@schneiderjoseph/devia 0.1.0

package/PRINCIPLES.md

@@ -0,0 +1,110 @@
+# Principles
+
+Non-negotiable for this standard and every project that adopts it. Rules expire and get
+superseded; these do not.
+
+## Core comparisons
+
+```text
+Simple > Clever
+Explicit > Implicit
+Validated > Trusted
+Tested > Assumed
+Documented > Remembered
+Automated > Manual
+Observable > Blind
+Recoverable > Fragile
+Clear > Novel
+Accessible > Decorative
+Tokens > One-off values
+States complete > Happy path
+Evidence > Opinion
+Secure by default · Least privilege · Fail safely
+```
+
+## Memory is part of the system
+
+A project's truth lives in three places, and only one of them is cheap to keep honest:
+
+```text
+Code        — true by definition, unreadable at scale
+Docs        — long, authoritative, goes stale silently
+.devia/     — short, indexed, updated in the same change as the code
+```
+
+`.devia/` **points**, it does not duplicate. If the exact SQL lives in `docs/DATABASE.md`, the
+memory records that the table exists and where its definition is — not a second copy that will
+drift.
+
+Corollary: a memory file that is allowed to be wrong is worse than no memory file. A false
+registry line is worse than a missing one, because it is trusted.
+
+## Complexity must be earned
+
+Do not impose Redis, Kubernetes, microservices, Kafka, Elasticsearch, GraphQL, CDNs, queues,
+extra databases, service meshes or multi-region "because serious apps have them".
+
+```text
+Need demonstrated?
+    ↓
+YES → implement, record the decision (ADR)
+NO  → do not introduce the complexity
+```
+
+The same bar applies to the interface: extra navigation modes, custom components that duplicate
+system ones, motion that communicates nothing, colour tokens for "branding experiments" with no
+product need.
+
+**Use when justified. Record the decision.**
+
+## Every new dependency is a liability
+
+Before adding a library, a component, or a token, answer:
+
+| Question | Why it matters |
+|---|---|
+| Why do we need it? | Feature vs convenience |
+| Does something we already have cover this? | Drift is the default failure |
+| Security track record? | CVEs, maintainer trust |
+| Maintenance? | Last release, bus factor |
+| License? | Compatible with distribution |
+| Cost at runtime / in the bundle? | Performance is a feature |
+| Supply-chain risk? | Typosquatting, install scripts |
+| What states does it need? | Half-built UI is not a component |
+
+Adding a dependency is a product decision, not a typing shortcut.
+
+## Nothing undecided becomes a silent truth
+
+When the answer is not known, the agent does not pick one quietly and encode it. It implements a
+**declared** policy and records the open question in `.devia/11_GAPS.md`.
+
+When the answer *is* known but not built, that is not "we know about it" — it is a line in
+`.devia/12_DEBT.md`, with an ID that is never reused.
+
+## Authoritative sources over taste
+
+When taste conflicts with WCAG, ARIA APG, OWASP ASVS, or an adopted rule, the standard wins.
+Sources are listed in [`REFERENCES.md`](REFERENCES.md); they are cited, not paraphrased into
+private folklore.
+
+## Done means verified
+
+"Done" is a claim about evidence, not about effort:
+
+```text
+The change works        → tests or manual steps stated
+The change is safe      → P0 gates pass
+The change is honest    → memory updated, unverified parts named
+```
+
+Anything else is a draft.
+
+## Related
+
+- Agent behaviour: [`AGENTS.md`](AGENTS.md)
+- Memory doctrine: [`MEMORY.md`](MEMORY.md)
+- Enforcement levels: [`LEVELS.md`](LEVELS.md)
+- Maturity tiers: [`MATURITY.md`](MATURITY.md)
+- Architecture detail: [`standard/engineering/architecture/PRINCIPLES.md`](standard/engineering/architecture/PRINCIPLES.md)
+- Design hierarchy: [`standard/design/principles/design-principles.md`](standard/design/principles/design-principles.md)

