@schneiderjoseph/devia 0.1.0

package/compliance/TRACEABILITY.md

@@ -0,0 +1,160 @@
+# Traceability
+
+Every rule maps down to something a human or a machine can check.
+
+```text
+Rule ID
+   ↓
+Authoritative source (REFERENCES.md)
+   ↓
+Success criterion (when the source has one)
+   ↓
+Guidance in standard/
+   ↓
+Checklist item
+   ↓
+Automated check or recorded manual review
+```
+
+> Generated by `npm run build:index`.
+
+| Rule | Domain | Severity | Priority | Source | Criteria | Validation |
+|---|---|---|---|---|---|---|
+| [A11Y-001](../rules/accessibility/A11Y-001.md) | accessibility | MUST | P0 | WCAG-2.2, WAI-ARIA-APG | 4.1.2 | automated + manual |
+| [A11Y-002](../rules/accessibility/A11Y-002.md) | accessibility | MUST | P1 | WAI-ARIA-APG | — | manual |
+| [A11Y-003](../rules/accessibility/A11Y-003.md) | accessibility | SHOULD | P2 | WAI-ARIA-APG | — | manual |
+| [A11Y-004](../rules/accessibility/A11Y-004.md) | accessibility | MUST | P0 | WCAG-2.2 | 2.1.1 | automated + manual |
+| [A11Y-005](../rules/accessibility/A11Y-005.md) | accessibility | MUST | P0 | WCAG-2.2 | 2.1.2 | manual |
+| [A11Y-006](../rules/accessibility/A11Y-006.md) | accessibility | MUST | P0 | WCAG-2.2 | 2.4.7, 2.4.13 | automated + manual |
+| [A11Y-007](../rules/accessibility/A11Y-007.md) | accessibility | MUST | P1 | WAI-ARIA-APG | — | manual |
+| [A11Y-008](../rules/accessibility/A11Y-008.md) | accessibility | MUST | P0 | WCAG-2.2 | 1.4.3 | automated + manual |
+| [A11Y-009](../rules/accessibility/A11Y-009.md) | accessibility | MUST | P1 | WCAG-2.2 | 1.4.11 | automated + manual |
+| [A11Y-010](../rules/accessibility/A11Y-010.md) | accessibility | MUST | P1 | WCAG-2.2 | 2.5.8 | manual |
+| [A11Y-011](../rules/accessibility/A11Y-011.md) | accessibility | MUST | P1 | WCAG-2.2 | 1.4.10 | manual |
+| [A11Y-012](../rules/accessibility/A11Y-012.md) | accessibility | MUST | P1 | WCAG-2.2 | 2.3.3 | automated + manual |
+| [AGT-001](../rules/agent/AGT-001.md) | agent | MUST | P0 | devia | — | manual |
+| [AGT-002](../rules/agent/AGT-002.md) | agent | MUST | P0 | devia | — | automated + manual |
+| [AGT-003](../rules/agent/AGT-003.md) | agent | MUST | P1 | devia | — | automated + manual |
+| [AGT-004](../rules/agent/AGT-004.md) | agent | MUST NOT | P0 | devia | — | manual |
+| [AGT-005](../rules/agent/AGT-005.md) | agent | MUST NOT | P0 | devia | — | manual |
+| [AGT-006](../rules/agent/AGT-006.md) | agent | MUST | P0 | devia | — | manual |
+| [AGT-007](../rules/agent/AGT-007.md) | agent | MUST | P1 | devia | — | manual |
+| [AGT-008](../rules/agent/AGT-008.md) | agent | MUST | P1 | devia | — | manual |
+| [AGT-009](../rules/agent/AGT-009.md) | agent | MUST NOT | P1 | devia | — | manual |
+| [AGT-010](../rules/agent/AGT-010.md) | agent | MUST | P1 | devia | — | manual |
+| [AGT-011](../rules/agent/AGT-011.md) | agent | MUST NOT | P0 | devia | — | automated + manual |
+| [AI-001](../rules/ai/AI-001.md) | ai | MUST | P0 | OWASP LLM Top 10 | — | manual |
+| [AI-002](../rules/ai/AI-002.md) | ai | MUST | P0 | OWASP LLM Top 10 | — | automated + manual |
+| [AI-003](../rules/ai/AI-003.md) | ai | MUST | P1 | OWASP LLM Top 10 | — | automated + manual |
+| [AI-004](../rules/ai/AI-004.md) | ai | MUST | P1 | devia | — | manual |
+| [AI-005](../rules/ai/AI-005.md) | ai | SHOULD | P2 | devia | — | automated + manual |
