@jmruthers/pace-core 0.6.9 → 0.6.11

package/audit-tool/audits/06-security-rbac.cjs

@@ -2,10 +2,13 @@
  * Standard 6: Security & RBAC Audit
  * @package @jmruthers/pace-core
  * @module Audit/Standard6
- * 
+ *
  * Audits consuming apps for compliance with Standard 6: Security & RBAC.
- * Validates RLS policies in SQL migrations, PagePermissionGuard coverage, and Edge Functions RBAC.
- * 
+ * Validates PagePermissionGuard coverage and Edge Functions RBAC. RLS policy compliance
+ * (naming, super-admin checks, schema-qualification, etc.) is audited by a separate
+ * DB audit tool that connects to the database directly; this file-based audit does
+ * not scan supabase/migrations.
+ *
  * Reference: packages/core/docs/standards/6-security-rbac-standards.md
  */
 
@@ -15,22 +18,22 @@ const { findSQLFiles, findSourceFiles, readFileSafe, getRelativePath, directoryE
 const { getLineNumber, getCodeSnippet, isInCommentOrStringSQL, isInCommentOrString, importsFromPaceCore } = require('../utils/code-utils.cjs');
 
 /**
- * Check RLS policy compliance in SQL migrations
+ * Check RLS policy compliance in SQL migrations.
+ * SKIPPED: This audit does not scan migration files. RLS policy compliance (naming,
+ * super-admin checks, schema-qualification, helper functions) is audited by a separate
+ * DB audit tool that connects to the database directly.
  */
 function checkRLSPolicies(consumingAppPath) {
+  return [];
+  /* Migration-based RLS checks disabled - see DB audit tool
   const issues = [];
-  
-  // Find SQL migration files
   const migrationsPath = path.join(consumingAppPath, 'supabase', 'migrations');
   const altMigrationsPath = path.join(consumingAppPath, 'migrations');
-  
-  const migrationsDir = fs.existsSync(migrationsPath) ? migrationsPath : 
+  const migrationsDir = fs.existsSync(migrationsPath) ? migrationsPath :
                         (fs.existsSync(altMigrationsPath) ? altMigrationsPath : null);
-  
   if (!migrationsDir) {
-    return issues; // No migrations directory, skip check
+    return issues;
   }
-  
   const sqlFiles = findSQLFiles(migrationsDir);
   
   sqlFiles.forEach(filePath => {
@@ -63,6 +66,7 @@ function checkRLSPolicies(consumingAppPath) {
             code: getCodeSnippet(content, policyStart, 0, 100),
             severity: 'error',
             fix: `Rename policy to follow pattern: rbac_${operation}_${tableName}`,
+            standardSection: 'Policy Naming Convention (RLS Policy Patterns)',
           });
         }
         
@@ -83,6 +87,7 @@ function checkRLSPolicies(consumingAppPath) {
             code: getCodeSnippet(content, policyStart, 0, 200),
             severity: 'error',
             fix: 'Replace auth.uid() with helper function like get_effective_user_id(). Helper functions must be STABLE SECURITY DEFINER.',
+            standardSection: 'Forbidden Patterns / Helper Function Requirements',
           });
         }
         
@@ -97,6 +102,7 @@ function checkRLSPolicies(consumingAppPath) {
             code: getCodeSnippet(content, policyStart, 0, 200),
             severity: 'error',
             fix: 'Replace subquery with helper function. Helper functions must be STABLE SECURITY DEFINER SET search_path TO public.',
+            standardSection: 'Forbidden Patterns / Helper Function Requirements',
           });
         }
         
@@ -111,6 +117,7 @@ function checkRLSPolicies(consumingAppPath) {
             code: getCodeSnippet(content, policyStart, 0, 200),
             severity: 'error',
             fix: 'Replace current_setting() with helper function. Helper functions must be STABLE SECURITY DEFINER.',
+            standardSection: 'Forbidden Patterns / Helper Function Requirements',
           });
         }
         
@@ -125,6 +132,7 @@ function checkRLSPolicies(consumingAppPath) {
             code: getCodeSnippet(content, policyStart, 0, 200),
             severity: 'error',
             fix: 'Replace is_super_admin() with is_super_admin(safe_get_user_id_for_rls()) to require explicit parameter passing.',
+            standardSection: 'Standard Helper Functions (is_super_admin)',
           });
         }
         