package/README.md

@@ -0,0 +1,125 @@
+# devia
+
+**One standard, one memory.** Devia is the single engineering standard for building software
+with AI coding agents — and the living project memory those agents read before they touch
+anything.
+
+```text
+MEMORY (what this project is)  →  POLICY (rules)  →  CHECK (devia check)  →  ENFORCEMENT (CI)
+```
+
+Install it once, run `devia init`, and the project grows a `.devia/` folder. That folder is the
+first thing every agent reads and the last thing every change updates.
+
+## Why it exists
+
+An agent that starts cold re-derives the project on every task: it invents APIs, re-litigates
+decisions that were already made, ships a UI with no empty state, and reports "done" because the
+unit tests passed. Documentation does not fix that — documentation goes stale the moment the code
+moves.
+
+Devia fixes it with three things that reinforce each other:
+
+| | | |
+|---|---|---|
+| **Discipline** | how an agent is allowed to work | `AGENTS.md`, `rules/agent/`, `rules/memory/` |
+| **Standard** | how the software must be built | `standard/engineering/`, `standard/design/`, `rules/`, `checklists/` |
+| **Memory** | what *this* project actually is | `.devia/` in the target repo |
+
+## Quick start
+
+```bash
+npm install -D @schneiderjoseph/devia    # the binary it installs is `devia`
+npx devia init                # creates .devia/ + agent adapters
+npx devia validate            # memory integrity
+npx devia check               # production readiness (P0/P1)
+npx devia doctor              # adoption + staleness diagnosis
+```
+
+`devia init` writes:
+
+```text
+.devia/
+├── AGENTS.md            # local work contract
+├── 00_OVERVIEW.md       # what this project is, stack, modules
+├── 01_ARCHITECTURE.md   # structure, boundaries, current vs target
+├── 02_SURFACES.md       # pages / endpoints / jobs and where they live
+├── 03_DATA_MODEL.md
+├── 04_PERMISSIONS.md
+├── 05_FLOWS.md
+├── 06_INTEGRATIONS.md
+├── 07_DESIGN.md
+├── 10_NEVER_ALWAYS.md   # project rules earned from real incidents
+├── 11_GAPS.md           # registry: decided by nobody yet
+├── 12_DEBT.md           # registry: decided, not built
+├── 13_RECIPES.md        # how to do common tasks in THIS repo
+├── 14_INDEX.md          # where to find what
+├── impact-map.yaml      # change type → files that must be updated
+├── devia.json           # profile, modules, maturity target, pinned version
+└── standard/            # vendored, version-pinned copy of the standard
+```
+
+Plus adapters so every agent gets the same contract: `AGENTS.md` (universal), `CLAUDE.md`,
+`.cursor/rules/devia.mdc`, `.github/copilot-instructions.md`, `.windsurfrules`.
+
+## Rule zero
+
+```text
+Work requested on a repository
+        ↓
+.devia/ exists? ──NO──► run `devia init` FIRST
+        ↓ YES
+Read .devia/AGENTS.md → 00_OVERVIEW → the surface you are touching
+        ↓
+Work
+        ↓
+Update .devia/ in the SAME change
+```
+
+An agent that codes without reading the memory, or that ships code without updating it, has
+failed the task — not styled it differently.
+
+## What is in the box
+
+| Layer | Where | Content |
+|---|---|---|
+| Work contract | [`AGENTS.md`](AGENTS.md) | Workflow, hard stops, output contract |
+| Principles | [`PRINCIPLES.md`](PRINCIPLES.md) | Simple > clever, complexity earned, dependency liability, evidence > opinion |
+| Memory doctrine | [`MEMORY.md`](MEMORY.md) | Registries, sweep discipline, impact map, staleness |
+| Rules | [`rules/`](rules/README.md) | 138 rules with stable IDs, severity, priority, validation |
+| Engineering | [`standard/engineering/`](standard/engineering/README.md) | Architecture, security (ASVS 5.0), database, API, testing, devops, observability, privacy, payments, AI |
+| Design | [`standard/design/`](standard/design/README.md) | UX, UI, accessibility (WCAG 2.2), states, components, data display, i18n, responsive, anti-patterns |
+| Checklists | [`checklists/`](checklists/README.md) | Engineering + design review gates |
+| Levels | [`LEVELS.md`](LEVELS.md) | Policy → Check → Enforcement |
+| Maturity | [`MATURITY.md`](MATURITY.md) | P0–P3, Bronze → Platinum |
+| Skill pack | [`skills/devia/SKILL.md`](skills/devia/SKILL.md) | Same contract for Cursor, Claude Code, Copilot, Windsurf, Aider |
+
+## Severity and priority
+
+```text
+Rules:    MUST · MUST NOT · SHOULD · MAY
+Gates:    P0 blocker · P1 required · P2 recommended · P3 optional
+Tiers:    Bronze → Silver → Gold (production-ready) → Platinum
+```
+
+A rule without a check is aspirational. A check without CI enforcement is a suggestion.
+See [`LEVELS.md`](LEVELS.md).
+
+## Consolidation
+
+Devia absorbs and replaces two earlier standards:
+
+- `production-app-standard` → [`standard/engineering/`](standard/engineering/README.md)
+- `design-system-standard` → [`standard/design/`](standard/design/README.md) + design rule IDs
+
+Only devia is maintained. See [`MIGRATION.md`](MIGRATION.md).
+
+## Stack assumption
+
+Written primarily for Node.js / TypeScript, PostgreSQL, React, Docker and GitHub Actions.
+The rules transfer to any stack; the commands may need adaptation. The memory layer is
+stack-agnostic by construction.
+
+## License
+
+MIT — see [`LICENSE`](LICENSE).

