@schneiderjoseph/devia 0.1.0

package/rules/security/SEC-011.md

@@ -0,0 +1,40 @@
+---
+id: SEC-011
+title: Dependency and secret scanning run in CI
+severity: MUST
+status: active
+domain: security
+priority: P1
+source:
+  - OpenSSF Scorecard
+  - OWASP ASVS 5.0 V14
+applies_to:
+  - repository
+success_criteria:
+  []
+requirement: >
+  CI MUST run a dependency audit and a secret scan on every pull request, and MUST fail the build on a known critical finding unless a human records an explicit, time-bounded acceptance.
+validation:
+  automated: true
+  manual: false
+exceptions: documented-only
+---
+
+# SEC-011 — Dependency and secret scanning run in CI
+
+**Requirement:** CI MUST run a dependency audit and a secret scan on every pull request, and MUST fail the build on a known critical finding unless a human records an explicit, time-bounded acceptance.
+
+**Bad:** The audit runs weekly by email and nobody reads it.
+
+**Good:** The audit is a required check; a critical advisory blocks the merge.
+
+## Validation
+
+- The workflow contains both jobs
+- Both are required checks in branch protection
+
+## Lifecycle
+
+- Status: `active`
+- Priority: `P1`
+- Exceptions: `documented-only`

package/rules/security/SEC-012.md

@@ -0,0 +1,40 @@
+---
+id: SEC-012
+title: Credentials are stored irreversibly and compared safely
+severity: MUST
+status: active
+domain: security
+priority: P0
+source:
+  - OWASP ASVS 5.0 V6
+applies_to:
+  - service
+  - database
+success_criteria:
+  []
+requirement: >
+  Passwords MUST be stored with a current memory-hard hash (argon2id or bcrypt with a modern cost). API tokens MUST be stored hashed. Secret comparisons MUST be constant time.
+validation:
+  automated: false
+  manual: true
+exceptions: none
+---
+
+# SEC-012 — Credentials are stored irreversibly and compared safely
+
+**Requirement:** Passwords MUST be stored with a current memory-hard hash (argon2id or bcrypt with a modern cost). API tokens MUST be stored hashed. Secret comparisons MUST be constant time.
+
+**Bad:** SHA-256 without a salt, or `token === storedToken`.
+
+**Good:** argon2id with per-credential salt; tokens stored as hashes; comparisons use a timing-safe function.
+
+## Validation
+
+- Read the hashing configuration
+- Confirm no reversible storage of a credential
+
+## Lifecycle
+
+- Status: `active`
+- Priority: `P0`
+- Exceptions: `none`

package/rules/states/STATE-001.md

@@ -0,0 +1,38 @@
+---
+id: STATE-001
+title: Interaction state set
+severity: MUST
+status: active
+priority: P1
+domain: states
+source:
+  - devia
+applies_to:
+  - components
+success_criteria:
+  []
+requirement: >
+  Interactive components MUST define default, hover (if pointer), focus-visible, active, and disabled as applicable.
+validation:
+  automated: false
+  manual: true
+exceptions: documented-only
+---
+
+# STATE-001 — Interaction state set
+
+**Requirement:** Interactive components MUST define default, hover (if pointer), focus-visible, active, and disabled as applicable.
+
+**Bad:** Only default styles shipped.
+
+**Good:** Full interaction matrix in component spec.
+
+## Validation
+
+- Design or engineering review
+
+## Lifecycle
+
+- Status: `active`
+- Priority: `P1`
+- Exceptions: `documented-only`

package/rules/states/STATE-002.md

@@ -0,0 +1,39 @@
+---
+id: STATE-002
+title: Async outcome states
+severity: MUST
+status: active
+priority: P1
+domain: states
+source:
+  - NN/g
+applies_to:
+  - async
+  - forms
+success_criteria:
+  []
+requirement: >
+  Async operations MUST expose pending, success, and failure (with retry when safe).
+validation:
+  automated: false
+  manual: true
+exceptions: documented-only
+---
+
+# STATE-002 — Async outcome states
+
+**Requirement:** Async operations MUST expose pending, success, and failure (with retry when safe).
+
+**Bad:** Spinner forever on failure.
+
+**Good:** Error + Retry.
+
+## Validation
+
+- Design or engineering review
+
+## Lifecycle
+
+- Status: `active`
+- Priority: `P1`
+- Exceptions: `documented-only`