+| [API-001](../rules/api/API-001.md) | api | MUST | P0 | OWASP ASVS 5.0 V13 | — | automated + manual |
+| [API-002](../rules/api/API-002.md) | api | MUST | P1 | devia | — | automated + manual |
+| [API-003](../rules/api/API-003.md) | api | MUST | P1 | devia | — | manual |
+| [API-004](../rules/api/API-004.md) | api | MUST | P1 | devia | — | manual |
+| [API-005](../rules/api/API-005.md) | api | MUST | P1 | devia | — | automated + manual |
+| [API-006](../rules/api/API-006.md) | api | SHOULD | P2 | devia | — | manual |
+| [ARC-001](../rules/architecture/ARC-001.md) | architecture | MUST | P1 | devia | — | manual |
+| [ARC-002](../rules/architecture/ARC-002.md) | architecture | MUST | P1 | devia | — | manual |
+| [ARC-003](../rules/architecture/ARC-003.md) | architecture | MUST | P1 | devia | — | manual |
+| [ARC-004](../rules/architecture/ARC-004.md) | architecture | MUST | P1 | devia | — | automated + manual |
+| [ARC-005](../rules/architecture/ARC-005.md) | architecture | SHOULD | P2 | devia | — | manual |
+| [ARC-006](../rules/architecture/ARC-006.md) | architecture | MUST | P1 | devia | — | automated + manual |
+| [CMP-001](../rules/components/CMP-001.md) | components | MUST | P1 | GOV.UK, Carbon | — | manual |
+| [CMP-002](../rules/components/CMP-002.md) | components | SHOULD | P2 | NN/g | — | manual |
+| [CMP-003](../rules/components/CMP-003.md) | components | MUST | P1 | WCAG-2.2 | 1.3.1 | automated + manual |
+| [CMP-004](../rules/components/CMP-004.md) | components | SHOULD | P2 | Carbon, Atlassian | — | manual |
+| [CMP-005](../rules/components/CMP-005.md) | components | MUST | P0 | WAI-ARIA-APG | — | automated + manual |
+| [CNT-001](../rules/content/CNT-001.md) | content | SHOULD | P2 | GOV.UK | — | manual |
+| [DATA-001](../rules/data-display/DATA-001.md) | data-display | MUST | P1 | i18n-best-practice | — | manual |
+| [DATA-002](../rules/data-display/DATA-002.md) | data-display | MUST | P1 | i18n-best-practice | — | manual |
+| [DATA-003](../rules/data-display/DATA-003.md) | data-display | SHOULD | P2 | Carbon, Atlassian | — | manual |
+| [DATA-004](../rules/data-display/DATA-004.md) | data-display | MUST | P1 | NN/g, Atlassian | — | manual |
+| [DB-001](../rules/database/DB-001.md) | database | MUST | P0 | devia | — | automated + manual |
+| [DB-002](../rules/database/DB-002.md) | database | MUST NOT | P0 | devia | — | manual |
+| [DB-003](../rules/database/DB-003.md) | database | MUST | P0 | devia | — | automated + manual |
+| [DB-004](../rules/database/DB-004.md) | database | MUST | P0 | devia | — | manual |
+| [DB-005](../rules/database/DB-005.md) | database | SHOULD | P2 | devia | — | manual |
+| [DB-006](../rules/database/DB-006.md) | database | SHOULD | P2 | devia | — | manual |
+| [DB-007](../rules/database/DB-007.md) | database | MUST | P1 | OWASP ASVS 5.0 V7 | — | manual |
+| [DB-008](../rules/database/DB-008.md) | database | MUST NOT | P0 | OWASP ASVS 5.0 V5 | — | automated + manual |
+| [DS-001](../rules/design-system/DS-001.md) | design-system | MUST | P1 | DTCG | — | automated + manual |
+| [DS-002](../rules/design-system/DS-002.md) | design-system | SHOULD | P2 | Carbon, DTCG | — | manual |
+| [DS-003](../rules/design-system/DS-003.md) | design-system | MUST | P1 | SemVer | — | manual |
+| [I18N-001](../rules/localization/I18N-001.md) | localization | MUST | P1 | i18n-best-practice | — | manual |