package/REFERENCES.md

@@ -0,0 +1,30 @@
+# Reference sources
+
+Devia is built on recognised sources. When detail matters, read the primary document — do not
+paraphrase from memory, and do not copy their text into this repository.
+
+| Area | Source | Used for |
+|---|---|---|
+| Application security | OWASP ASVS 5.0 | Security rule spine, `standard/engineering/security/ASVS_5.0/` |
+| Web risk | OWASP Top 10, OWASP Cheat Sheets | Threat framing, control choices |
+| Accessibility | WCAG 2.2 (W3C) | `A11Y-*` rules, contrast, focus, target size, reflow |
+| Accessible patterns | WAI-ARIA Authoring Practices Guide | Component keyboard behaviour (`CMP-*`) |
+| Usability | Nielsen Norman Group heuristics | `UX-*` rules, feedback and status |
+| Design systems | Material, Carbon, Primer, Atlassian, US Web Design System, GOV.UK | Component and token conventions |
+| Semantics | HTML Living Standard, ARIA in HTML | Native-first guidance (`A11Y-003`) |
+| Supply chain | SLSA, OpenSSF Scorecard | Dependency and build controls |
+| Operations | Google SRE practice (SLO, error budgets) | Observability and alerting rules |
+| Privacy | GDPR principles, data-minimisation practice | `PRIV-*` rules |
+
+Detail lists:
+
+- Engineering: [`standard/engineering/REFERENCES.md`](standard/engineering/REFERENCES.md)
+- Design: [`standard/design/REFERENCES.md`](standard/design/REFERENCES.md)
+
+## Rules for citing
+
+- A rule carries at least one `source` entry naming where the obligation comes from.
+- Cite the source, link to it, and write the requirement in your own words.
+- Where devia is stricter than a source, say so in the rule body rather than implying the
+  source demands it.
+- Devia interprets these standards; it does not certify against them.

package/VERSION

@@ -0,0 +1,5 @@
+standard_version: 0.1.0
+rule_schema_version: 1
+token_schema_version: 1
+memory_schema_version: 1
+cli_contract_version: 1

package/bin/devia.mjs

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+import process from "node:process";
+import { run } from "../src/cli.mjs";
+
+run(process.argv.slice(2))
+  .then((code) => {
+    process.exitCode = code || 0;
+  })
+  .catch((err) => {
+    console.error(`devia: ${err?.message || err}`);
+    if (process.env.DEVIA_DEBUG) console.error(err);
+    process.exitCode = 1;
+  });