package/rules/states/STATE-003.md

@@ -0,0 +1,39 @@
+---
+id: STATE-003
+title: Permission-denied and read-only
+severity: MUST
+status: active
+priority: P1
+domain: states
+source:
+  - NN/g
+applies_to:
+  - page
+  - forms
+success_criteria:
+  []
+requirement: >
+  When the user lacks permission, the UI MUST explain denial (not a blank/broken page).
+validation:
+  automated: false
+  manual: true
+exceptions: documented-only
+---
+
+# STATE-003 — Permission-denied and read-only
+
+**Requirement:** When the user lacks permission, the UI MUST explain denial (not a blank/broken page).
+
+**Bad:** Empty screen for forbidden resource.
+
+**Good:** Permission denied message + next step.
+
+## Validation
+
+- Design or engineering review
+
+## Lifecycle
+
+- Status: `active`
+- Priority: `P1`
+- Exceptions: `documented-only`

package/rules/states/STATE-004.md

@@ -0,0 +1,38 @@
+---
+id: STATE-004
+title: Unsaved changes
+severity: SHOULD
+status: active
+priority: P2
+domain: states
+source:
+  - NN/g
+applies_to:
+  - forms
+success_criteria:
+  []
+requirement: >
+  Views with unsaved edits SHOULD warn before destructive navigation.
+validation:
+  automated: false
+  manual: true
+exceptions: documented-only
+---
+
+# STATE-004 — Unsaved changes
+
+**Requirement:** Views with unsaved edits SHOULD warn before destructive navigation.
+
+**Bad:** Back discards form silently.
+
+**Good:** Leave without saving? confirm.
+
+## Validation
+
+- Design or engineering review
+
+## Lifecycle
+
+- Status: `active`
+- Priority: `P2`
+- Exceptions: `documented-only`

package/rules/testing/TST-001.md

@@ -0,0 +1,39 @@
+---
+id: TST-001
+title: Business rules are covered by automated tests
+severity: MUST
+status: active
+domain: testing
+priority: P0
+source:
+  - devia
+applies_to:
+  - repository
+success_criteria:
+  []
+requirement: >
+  Every rule that decides money, access, state transitions or eligibility MUST have an automated test, including the boundary and the refusal path — not only the happy case.
+validation:
+  automated: true
+  manual: true
+exceptions: none
+---
+
+# TST-001 — Business rules are covered by automated tests
+
+**Requirement:** Every rule that decides money, access, state transitions or eligibility MUST have an automated test, including the boundary and the refusal path — not only the happy case.
+
+**Bad:** A discount rule with one test that proves it applies, and none that prove it stops applying.
+
+**Good:** Tests for below, at, and above the threshold, plus the rejection path.
+
+## Validation
+
+- The rule's boundaries appear in the test names
+- The test fails when the rule is inverted
+
+## Lifecycle
+
+- Status: `active`
+- Priority: `P0`
+- Exceptions: `none`

package/rules/testing/TST-002.md

@@ -0,0 +1,39 @@
+---
+id: TST-002
+title: Authorization and isolation paths are tested
+severity: MUST
+status: active
+domain: testing
+priority: P0
+source:
+  - OWASP ASVS 5.0 V4
+applies_to:
+  - repository
+success_criteria:
+  []
+requirement: >
+  Tests MUST prove that an unauthorized actor is refused and that one tenant cannot reach another's data. Absence of such a test is a P0 gap even when the code looks correct.
+validation:
+  automated: false
+  manual: true
+exceptions: none
+---
+
+# TST-002 — Authorization and isolation paths are tested
+
+**Requirement:** Tests MUST prove that an unauthorized actor is refused and that one tenant cannot reach another's data. Absence of such a test is a P0 gap even when the code looks correct.
+
+**Bad:** Only the authenticated-happy-path is tested; the 403 case is assumed.
+
+**Good:** A test per sensitive route asserting 401/403, plus a cross-tenant read and write test.
+
+## Validation
+
+- Refusal tests exist for the routes touched
+- Cross-tenant tests exist
+
+## Lifecycle
+
+- Status: `active`
+- Priority: `P0`
+- Exceptions: `none`