+| [I18N-002](../rules/localization/I18N-002.md) | localization | SHOULD | P2 | Material, i18n-best-practice | — | manual |
+| [I18N-003](../rules/localization/I18N-003.md) | localization | SHOULD | P2 | WCAG-2.2, Material | — | manual |
+| [INT-001](../rules/interaction/INT-001.md) | interaction | MUST | P1 | WCAG-2.2 | — | manual |
+| [INT-002](../rules/interaction/INT-002.md) | interaction | MUST | P1 | WCAG-2.2 | 2.1.1 | manual |
+| [MEM-001](../rules/memory/MEM-001.md) | memory | MUST | P0 | devia | — | manual |
+| [MEM-002](../rules/memory/MEM-002.md) | memory | MUST | P1 | devia | — | manual |
+| [MEM-003](../rules/memory/MEM-003.md) | memory | MUST | P1 | devia | — | manual |
+| [MEM-004](../rules/memory/MEM-004.md) | memory | MUST | P1 | devia | — | automated + manual |
+| [MEM-005](../rules/memory/MEM-005.md) | memory | MUST | P1 | devia | — | manual |
+| [MEM-006](../rules/memory/MEM-006.md) | memory | MUST | P1 | devia | — | manual |
+| [MEM-007](../rules/memory/MEM-007.md) | memory | MUST NOT | P1 | devia | — | automated + manual |
+| [MEM-008](../rules/memory/MEM-008.md) | memory | MUST | P1 | devia | — | manual |
+| [MEM-009](../rules/memory/MEM-009.md) | memory | MUST | P0 | devia | — | automated + manual |
+| [MEM-010](../rules/memory/MEM-010.md) | memory | SHOULD | P2 | devia | — | manual |
+| [MEM-011](../rules/memory/MEM-011.md) | memory | MUST NOT | P0 | devia | — | automated + manual |
+| [MOT-001](../rules/motion/MOT-001.md) | motion | SHOULD | P2 | Material | — | manual |
+| [OBS-001](../rules/observability/OBS-001.md) | observability | MUST | P1 | Google SRE | — | automated + manual |
+| [OBS-002](../rules/observability/OBS-002.md) | observability | MUST | P1 | Google SRE | — | automated + manual |
+| [OBS-003](../rules/observability/OBS-003.md) | observability | MUST | P1 | Google SRE | — | manual |
+| [OBS-004](../rules/observability/OBS-004.md) | observability | SHOULD | P2 | devia | — | automated + manual |
+| [OPS-001](../rules/devops/OPS-001.md) | devops | MUST | P0 | devia | — | automated |
+| [OPS-002](../rules/devops/OPS-002.md) | devops | MUST | P0 | devia | — | automated |
+| [OPS-003](../rules/devops/OPS-003.md) | devops | MUST NOT | P0 | devia | — | automated + manual |
+| [OPS-004](../rules/devops/OPS-004.md) | devops | MUST | P1 | SLSA | — | automated + manual |
+| [OPS-005](../rules/devops/OPS-005.md) | devops | MUST | P1 | devia | — | manual |
+| [OPS-006](../rules/devops/OPS-006.md) | devops | SHOULD | P2 | devia | — | manual |
+| [OPS-007](../rules/devops/OPS-007.md) | devops | MUST | P0 | devia | — | manual |
+| [PRIV-001](../rules/privacy/PRIV-001.md) | privacy | MUST | P1 | GDPR principles | — | manual |
+| [PRIV-002](../rules/privacy/PRIV-002.md) | privacy | MUST | P1 | GDPR principles | — | manual |
+| [PRIV-003](../rules/privacy/PRIV-003.md) | privacy | MUST | P1 | GDPR principles | — | manual |
+| [PRIV-004](../rules/privacy/PRIV-004.md) | privacy | MUST | P1 | GDPR principles | — | automated + manual |
+| [RWD-001](../rules/responsive/RWD-001.md) | responsive | MUST | P1 | WCAG-2.2 | — | manual |
+| [RWD-002](../rules/responsive/RWD-002.md) | responsive | MUST | P0 | WCAG-2.2 | 1.4.10 | manual |
+| [RWD-003](../rules/responsive/RWD-003.md) | responsive | MUST | P0 | WCAG-2.2 | 2.5.1 | manual |