package/checklists/README.md

@@ -0,0 +1,39 @@
+# Checklists
+
+Walk the checklist for the surface you touched before you claim the work is done. A checklist is
+the human-readable form of the gates in [`../MATURITY.md`](../MATURITY.md); the machine-readable
+form is `devia check`.
+
+## Engineering
+
+| Checklist | Use when |
+|---|---|
+| [`engineering/architecture.md`](engineering/architecture.md) | Adding a boundary, a service, a dependency |
+| [`engineering/security.md`](engineering/security.md) | Any auth, data-access or input-handling change |
+| [`engineering/database.md`](engineering/database.md) | Schema, migration, index, retention |
+| [`engineering/api.md`](engineering/api.md) | New or changed endpoint |
+| [`engineering/frontend.md`](engineering/frontend.md) | Client-side engineering |
+| [`engineering/accessibility.md`](engineering/accessibility.md) | Any user-facing surface |
+| [`engineering/testing.md`](engineering/testing.md) | Before calling coverage sufficient |
+| [`engineering/devops.md`](engineering/devops.md) | Pipeline, environment, deploy |
+| [`engineering/performance.md`](engineering/performance.md) | Latency, payload, query cost |
+| [`engineering/incident.md`](engineering/incident.md) | During and after an incident |
+| [`engineering/disaster-recovery.md`](engineering/disaster-recovery.md) | Backup and restore work |
+| [`engineering/release.md`](engineering/release.md) | Definition of done for a feature |
+| [`engineering/production.md`](engineering/production.md) | Before claiming production ready |
+
+## Design
+
+| Checklist | Use when |
+|---|---|
+| [`design/ux-review.md`](design/ux-review.md) | Flow, journey or IA change |
+| [`design/ui-review.md`](design/ui-review.md) | Visual change |
+| [`design/accessibility-review.md`](design/accessibility-review.md) | Any interface change |
+| [`design/responsive-review.md`](design/responsive-review.md) | Layout across sizes and inputs |
+| [`design/design-to-code-review.md`](design/design-to-code-review.md) | Implementing a design |
+
+## Rules for using them
+
+- A checklist item you did not check is **not verified**, and says so in the report.
+- An item that does not apply is marked not applicable with a reason — never silently dropped.
+- An item that keeps not applying is a bug in the checklist: fix the checklist.

package/checklists/design/accessibility-review.md

@@ -0,0 +1,11 @@
+# Checklist — Accessibility review
+
+- [ ] Keyboard complete for the flow
+- [ ] Visible focus
+- [ ] Names/labels
+- [ ] Contrast AA (text + UI)
+- [ ] Not color-only
+- [ ] Forms: labels, errors, required
+- [ ] Dialogs: APG behavior
+- [ ] Skip/landmarks as needed
+- [ ] Reduced motion respected

package/checklists/design/design-to-code-review.md

@@ -0,0 +1,10 @@
+# Checklist — Design → code handoff
+
+- [ ] Token names specified (not only hex screenshots)
+- [ ] Component names match system
+- [ ] States documented
+- [ ] A11y notes (keyboard, names)
+- [ ] Responsive behavior noted
+- [ ] Empty/loading/error included
+- [ ] Content finalized or marked TBD
+- [ ] MUST rules reviewed (`AGENTS.md` output contract)

package/checklists/design/responsive-review.md

@@ -0,0 +1,7 @@
+# Checklist — Responsive review
+
+- [ ] 320px core flow usable
+- [ ] Tablet acceptable
+- [ ] Desktop density appropriate
+- [ ] Touch targets adequate
+- [ ] Tables/actions strategy on small screens

package/checklists/design/ui-review.md

@@ -0,0 +1,8 @@
+# Checklist — UI review
+
+- [ ] Uses tokens (color, type, space, radius)
+- [ ] Hierarchy clear
+- [ ] Component variants from system
+- [ ] Consistent alignment/spacing
+- [ ] Imagery/icons correct
+- [ ] No one-off chrome without justification

package/checklists/design/ux-review.md

@@ -0,0 +1,10 @@
+# Checklist — UX review
+
+- [ ] Primary user job clear
+- [ ] Primary action clear
+- [ ] Happy path + failure path
+- [ ] Empty / loading / error states
+- [ ] Irreversible actions confirmed
+- [ ] Nav orientation clear
+- [ ] Copy understandable
+- [ ] Cognitive load acceptable

package/checklists/engineering/accessibility.md

@@ -0,0 +1,8 @@
+# Checklist — Accessibility
+
+- [ ] Keyboard completes primary flows
+- [ ] Accessible names on controls
+- [ ] Alt text where needed
+- [ ] Focus management for dialogs
+- [ ] Contrast reviewed on primary UI
+- [ ] Not color-only status indicators

package/checklists/engineering/api.md

@@ -0,0 +1,12 @@
+# Checklist — API
+
+- [ ] AuthN + AuthZ on sensitive endpoints
+- [ ] Schema validation
+- [ ] Consistent error codes/shape
+- [ ] Correct HTTP statuses
+- [ ] Pagination on large collections
+- [ ] Rate limiting where needed
+- [ ] Idempotency for critical POSTs
+- [ ] Webhook signature verification
+- [ ] OpenAPI/docs updated if public
+- [ ] Request/correlation IDs