@@ -149,6 +157,7 @@ function checkRLSPolicies(consumingAppPath) {
               code: getCodeSnippet(content, policyStart, 0, 200),
               severity: 'error',
               fix: 'Add is_super_admin(safe_get_user_id_for_rls()) check. Pattern: (is_super_admin(safe_get_user_id_for_rls()) OR ...other checks...)',
+              standardSection: 'Standard Organisation-Scoped Policy / Policy Best Practices',
             });
           }
         }
@@ -180,6 +189,7 @@ function checkRLSPolicies(consumingAppPath) {
             code: getCodeSnippet(content, policyStart, 0, 200),
             severity: 'error',
             fix: `Replace ${usesEventAccess ? 'check_user_event_access(event_id)' : 'check_user_is_event_creator(event_id)'} with check_rbac_permission_with_context('${operation}:page.{page_name}', '{page_name}', organisation_id, event_id::text, get_app_id('{app_name}')). See RBAC compliance standard for page name mapping.`,
+            standardSection: 'RBAC Permission-Based Policy / Helper Selection Quick Guide',
           });
         }
         
@@ -205,6 +215,7 @@ function checkRLSPolicies(consumingAppPath) {
             code: getCodeSnippet(content, policyStart, 0, 200),
             severity: 'error',
             fix: 'Add event_id IS NOT NULL check to WITH CHECK clause. Pattern: event_id IS NOT NULL AND ...',
+            standardSection: 'Policy Best Practices / Standard Organisation-Scoped Policy',
           });
         }
         
@@ -224,6 +235,7 @@ function checkRLSPolicies(consumingAppPath) {
               code: getCodeSnippet(content, policyStart, 0, 200),
               severity: 'warning',
               fix: 'Add organisation_id IS NOT NULL check. Pattern: organisation_id IS NOT NULL AND ...',
+              standardSection: 'Policy Best Practices / Standard Organisation-Scoped Policy',
             });
           }
         }
@@ -270,6 +282,7 @@ function checkRLSPolicies(consumingAppPath) {
                   code: getCodeSnippet(content, funcStart, 0, 300),
                   severity: 'error',
                   fix: 'Remove DEFAULT NULL parameter and all fallback logic. Function should require explicit parameter and return false if parameter is NULL (fail secure).',
+                  standardSection: 'Security Anti-Patterns / Forbidden Patterns',
                 });
               }
             }
@@ -290,19 +303,41 @@ function checkRLSPolicies(consumingAppPath) {
               code: getCodeSnippet(content, funcStart, 0, 150),
               severity: 'error',
               fix: 'Add STABLE attribute to function definition.',
+              standardSection: 'RLS Policy Performance Requirements / Helper Function Requirements',
             });
           }
           
+          // Check if function queries RLS-protected tables to determine if SECURITY DEFINER is needed
+          const funcBodyStart = content.indexOf('AS $$', funcStart);
+          let needsSecurityDefiner = false;
+          if (funcBodyStart !== -1) {
+            const funcBodyEnd = content.indexOf('$$;', funcBodyStart);
+            if (funcBodyEnd !== -1) {
+              const funcBody = content.substring(funcBodyStart, funcBodyEnd);
+              const rlsProtectedTables = ['rbac_organisation_roles', 'rbac_global_roles', 'rbac_event_app_roles', 'rbac_user_profiles', 'rbac_apps', 'rbac_app_pages', 'rbac_page_permissions'];
+              needsSecurityDefiner = rlsProtectedTables.some(table => {
+                const tablePattern = new RegExp(`\\b${table}\\b`, 'i');
+                return tablePattern.test(funcBody);
+              });
+            }
+          }
+          
           if (!hasSecurityDefiner) {
-            issues.push({
-              type: 'rlsPolicy',
-              file: relativePath,
-              line: getLineNumber(content, funcStart),
-              message: `Helper function '${funcName}' missing SECURITY DEFINER attribute. RLS helper functions must be SECURITY DEFINER to bypass RLS recursion.`,
-              code: getCodeSnippet(content, funcStart, 0, 150),
-              severity: 'error',
-              fix: 'Add SECURITY DEFINER attribute to function definition.',
-            });
+            if (needsSecurityDefiner) {
+              issues.push({
+                type: 'rlsPolicy',
+                file: relativePath,
+                line: getLineNumber(content, funcStart),
+                message: `Helper function '${funcName}' queries RLS-protected tables but missing SECURITY DEFINER attribute. REQUIRED: SECURITY DEFINER is needed to bypass RLS and avoid circular dependencies when querying RLS-protected tables from within RLS policies.`,
+                code: getCodeSnippet(content, funcStart, 0, 150),
+                severity: 'error',
+                fix: 'Add SECURITY DEFINER attribute to function definition. Also ensure SET search_path TO public is present.',
+                standardSection: 'SECURITY DEFINER Requirements & Security',
+              });
+            } else {
+              // Function doesn't query RLS-protected tables, SECURITY DEFINER might not be needed
+              // This is just informational, not an error
+            }
           }
           
