAppPath));
   } catch (error) {
     return {