+| [SEC-001](../rules/security/SEC-001.md) | security | MUST | P0 | OWASP ASVS 5.0 V4 | — | manual |
+| [SEC-002](../rules/security/SEC-002.md) | security | MUST NOT | P0 | OWASP ASVS 5.0 V14 | — | automated + manual |
+| [SEC-003](../rules/security/SEC-003.md) | security | MUST | P0 | OWASP ASVS 5.0 V5 | — | automated + manual |
+| [SEC-004](../rules/security/SEC-004.md) | security | MUST | P0 | OWASP ASVS 5.0 V7 | — | automated + manual |
+| [SEC-005](../rules/security/SEC-005.md) | security | MUST | P0 | OWASP ASVS 5.0 V4 | — | manual |
+| [SEC-006](../rules/security/SEC-006.md) | security | MUST | P1 | OWASP ASVS 5.0 V3 | — | manual |
+| [SEC-007](../rules/security/SEC-007.md) | security | MUST | P0 | OWASP ASVS 5.0 V13 | — | manual |
+| [SEC-008](../rules/security/SEC-008.md) | security | MUST | P1 | OWASP ASVS 5.0 V11 | — | manual |
+| [SEC-009](../rules/security/SEC-009.md) | security | MUST | P1 | OWASP ASVS 5.0 V9 | — | automated + manual |
+| [SEC-010](../rules/security/SEC-010.md) | security | MUST | P1 | OWASP ASVS 5.0 V1 | — | manual |
+| [SEC-011](../rules/security/SEC-011.md) | security | MUST | P1 | OpenSSF Scorecard, OWASP ASVS 5.0 V14 | — | automated |
+| [SEC-012](../rules/security/SEC-012.md) | security | MUST | P0 | OWASP ASVS 5.0 V6 | — | manual |
+| [STATE-001](../rules/states/STATE-001.md) | states | MUST | P1 | devia | — | manual |
+| [STATE-002](../rules/states/STATE-002.md) | states | MUST | P1 | NN/g | — | manual |
+| [STATE-003](../rules/states/STATE-003.md) | states | MUST | P1 | NN/g | — | manual |
+| [STATE-004](../rules/states/STATE-004.md) | states | SHOULD | P2 | NN/g | — | manual |
+| [TST-001](../rules/testing/TST-001.md) | testing | MUST | P0 | devia | — | automated + manual |
+| [TST-002](../rules/testing/TST-002.md) | testing | MUST | P0 | OWASP ASVS 5.0 V4 | — | manual |
+| [TST-003](../rules/testing/TST-003.md) | testing | MUST NOT | P0 | devia | — | automated + manual |
+| [TST-004](../rules/testing/TST-004.md) | testing | MUST | P1 | devia | — | manual |
+| [TST-005](../rules/testing/TST-005.md) | testing | SHOULD | P2 | devia | — | manual |
+| [TST-006](../rules/testing/TST-006.md) | testing | MUST | P1 | devia | — | automated + manual |
+| [UI-001](../rules/ui/UI-001.md) | ui | MUST | P1 | Carbon, Material | — | automated + manual |
+| [UI-002](../rules/ui/UI-002.md) | ui | SHOULD | P2 | NN/g | — | manual |
+| [UI-003](../rules/ui/UI-003.md) | ui | MUST | P1 | DTCG, Carbon | — | automated + manual |
+| [UI-004](../rules/ui/UI-004.md) | ui | MUST | P0 | WCAG-2.2 | 1.4.1 | automated + manual |
+| [UI-005](../rules/ui/UI-005.md) | ui | MUST | P1 | Carbon, Material | — | automated + manual |
+| [UI-006](../rules/ui/UI-006.md) | ui | SHOULD | P2 | Carbon, Atlassian | — | manual |
+| [UI-007](../rules/ui/UI-007.md) | ui | MUST | P0 | WCAG-2.2, WAI-ARIA-APG | 4.1.2 | automated + manual |
+| [UX-001](../rules/ux/UX-001.md) | ux | MUST | P1 | NN/g | — | manual |
+| [UX-002](../rules/ux/UX-002.md) | ux | MUST | P1 | NN/g | — | automated + manual |
+| [UX-003](../rules/ux/UX-003.md) | ux | SHOULD | P2 | NN/g, GOV.UK | — | manual |
+| [UX-004](../rules/ux/UX-004.md) | ux | SHOULD | P2 | GOV.UK | — | manual |
+| [UX-005](../rules/ux/UX-005.md) | ux | MUST | P1 | WCAG-2.2, NN/g | 2.4.8 | automated + manual |
+| [UX-006](../rules/ux/UX-006.md) | ux | MUST | P1 | WCAG-2.2 | 2.4.1 | automated + manual |