           if (!hasSearchPath) {
@@ -310,20 +345,102 @@ function checkRLSPolicies(consumingAppPath) {
               type: 'rlsPolicy',
               file: relativePath,
               line: getLineNumber(content, funcStart),
-              message: `Helper function '${funcName}' missing SET search_path TO public. Required to prevent search path injection.`,
+              message: `Helper function '${funcName}' missing SET search_path TO public. MANDATORY for SECURITY DEFINER functions to prevent search path hijacking attacks.`,
               code: getCodeSnippet(content, funcStart, 0, 150),
               severity: 'error',
-              fix: 'Add SET search_path TO public to function definition.',
+              fix: 'Add SET search_path TO public to function definition. This is MANDATORY for SECURITY DEFINER functions to prevent search path hijacking.',
+              standardSection: 'Helper Function Template / Security Risks & Mitigations',
             });
           }
+          
+          // Additional security checks for SECURITY DEFINER functions
+          if (hasSecurityDefiner) {
+            // Get function body to check for unqualified references
+            const funcBodyStart = content.indexOf('AS $$', funcStart);
+            if (funcBodyStart !== -1) {
+              const funcBodyEnd = content.indexOf('$$;', funcBodyStart);
+              if (funcBodyEnd !== -1) {
+                const funcBody = content.substring(funcBodyStart, funcBodyEnd);
+                
+                // Check for unqualified table references (security risk)
+                // Look for FROM/JOIN without schema qualification
+                const unqualifiedTablePattern = /(?:FROM|JOIN)\s+([a-z_][a-z0-9_]*)\s+(?!WHERE|ON|,|$)/gi;
+                let tableMatch;
+                const rlsProtectedTables = ['rbac_organisation_roles', 'rbac_global_roles', 'rbac_event_app_roles', 'rbac_user_profiles', 'rbac_apps', 'rbac_app_pages', 'rbac_page_permissions'];
+                
+                while ((tableMatch = unqualifiedTablePattern.exec(funcBody)) !== null) {
+                  const tableName = tableMatch[1].toLowerCase();
+                  // Check if it's a known RLS-protected table without schema qualification
+                  if (rlsProtectedTables.some(t => t.toLowerCase() === tableName)) {
+                    // Check if it's already schema-qualified (public.table_name)
+                    const beforeMatch = funcBody.substring(Math.max(0, tableMatch.index - 20), tableMatch.index);
+                    if (!/public\./i.test(beforeMatch)) {
+                      issues.push({
+                        type: 'rlsPolicy',
+                        file: relativePath,
+                        line: getLineNumber(content, funcStart + tableMatch.index),
+                        message: `SECURITY DEFINER function '${funcName}' uses unqualified table reference '${tableName}'. MANDATORY: All table references in SECURITY DEFINER functions must be schema-qualified (e.g., public.${tableName}) to prevent search path hijacking.`,
+                        code: getCodeSnippet(content, funcStart + tableMatch.index, 0, 100),
+                        severity: 'error',
+                        fix: `Schema-qualify the table reference: public.${tableName}`,
+                        standardSection: 'Security Anti-Patterns / Schema-qualify references',
+                      });
+                    }
+                  }
+                }
+                
+                // Check if function queries RLS-protected tables (justification for SECURITY DEFINER)
+                const queriesRLSProtected = rlsProtectedTables.some(table => {
+                  const tablePattern = new RegExp(`\\b${table}\\b`, 'i');
+                  return tablePattern.test(funcBody);
+                });
+                
+                // Check if function has any table queries at all
+                const hasTableQueries = /(?:FROM|JOIN|INTO|UPDATE)\s+\w+/i.test(funcBody);
+                
+                if (!queriesRLSProtected && hasTableQueries) {
+                  // Function has SECURITY DEFINER but doesn't query RLS-protected tables
+                  // This might be okay if it needs elevated privileges, but should be documented
+                  const hasComment = /COMMENT\s+ON\s+FUNCTION.*SECURITY\s+DEFINER/i.test(content.substring(funcStart, funcStart + 2000));
+                  if (!hasComment) {
+                    issues.push({
+                      type: 'rlsPolicy',
+                      file: relativePath,
+                      line: getLineNumber(content, funcStart),
+                      message: `SECURITY DEFINER function '${funcName}' does not query RLS-protected tables. If SECURITY DEFINER is needed for elevated privileges, document why in a COMMENT. Otherwise, consider removing SECURITY DEFINER if not needed.`,
+                      code: getCodeSnippet(content, funcStart, 0, 200),
+                      severity: 'warning',
+                      fix: 'Add COMMENT ON FUNCTION explaining why SECURITY DEFINER is needed, or remove SECURITY DEFINER if not required.',
+                      standardSection: 'Required Mitigations (Document rationale)',
+                    });
+                  }
+                } else if (queriesRLSProtected && !hasComment) {
+                  // Function queries RLS-protected tables but doesn't document why SECURITY DEFINER is needed
+                  const hasComment = /COMMENT\s+ON\s+FUNCTION/i.test(content.substring(funcStart, funcStart + 2000));
+                  if (!hasComment) {
+                    issues.push({
+                      type: 'rlsPolicy',
+                      file: relativePath,
+                      line: getLineNumber(content, funcStart),
+                      message: `SECURITY DEFINER function '${funcName}' queries RLS-protected tables but lacks documentation. REQUIRED: Add COMMENT ON FUNCTION explaining why SECURITY DEFINER is needed (to avoid circular RLS dependencies).`,
+                      code: getCodeSnippet(content, funcStart, 0, 200),
+                      severity: 'warning',
+                      fix: 'Add COMMENT ON FUNCTION documenting that SECURITY DEFINER is required to avoid circular RLS dependencies when querying RLS-protected tables.',
+                      standardSection: 'Required Mitigations (Document rationale)',
+                    });
+                  }
+                }
+              }
+            }
+          }
         }
       }
     } catch (error) {
       // Skip files that can't be read
     }
   });
-  
   return issues;
+  */
 }
 