package/rules/testing/TST-003.md

@@ -0,0 +1,39 @@
+---
+id: TST-003
+title: Never disable or weaken a test to make CI pass
+severity: MUST NOT
+status: active
+domain: testing
+priority: P0
+source:
+  - devia
+applies_to:
+  - repository
+success_criteria:
+  []
+requirement: >
+  Skipping, deleting, loosening an assertion, or widening a tolerance to turn CI green is forbidden. Either fix the code, or record the failure as debt and stop.
+validation:
+  automated: true
+  manual: true
+exceptions: none
+---
+
+# TST-003 — Never disable or weaken a test to make CI pass
+
+**Requirement:** Skipping, deleting, loosening an assertion, or widening a tolerance to turn CI green is forbidden. Either fix the code, or record the failure as debt and stop.
+
+**Bad:** `it.skip` added in the same commit as the feature that broke it.
+
+**Good:** The regression is fixed, or the change is reverted and a debt line is opened.
+
+## Validation
+
+- Diff contains no new skip, `only`, or removed assertion
+- Coverage did not drop silently
+
+## Lifecycle
+
+- Status: `active`
+- Priority: `P0`
+- Exceptions: `none`

package/rules/testing/TST-004.md

@@ -0,0 +1,38 @@
+---
+id: TST-004
+title: Every bug fix ships with a regression test
+severity: MUST
+status: active
+domain: testing
+priority: P1
+source:
+  - devia
+applies_to:
+  - repository
+success_criteria:
+  []
+requirement: >
+  A defect fix MUST include a test that fails before the fix and passes after it.
+validation:
+  automated: false
+  manual: true
+exceptions: documented-only
+---
+
+# TST-004 — Every bug fix ships with a regression test
+
+**Requirement:** A defect fix MUST include a test that fails before the fix and passes after it.
+
+**Bad:** A one-line fix with the note 'tested manually'.
+
+**Good:** A test reproducing the reported input, committed with the fix.
+
+## Validation
+
+- The test fails when the fix is reverted
+
+## Lifecycle
+
+- Status: `active`
+- Priority: `P1`
+- Exceptions: `documented-only`

package/rules/testing/TST-005.md

@@ -0,0 +1,40 @@
+---
+id: TST-005
+title: Critical journeys are covered end to end
+severity: SHOULD
+status: active
+domain: testing
+priority: P2
+source:
+  - devia
+applies_to:
+  - web
+  - api
+success_criteria:
+  []
+requirement: >
+  The few journeys the product cannot afford to break — sign in, pay, submit, export — SHOULD have an end-to-end test that exercises the real stack.
+validation:
+  automated: false
+  manual: true
+exceptions: documented-only
+---
+
+# TST-005 — Critical journeys are covered end to end
+
+**Requirement:** The few journeys the product cannot afford to break — sign in, pay, submit, export — SHOULD have an end-to-end test that exercises the real stack.
+
+**Bad:** Thorough unit tests and a checkout that has never been driven end to end.
+
+**Good:** One end-to-end test per critical journey, run before release.
+
+## Validation
+
+- The journey list exists in `.devia/05_FLOWS.md`
+- Each has a test or a named manual step
+
+## Lifecycle
+
+- Status: `active`
+- Priority: `P2`
+- Exceptions: `documented-only`

package/rules/testing/TST-006.md

@@ -0,0 +1,39 @@
+---
+id: TST-006
+title: Tests are deterministic and independent
+severity: MUST
+status: active
+domain: testing
+priority: P1
+source:
+  - devia
+applies_to:
+  - repository
+success_criteria:
+  []
+requirement: >
+  Tests MUST NOT depend on execution order, wall-clock time, network access, or state left by another test. A flaky test is fixed or removed, never retried into green.
+validation:
+  automated: true
+  manual: true
+exceptions: documented-only
+---
+
+# TST-006 — Tests are deterministic and independent
+
+**Requirement:** Tests MUST NOT depend on execution order, wall-clock time, network access, or state left by another test. A flaky test is fixed or removed, never retried into green.
+
+**Bad:** A test that passes locally and fails in CI because it assumes today's date.
+
+**Good:** Time and randomness are injected; each test sets up and tears down its own data.
+
+## Validation
+
+- Run the suite twice in a different order
+- No retry loop hides a flake
+
+## Lifecycle
+
+- Status: `active`
+- Priority: `P1`
+- Exceptions: `documented-only`