+| [UX-007](../rules/ux/UX-007.md) | ux | MUST | P0 | WCAG-2.2, GOV.UK | 1.3.1, 3.3.2 | automated + manual |
+| [UX-008](../rules/ux/UX-008.md) | ux | MUST | P0 | WCAG-2.2, GOV.UK | 3.3.1, 3.3.3 | automated + manual |
+| [UX-009](../rules/ux/UX-009.md) | ux | MUST | P1 | WCAG-2.2, GOV.UK | 1.4.1 | manual |
+| [UX-010](../rules/ux/UX-010.md) | ux | MUST | P1 | NN/g | — | manual |
+| [UX-011](../rules/ux/UX-011.md) | ux | MUST | P0 | NN/g, GOV.UK | — | manual |
+| [UX-012](../rules/ux/UX-012.md) | ux | MUST | P1 | WCAG-2.2, GOV.UK | 3.3.3 | manual |
+| [UX-013](../rules/ux/UX-013.md) | ux | SHOULD | P2 | NN/g | — | manual |

package/compliance/WAIVERS.md

@@ -0,0 +1,13 @@
+# Waivers
+
+Document exceptions with `schema/waiver.schema.json` fields:
+
+```yaml
+rule_id: A11Y-010
+reason: Legacy PDF viewer chrome; remediating Q3
+owner: @team
+expires: 2026-12-31
+risk: medium
+```
+
+Store product-specific waivers in the **application** repo, not here, unless the exception changes the standard itself.

package/package.json

@@ -0,0 +1,74 @@
+{
+  "name": "@schneiderjoseph/devia",
+  "version": "0.1.0",
+  "description": "One standard, one memory: engineering and design rules plus living project memory for AI coding agents",
+  "type": "module",
+  "license": "MIT",
+  "author": "Joseph Schneider",
+  "homepage": "https://github.com/schneiderjoseph/devia#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/schneiderjoseph/devia.git"
+  },
+  "bugs": {
+    "url": "https://github.com/schneiderjoseph/devia/issues"
+  },
+  "keywords": [
+    "standard",
+    "ai-agents",
+    "agents",
+    "project-memory",
+    "code-quality",
+    "accessibility",
+    "security",
+    "asvs",
+    "wcag",
+    "conventions"
+  ],
+  "bin": {
+    "devia": "bin/devia.mjs"
+  },
+  "exports": {
+    ".": "./src/cli.mjs",
+    "./rules": "./src/lib/rules.mjs"
+  },
+  "files": [
+    "bin",
+    "src",
+    "rules",
+    "checklists",
+    "standard",
+    "compliance",
+    "schema",
+    "templates",
+    "skills",
+    "scripts",
+    "AGENTS.md",
+    "PRINCIPLES.md",
+    "MEMORY.md",
+    "LEVELS.md",
+    "MATURITY.md",
+    "GOVERNANCE.md",
+    "MIGRATION.md",
+    "REFERENCES.md",
+    "VERSION",
+    "CHANGELOG.md",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build:index": "node scripts/build-index.mjs",
+    "validate": "node scripts/validate-rules.mjs && node scripts/validate-links.mjs && node scripts/build-index.mjs --check",
+    "validate:rules": "node scripts/validate-rules.mjs",
+    "validate:links": "node scripts/validate-links.mjs",
+    "test": "node --test",
+    "prepublishOnly": "npm run validate && npm test && node bin/devia.mjs check --root . && node bin/devia.mjs validate",
+    "check": "node bin/devia.mjs check --root ."
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=20"
+  }
+}

package/rules/LIFECYCLE.md

@@ -0,0 +1,16 @@
+# Rule lifecycle
+
+```text
+draft → proposed → active → deprecated → superseded → removed
+```
+
+| Status | Meaning |
+|---|---|
+| `draft` | Authoring; not enforced |
+| `proposed` | In review |
+| `active` | Enforceable |
+| `deprecated` | Still valid briefly; plan migration |
+| `superseded` | Replaced by another rule id |
+| `removed` | Gone; requires changelog + migration note |
+
+Never delete an active MUST without changelog entry and superseding id when replaced.