 /**
@@ -372,6 +489,11 @@ function checkPagePermissionGuardCoverage(consumingAppPath) {
       return;
     }
     
+    // Exclude test files - they don't need PagePermissionGuard
+    if (filePath.includes('.test.') || filePath.includes('.spec.')) {
+      return;
+    }
+    
     if (!isPageComponent(filePath, content)) {
       return;
     }
@@ -381,8 +503,13 @@ function checkPagePermissionGuardCoverage(consumingAppPath) {
     
     // Exclude public/error pages that don't need RBAC protection
     // NotFound, 404, Error, Unauthorized, Forbidden, AccessDenied pages are public
+    // Showcase/demo pages (UI, DataTable, Styles, Public, Organisation, Storage, etc.) are intentionally public
     const isPublicPage = /NotFound|not.*found|404|Error|Unauthorized|Forbidden|AccessDenied/i.test(fileName) ||
-                        /public|error|unauthorized|forbidden|access.*denied/i.test(relativePath);
+                        /public|error|unauthorized|forbidden|access.*denied/i.test(relativePath) ||
+                        /Showcase|showcase|StylesShowcase|DataTableShowcase|UIShowcase|OrganisationShowcase|StorageShowcase|PublicPage|CalendarTest|SuperAdmin|HomePage/i.test(fileName) ||
+                        /showcase|public.*page/i.test(relativePath) ||
+                        /PaceLoginPage|Login|login/i.test(fileName) ||
+                        /login/i.test(relativePath);
     