package/rules/ui/UI-001.md

@@ -0,0 +1,40 @@
+---
+id: UI-001
+title: Type from tokens
+severity: MUST
+status: active
+priority: P1
+domain: ui
+source:
+  - Carbon
+  - Material
+applies_to:
+  - typography
+success_criteria:
+  []
+requirement: >
+  UI text sizes/weights/line-heights MUST use design tokens (or the system type scale), not random px values.
+validation:
+  automated: true
+  manual: true
+exceptions: documented-only
+---
+
+# UI-001 — Type from tokens
+
+**Requirement:** UI text sizes/weights/line-heights MUST use design tokens (or the system type scale), not random px values.
+
+**Bad:** font-size: 13.5px inline on one card.
+
+**Good:** --font-size-sm / role token.
+
+## Validation
+
+- Automated checks / lint / a11y tooling where applicable
+- Design or engineering review
+
+## Lifecycle
+
+- Status: `active`
+- Priority: `P1`
+- Exceptions: `documented-only`

package/rules/ui/UI-002.md

@@ -0,0 +1,38 @@
+---
+id: UI-002
+title: Readable body measure
+severity: SHOULD
+status: active
+priority: P2
+domain: ui
+source:
+  - NN/g
+applies_to:
+  - typography
+success_criteria:
+  []
+requirement: >
+  Long-form reading SHOULD keep a comfortable line length (roughly 45–75 characters where practical).
+validation:
+  automated: false
+  manual: true
+exceptions: documented-only
+---
+
+# UI-002 — Readable body measure
+
+**Requirement:** Long-form reading SHOULD keep a comfortable line length (roughly 45–75 characters where practical).
+
+**Bad:** Full-bleed 200-char lines of body text.
+
+**Good:** Constrained content width for articles/help.
+
+## Validation
+
+- Design or engineering review
+
+## Lifecycle
+
+- Status: `active`
+- Priority: `P2`
+- Exceptions: `documented-only`

package/rules/ui/UI-003.md

@@ -0,0 +1,41 @@
+---
+id: UI-003
+title: Semantic tokens over raw hex
+severity: MUST
+status: active
+priority: P1
+domain: ui
+source:
+  - DTCG
+  - Carbon
+applies_to:
+  - color
+  - components
+success_criteria:
+  []
+requirement: >
+  Product UI MUST consume semantic tokens, not scattered raw hex (except in token definitions).
+validation:
+  automated: true
+  manual: true
+exceptions: documented-only
+---
+
+# UI-003 — Semantic tokens over raw hex
+
+**Requirement:** Product UI MUST consume semantic tokens, not scattered raw hex (except in token definitions).
+
+**Bad:** #ff3b30 hard-coded in 12 components.
+
+**Good:** Components reference danger / primary tokens.
+
+## Validation
+
+- Automated checks / lint / a11y tooling where applicable
+- Design or engineering review
+
+## Lifecycle
+
+- Status: `active`
+- Priority: `P1`
+- Exceptions: `documented-only`

package/rules/ui/UI-004.md

@@ -0,0 +1,41 @@
+---
+id: UI-004
+title: Not color alone
+severity: MUST
+status: active
+priority: P0
+domain: ui
+source:
+  - WCAG-2.2
+applies_to:
+  - status
+  - forms
+  - charts
+success_criteria:
+  - "1.4.1"
+requirement: >
+  Status and meaning MUST NOT be conveyed by color alone.
+validation:
+  automated: true
+  manual: true
+exceptions: documented-only
+---
+
+# UI-004 — Not color alone
+
+**Requirement:** Status and meaning MUST NOT be conveyed by color alone.
+
+**Bad:** Red/green dots only for status.
+
+**Good:** Color + text/icon/pattern.
+
+## Validation
+
+- Automated checks / lint / a11y tooling where applicable
+- Design or engineering review
+
+## Lifecycle
+
+- Status: `active`
+- Priority: `P0`
+- Exceptions: `documented-only`

package/rules/ui/UI-005.md

@@ -0,0 +1,41 @@
+---
+id: UI-005
+title: Spacing scale
+severity: MUST
+status: active
+priority: P1
+domain: ui
+source:
+  - Carbon
+  - Material
+applies_to:
+  - layout
+  - components
+success_criteria:
+  []
+requirement: >
+  Spacing MUST use the system scale (e.g. 4/8-based tokens), not arbitrary values.
+validation:
+  automated: true
+  manual: true
+exceptions: documented-only
+---
+
+# UI-005 — Spacing scale
+
+**Requirement:** Spacing MUST use the system scale (e.g. 4/8-based tokens), not arbitrary values.
+
+**Bad:** margin: 13px 7px.
+
+**Good:** space.3 / --space-3.
+
+## Validation
+
+- Automated checks / lint / a11y tooling where applicable
+- Design or engineering review
+
+## Lifecycle
+
+- Status: `active`
+- Priority: `P1`
+- Exceptions: `documented-only`