package/checklists/engineering/architecture.md

@@ -0,0 +1,8 @@
+# Checklist — Architecture
+
+- [ ] Problem, users, and sensitive data identified
+- [ ] UI / API / DB boundaries clear
+- [ ] Critical components & SPOFs identified
+- [ ] Recovery approach exists for critical failures
+- [ ] ADRs for irreversible decisions
+- [ ] Architecture doc updated for this change

package/checklists/engineering/database.md

@@ -0,0 +1,11 @@
+# Checklist — Database
+
+- [ ] Schema constraints (PK/FK/unique/check) in place
+- [ ] Indexes reviewed for hot queries
+- [ ] Migrations versioned
+- [ ] No manual prod schema edits
+- [ ] N+1 / slow queries considered
+- [ ] Connection pooling configured
+- [ ] Backup automated
+- [ ] Restore tested
+- [ ] Tenant/user scoping verified

package/checklists/engineering/devops.md

@@ -0,0 +1,9 @@
+# Checklist — DevOps
+
+- [ ] PR required for `main`
+- [ ] CI required checks green
+- [ ] Dependency/secret scanning considered
+- [ ] Staging environment exists for risky changes
+- [ ] Deploy path documented
+- [ ] Rollback path known
+- [ ] Env vars documented

package/checklists/engineering/disaster-recovery.md

@@ -0,0 +1,9 @@
+# Checklist — Disaster recovery
+
+- [ ] RPO defined
+- [ ] RTO defined
+- [ ] Backup inventory listed (DB/files/config)
+- [ ] Restore procedure documented
+- [ ] Restore tested within last agreed interval
+- [ ] Failover/owner contacts documented
+- [ ] Post-restore verification checklist exists

package/checklists/engineering/frontend.md

@@ -0,0 +1,9 @@
+# Checklist — Frontend
+
+- [ ] Loading/empty/error/success states
+- [ ] Form validation + server error display
+- [ ] Responsive for claimed devices
+- [ ] No secrets in client
+- [ ] XSS-safe rendering
+- [ ] Destructive action confirmations
+- [ ] Error boundary/fallback for shell

package/checklists/engineering/incident.md

@@ -0,0 +1,9 @@
+# Checklist — Incident response
+
+- [ ] Impact assessed (users/payments/data)
+- [ ] Mitigation applied (rollback/flag/patch)
+- [ ] Stakeholders/users informed if needed
+- [ ] Timeline captured
+- [ ] Root cause identified (best effort)
+- [ ] Follow-up tasks filed with owners
+- [ ] Monitoring/alerts improved if detection was slow

package/checklists/engineering/performance.md

@@ -0,0 +1,7 @@
+# Checklist — Performance
+
+- [ ] Latency targets defined for critical endpoints
+- [ ] Heavy work queued off request path when needed
+- [ ] Hot queries profiled/indexed
+- [ ] Caching deliberate (with invalidation idea)
+- [ ] Load test before large traffic events

package/checklists/engineering/production.md

@@ -0,0 +1,26 @@
+# Checklist — Production readiness
+
+You may call it production only if you can honestly check these:
+
+- [ ] Security reviewed (authn/authz/secrets/headers)
+- [ ] Authentication tested
+- [ ] Authorization tested (incl. cross-user/tenant)
+- [ ] Database migrations tested
+- [ ] Backup tested
+- [ ] Restore tested
+- [ ] Monitoring active
+- [ ] Alerts active
+- [ ] Error tracking active
+- [ ] Logging active
+- [ ] CI green
+- [ ] Critical E2E/smoke green
+- [ ] Dependencies audited
+- [ ] Secrets secured
+- [ ] HTTPS active
+- [ ] Rate limiting active on abuse surfaces
+- [ ] Rollback tested or feature-flag kill switch ready
+- [ ] Documentation sufficient for operation
+- [ ] Environment variables documented
+- [ ] Privacy requirements reviewed for this product
+- [ ] Disaster recovery notes exist
+- [ ] Critical business workflows tested