     if (isPublicPage) {
       return; // Skip public/error pages - they don't need PagePermissionGuard
@@ -411,6 +538,7 @@ function checkPagePermissionGuardCoverage(consumingAppPath) {
           message: 'Page component missing PagePermissionGuard wrapper. Pages using RBAC hooks must be protected.',
           severity: 'error',
           fix: 'Wrap page content with <PagePermissionGuard pageName="page-name" operation="read">',
+          standardSection: 'Security Baseline (page protection)',
         });
       } else {
         // Might be a public page, but flag for review
@@ -421,6 +549,7 @@ function checkPagePermissionGuardCoverage(consumingAppPath) {
           message: 'Page component does not use PagePermissionGuard. Verify if this page should be protected.',
           severity: 'warning',
           fix: 'If page should be protected, wrap with <PagePermissionGuard pageName="page-name" operation="read">',
+          standardSection: 'Security Baseline (page protection)',
         });
       }
     }
@@ -447,6 +576,7 @@ function checkPagePermissionGuardCoverage(consumingAppPath) {
             code: guardProps,
             severity: 'error',
             fix: 'Add required props: <PagePermissionGuard pageName="page-name" operation="read">',
+            standardSection: 'Security Baseline (page protection)',
           });
         }
       }
@@ -456,6 +586,62 @@ function checkPagePermissionGuardCoverage(consumingAppPath) {
   return issues;
 }
 
+/**
+ * Check organisation ID resolution in consuming app source.
+ * When both selectedOrganisation and selectedEvent are in scope, RPC/params that pass
+ * organisation context (p_organisation_id, organisation_id, selectedOrganisationId) must use
+ * a derived organisationId (selectedOrganisation?.id ?? selectedEvent?.organisation_id) so that
+ * org is resolved correctly when an event is selected without an explicit org in the context selector.
+ * Reference: Standard 6 data isolation; pace-core Event has organisation_id.
+ */
+function checkOrganisationIdResolution(consumingAppPath) {
+  const issues = [];
+  const srcDir = path.join(consumingAppPath, 'src');
+  if (!directoryExists(srcDir)) {
+    return issues;
+  }
+  const sourceFiles = findSourceFiles(srcDir);
+  const orgParamKeys = ['p_organisation_id', 'organisation_id', 'selectedOrganisationId'];
+  const orgParamKeyPattern = new RegExp(
+    '\\b(' + orgParamKeys.join('|') + ')\\s*:\\s*([^,}\\n]+)',
+    'g'
+  );
+  const usesSelectedOrgIdInValue = /selectedOrganisation\s*(\?\.id|\.id)/;
+
+  sourceFiles.forEach((filePath) => {
+    if (filePath.includes('.test.') || filePath.includes('.spec.')) {
+      return;
+    }
+    const content = readFileSafe(filePath);
+    if (!content) return;
+    const hasOrg = /selectedOrganisation|useOrganisations\s*\(/.test(content);
+    const hasEvent = /selectedEvent|useEvents\s*\(/.test(content);
+    if (!hasOrg || !hasEvent) return;
+
+    let match;
+    orgParamKeyPattern.lastIndex = 0;
+    while ((match = orgParamKeyPattern.exec(content)) !== null) {
+      const key = match[1];
+      const valuePart = match[2].trim();
+      if (!usesSelectedOrgIdInValue.test(valuePart)) continue;
+      if (/organisationId\b/.test(valuePart)) continue;
+      if (isInCommentOrString(content, match.index)) continue;
+      const lineNum = getLineNumber(content, match.index);
+      issues.push({
+        type: 'organisationIdResolution',
+        file: getRelativePath(filePath, consumingAppPath),
+        line: lineNum,
+        message: `Organisation context (${key}) is set from selectedOrganisation?.id while selectedEvent is also in scope. Use a derived organisationId (e.g. selectedOrganisation?.id ?? selectedEvent?.organisation_id) so org is resolved correctly when an event is selected without an explicit org.`,
+        code: getCodeSnippet(content, match.index, 0, 120),
+        severity: 'error',
+        fix: 'Derive organisationId = selectedOrganisation?.id ?? selectedEvent?.organisation_id ?? undefined (in a useMemo with [selectedOrganisation?.id, selectedEvent]) and use organisationId for all p_organisation_id, organisation_id, and selectedOrganisationId values.',
+        standardSection: 'Data isolation (organisation context resolution)',
+      });
+    }
+  });
+  return issues;
+}
+
 /**
  * Check Edge Functions RBAC setup
  */
@@ -517,6 +703,7 @@ function checkEdgeFunctionsRBAC(consumingAppPath) {
         message: 'Edge function uses isPermitted() but does not call setupRBAC(). Must call setupRBAC() before using RBAC functions.',
         severity: 'error',
         fix: 'Add: import { setupRBAC, isPermitted } from \'@jmruthers/pace-core/rbac\'; and call setupRBAC() at the start of the handler.',
+        standardSection: 'Edge Functions and Serverless Functions',
       });
     }
   });
@@ -527,14 +714,16 @@ function checkEdgeFunctionsRBAC(consumingAppPath) {
 /**
  * Run audit for Standard 6: Security & RBAC
  * @param {string} consumingAppPath - Path to consuming app
+ * @param {{ isPaceCorePackage?: boolean }} [auditContext] - Optional context (PaceLoginPage/Login are in public-page list)
  * @returns {object} - Audit results with issues array
  */
-function runStandard6Audit(consumingAppPath) {
+function runStandard6Audit(consumingAppPath, auditContext = {}) {
   const issues = [];
   
   try {
     issues.push(...checkRLSPolicies(consumingAppPath));
     issues.push(...checkPagePermissionGuardCoverage(consumingAppPath));
+    issues.push(...checkOrganisationIdResolution(consumingAppPath));
     issues.push(...checkEdgeFunctionsRBAC(consumingAppPath));
   } catch (error) {
     return {

package/audit-tool/audits/07-api-tech-stack.cjs

@@ -2,10 +2,12 @@
  * Standard 7: API & Tech Stack Audit
  * @package @jmruthers/pace-core
  * @module Audit/Standard7
- * 
+ *
  * Audits consuming apps for compliance with Standard 7: API & Tech Stack.
- * Validates RPC naming in SQL migrations, tech stack versions, and Vite configuration.
- * 
+ * Validates tech stack versions and Vite configuration. RPC naming compliance
+ * (data_/app_ prefix, verbs) is audited by a separate DB audit tool that connects
+ * to the database directly; this file-based audit does not scan supabase/migrations.
+ *
  * Reference: packages/core/docs/standards/7-api-tech-stack-standards.md
  */
 
@@ -15,24 +17,22 @@ const { findSQLFiles, findConfigFiles, readFileSafe, getRelativePath, findPaceCo
 const { getLineNumber, getCodeSnippet, isInCommentOrStringSQL } = require('../utils/code-utils.cjs');
 