package/checklists/engineering/release.md

@@ -0,0 +1,17 @@
+# Checklist — Feature Definition of Done
+
+- [ ] Requirement understood
+- [ ] Business rules documented when non-obvious
+- [ ] Architecture impact reviewed
+- [ ] DB changes migrated
+- [ ] API documented if contract changed
+- [ ] Authorization implemented
+- [ ] Validation implemented
+- [ ] Error handling implemented
+- [ ] Logging considered
+- [ ] Tests written/updated
+- [ ] Security reviewed for the touch area
+- [ ] Accessibility considered for UI
+- [ ] Docs updated
+- [ ] CI passing
+- [ ] Code reviewed (human)

package/checklists/engineering/security.md

@@ -0,0 +1,33 @@
+# Checklist — Security
+
+## AuthN / AuthZ
+- [ ] Authentication implemented correctly
+- [ ] Authorization verified server-side
+- [ ] Object-level authorization (no IDOR)
+- [ ] Passwords hashed with approved algorithm
+- [ ] Session/token expiration & revocation work
+- [ ] Brute-force protections on auth endpoints
+
+## Input / output
+- [ ] Input validation on every external input
+- [ ] SQL injection protection (parameterized queries)
+- [ ] XSS protection
+- [ ] CSRF protection where applicable
+- [ ] Upload limits / type checks if uploads exist
+
+## Secrets / config
+- [ ] No secrets in source code
+- [ ] `.env` ignored; `.env.example` present
+- [ ] Credentials separated by environment
+- [ ] Secret scanning enabled when possible
+
+## Transport / browser
+- [ ] HTTPS enforced in production
+- [ ] Secure HTTP headers (baseline)
+- [ ] CORS correctly configured
+- [ ] Cookies Secure/HttpOnly/SameSite as applicable
+- [ ] Rate limiting on public abuse surfaces
+
+## Ops
+- [ ] Audit logging for security-relevant events
+- [ ] Dependencies audited

package/checklists/engineering/testing.md

@@ -0,0 +1,8 @@
+# Checklist — Testing
+
+- [ ] Unit tests for domain rules touched
+- [ ] Integration tests for API/DB/auth paths touched
+- [ ] Denial tests for authz on sensitive resources
+- [ ] E2E/smoke for critical journeys when UI changes
+- [ ] Regression test for fixed prod bugs
+- [ ] CI runs tests on PR

package/compliance/COVERAGE.md

@@ -0,0 +1,46 @@
+# Coverage
+
+> Generated by `npm run build:index`.
+
+| Metric | Value |
+|---|---|
+| Rules total | 138 |
+| Active | 138 |
+| MUST | 103 |
+| MUST NOT | 11 |
+| SHOULD | 24 |
+| P0 | 44 |
+| P1 | 70 |
+| P2 | 24 |
+| Automatable | 53 |
+| Domains | 23 |
+
+## By domain
+
+| Domain | Rules | P0 |
+|---|---|---|
+| accessibility | 12 | 5 |
+| agent | 11 | 6 |
+| ai | 5 | 2 |
+| api | 6 | 1 |
+| architecture | 6 | 0 |
+| components | 5 | 1 |
+| content | 1 | 0 |
+| data-display | 4 | 0 |
+| database | 8 | 5 |
+| design-system | 3 | 0 |
+| devops | 7 | 4 |
+| interaction | 2 | 0 |
+| localization | 3 | 0 |
+| memory | 11 | 3 |
+| motion | 1 | 0 |
+| observability | 4 | 0 |
+| privacy | 4 | 0 |
+| responsive | 3 | 2 |
+| security | 12 | 7 |
+| states | 4 | 0 |
+| testing | 6 | 3 |
+| ui | 7 | 2 |
+| ux | 13 | 3 |
+
+A domain with rules and no automatable check is not a failure — it is a backlog item for [`LEVELS.md`](../LEVELS.md) level 2.

package/compliance/REQUIREMENTS.md

@@ -0,0 +1,8 @@
+# Requirements model
+
+1. **Normative** sources (WCAG, ARIA) define non-negotiable accessibility bars.
+2. **This standard** maps them into rule IDs agents and CI can cite.
+3. **Checklists** operationalize reviews.
+4. **Waivers** are time-boxed exceptions (`schema/waiver.schema.json`).
+
+This repository is an **operational standard**, not an international standards body.