 /**
- * Check RPC naming in SQL migrations (data_* for reads, app_* for writes)
+ * Check RPC naming in SQL migrations (data_* for reads, app_* for writes).
+ * SKIPPED: This audit does not scan migration files. RPC naming compliance is
+ * audited by a separate DB audit tool that connects to the database directly.
  */
 function checkRPCNaming(consumingAppPath) {
+  return [];
+  /* Migration-based RPC checks disabled - see DB audit tool
   const issues = [];
-  
-  // Find SQL migration files
   const migrationsPath = path.join(consumingAppPath, 'supabase', 'migrations');
   const altMigrationsPath = path.join(consumingAppPath, 'migrations');
-  
-  const migrationsDir = fs.existsSync(migrationsPath) ? migrationsPath : 
+  const migrationsDir = fs.existsSync(migrationsPath) ? migrationsPath :
                         (fs.existsSync(altMigrationsPath) ? altMigrationsPath : null);
-  
   if (!migrationsDir) {
-    return issues; // No migrations directory, skip check
+    return issues;
   }
-  
   const sqlFiles = findSQLFiles(migrationsDir);
-  
   sqlFiles.forEach(filePath => {
     try {
       const content = readFileSafe(filePath);
@@ -76,6 +76,7 @@ function checkRPCNaming(consumingAppPath) {
             code: getCodeSnippet(content, functionStart, 0, 100),
             severity: 'error',
             fix: `Rename function to follow pattern: data_${functionName} (for read) or app_${functionName} (for write)`,
+            standardSection: 'API & RPC Naming Conventions (RPC Naming Pattern / Naming Rules)',
           });
           continue;
         }
@@ -97,6 +98,7 @@ function checkRPCNaming(consumingAppPath) {
             code: getCodeSnippet(content, functionStart, 0, 100),
             severity: 'error',
             fix: `Rename RPC to use valid verb: ${functionName.replace(verb, validVerbs[0])}`,
+            standardSection: 'API & RPC Naming Conventions (RPC Naming Pattern / Naming Rules)',
           });
           continue;
         }
@@ -116,9 +118,10 @@ function checkRPCNaming(consumingAppPath) {
             code: getCodeSnippet(content, functionStart, 0, 100),
             severity: 'error',
             fix: `Rename to app_${functionName.replace('data_', '')}`,
+            standardSection: 'API & RPC Naming Conventions (RPC Naming Pattern / Naming Rules)',
           });
         }
-        
+
         if (hasAppPrefix && isReadOperation) {
           issues.push({
             type: 'rpcNaming',
@@ -128,6 +131,7 @@ function checkRPCNaming(consumingAppPath) {
             code: getCodeSnippet(content, functionStart, 0, 100),
             severity: 'error',
             fix: `Rename to data_${functionName.replace('app_', '')}`,
+            standardSection: 'API & RPC Naming Conventions (RPC Naming Pattern / Naming Rules)',
           });
         }
       }
@@ -135,8 +139,8 @@ function checkRPCNaming(consumingAppPath) {
       // Skip files that can't be read
     }
   });
-  
   return issues;
+  */
 }
 
 /**
@@ -163,6 +167,11 @@ function checkTechStackVersions(consumingAppPath) {
     ...(packageJson.dependencies || {}),
     ...(packageJson.devDependencies || {}),
   };
+
+  // When auditing the pace-core package, its peerDependencies satisfy required dependency check
+  if (packageJson.name === '@jmruthers/pace-core' && packageJson.peerDependencies) {
+    Object.assign(allDeps, packageJson.peerDependencies);
+  }
   
   // Get pace-core package.json for peer dependencies
   const paceCorePath = findPaceCorePackageJson(consumingAppPath);
@@ -185,6 +194,7 @@ function checkTechStackVersions(consumingAppPath) {
         message: `Missing required dependency: ${dep}. Required version: ${peerDeps[dep] || 'latest'}`,
         severity: 'error',
         fix: `Install ${dep}: npm install ${dep}@${peerDeps[dep] || 'latest'}`,
+        standardSection: 'Required Tech Stack / Version Requirements',
       });
     }
   });
@@ -202,6 +212,7 @@ function checkTechStackVersions(consumingAppPath) {
         message: `React version ${reactVersion} is below required version 19+. pace-core requires React 19+.`,
         severity: 'error',
         fix: 'Upgrade React: npm install react@^19.0.0 react-dom@^19.0.0',
+        standardSection: 'Required Tech Stack (React 19+)',
       });
     }
   }
@@ -239,6 +250,7 @@ function checkViteConfig(consumingAppPath) {
       message: 'vite.config.ts missing optimizeDeps.exclude. Should exclude @jmruthers/pace-core and react-router-dom to prevent React context mismatches.',
       severity: 'warning',
       fix: 'Add: optimizeDeps: { exclude: [\'@jmruthers/pace-core\', \'react-router-dom\'] }',
+      standardSection: 'Tech Stack Configuration (Vite Configuration)',
     });
   } else {
     // Check if pace-core is excluded
@@ -251,6 +263,7 @@ function checkViteConfig(consumingAppPath) {
         message: 'vite.config.ts optimizeDeps.exclude should include @jmruthers/pace-core to prevent React context mismatches.',
         severity: 'warning',
         fix: 'Add \'@jmruthers/pace-core\' to optimizeDeps.exclude array',
+        standardSection: 'Tech Stack Configuration (Vite Configuration)',
       });
     }
   }
@@ -304,6 +317,7 @@ function checkViteConfig(consumingAppPath) {
               message: 'vite.config.ts resolve.dedupe is missing required dependencies. Should include: react, react-dom, react-router-dom',
               severity: 'warning',
               fix: 'Update resolve.dedupe to include: [\'react\', \'react-dom\', \'react-router-dom\']',
+              standardSection: 'Tech Stack Configuration (Vite Configuration)',
             });
           }
         }
@@ -319,6 +333,7 @@ function checkViteConfig(consumingAppPath) {
       message: 'vite.config.ts missing resolve.dedupe. Should dedupe React dependencies to prevent context mismatches.',
       severity: 'warning',
       fix: 'Add: resolve: { dedupe: [\'react\', \'react-dom\', \'react-router-dom\'] }',
+      standardSection: 'Tech Stack Configuration (Vite Configuration)',
     });
   }
   
@@ -328,9 +343,10 @@ function checkViteConfig(consumingAppPath) {
 /**
  * Run audit for Standard 7: API & Tech Stack
  * @param {string} consumingAppPath - Path to consuming app
+ * @param {{ isPaceCorePackage?: boolean }} [auditContext] - Optional context (peerDeps satisfy required deps when package is pace-core)
  * @returns {object} - Audit results with issues array
  */
-function runStandard7Audit(consumingAppPath) {
+function runStandard7Audit(consumingAppPath, auditContext = {}) {
   const issues = [];
   
   try {

package/audit-tool/audits/08-testing-documentation.cjs

@@ -47,6 +47,7 @@ function checkTestTimeoutConfig(consumingAppPath) {
           message: 'vitest.config.ts missing test timeout configuration. Tests may hang indefinitely without timeouts.',
           severity: 'error',
           fix: 'Add: test: { testTimeout: 10000, hookTimeout: 10000, teardownTimeout: 5000 }',
+          standardSection: 'Test Timeouts',
         });
       }
     }
@@ -74,6 +75,7 @@ function checkTestTimeoutConfig(consumingAppPath) {
           message: 'Test scripts missing timeout configuration. Tests may hang indefinitely without timeouts.',
           severity: 'error',
           fix: 'Add --test-timeout=10000 to test scripts or configure in vitest.config.ts',
+          standardSection: 'Test Timeouts',
         });
       }
     } catch (error) {
@@ -125,6 +127,7 @@ function checkTestingTools(consumingAppPath) {
         message: `Missing required testing tool: ${name} (${description})`,
         severity: 'warning',
         fix: `Install: npm install --save-dev ${name}`,
+        standardSection: 'Testing Tools',
       });
     }
   });
@@ -165,6 +168,7 @@ function checkTestStructure(consumingAppPath) {
         message: 'Test file uses .spec extension. Should use .test extension for consistency.',
         severity: 'warning',
         fix: `Rename to ${testFile.replace('.spec.', '.test.')}`,
+        standardSection: 'Test Structure / Test File Naming',
       });
     }
   });
@@ -175,14 +179,18 @@ function checkTestStructure(consumingAppPath) {
 /**
  * Run audit for Standard 8: Testing & Documentation
  * @param {string} consumingAppPath - Path to consuming app
+ * @param {{ isPaceCorePackage?: boolean }} [auditContext] - When isPaceCorePackage, skip checkTestingTools (vitest may be at workspace root)
  * @returns {object} - Audit results with issues array
  */
-function runStandard8Audit(consumingAppPath) {
+function runStandard8Audit(consumingAppPath, auditContext = {}) {
   const issues = [];
-  
+  const isPaceCorePackage = auditContext.isPaceCorePackage === true;
+
   try {
     issues.push(...checkTestTimeoutConfig(consumingAppPath));
-    issues.push(...checkTestingTools(consumingAppPath));
+    if (!isPaceCorePackage) {
+      issues.push(...checkTestingTools(consumingAppPath));
+    }
     issues.push(...checkTestStructure(consumingAppPath));
   } catch (error) {
     return {