package/rules/README.md

@@ -0,0 +1,166 @@
+# Rules registry
+
+Machine-readable rules with stable IDs. Narrative guidance lives under
+[`standard/`](../standard/README.md); these files are what agents and reviews cite.
+
+Severity is the obligation (`MUST` · `MUST NOT` · `SHOULD` · `MAY`).
+Priority is when it blocks (`P0` · `P1` · `P2` · `P3` — see [`MATURITY.md`](../MATURITY.md)).
+
+> Generated by `npm run build:index`. Edit the rule files, not this page.
+
+## Agent discipline
+
+| ID | Title | Severity | Priority | Domain | Auto | Status |
+|---|---|---|---|---|---|---|
+| [AGT-001](agent/AGT-001.md) | Read the memory before writing code | MUST | P0 | agent | no | active |
+| [AGT-002](agent/AGT-002.md) | No memory, no code — initialise first | MUST | P0 | agent | yes | active |
+| [AGT-003](agent/AGT-003.md) | Make the smallest change that satisfies the request | MUST | P1 | agent | yes | active |
+| [AGT-004](agent/AGT-004.md) | Never invent an interface or a rule | MUST NOT | P0 | agent | no | active |
+| [AGT-005](agent/AGT-005.md) | Never claim done or production ready without evidence | MUST NOT | P0 | agent | no | active |
+| [AGT-006](agent/AGT-006.md) | Report what was not verified | MUST | P0 | agent | no | active |
+| [AGT-007](agent/AGT-007.md) | Cite rule identifiers | MUST | P1 | agent | no | active |
+| [AGT-008](agent/AGT-008.md) | Read a file before editing it | MUST | P1 | agent | no | active |
+| [AGT-009](agent/AGT-009.md) | Only original work | MUST NOT | P1 | agent | no | active |
+| [AGT-010](agent/AGT-010.md) | Ask or record instead of guessing | MUST | P1 | agent | no | active |
+| [AGT-011](agent/AGT-011.md) | Never weaken the standard to fit the code | MUST NOT | P0 | agent | yes | active |
+| [MEM-001](memory/MEM-001.md) | Undecided is never coded as a silent truth | MUST | P0 | memory | no | active |
+| [MEM-002](memory/MEM-002.md) | Decided but not built is recorded as debt | MUST | P1 | memory | no | active |
+| [MEM-003](memory/MEM-003.md) | Debt lines are closed only by the change that discharges them | MUST | P1 | memory | no | active |
+| [MEM-004](memory/MEM-004.md) | Registry identifiers are monotone and never reused | MUST | P1 | memory | yes | active |
+| [MEM-005](memory/MEM-005.md) | Verify before recording | MUST | P1 | memory | no | active |
+| [MEM-006](memory/MEM-006.md) | Sweep the surface you touch | MUST | P1 | memory | no | active |
+| [MEM-007](memory/MEM-007.md) | No perishable facts in overview or index files | MUST NOT | P1 | memory | yes | active |
+| [MEM-008](memory/MEM-008.md) | Memory points at documentation, it does not duplicate it | MUST | P1 | memory | no | active |
+| [MEM-009](memory/MEM-009.md) | Code and memory ship in the same change | MUST | P0 | memory | yes | active |
+| [MEM-010](memory/MEM-010.md) | Never/always lines come from real incidents | SHOULD | P2 | memory | no | active |
+| [MEM-011](memory/MEM-011.md) | Never delete a registry line you did not discharge | MUST NOT | P0 | memory | yes | active |
+
+## Engineering
+
+| ID | Title | Severity | Priority | Domain | Auto | Status |
+|---|---|---|---|---|---|---|
+| [AI-001](ai/AI-001.md) | Untrusted content is data, never instructions | MUST | P0 | ai | no | active |
+| [AI-002](ai/AI-002.md) | No secrets or unnecessary personal data in prompts | MUST | P0 | ai | yes | active |
+| [AI-003](ai/AI-003.md) | Model output is validated before it reaches a system of record | MUST | P1 | ai | yes | active |
+| [AI-004](ai/AI-004.md) | Irreversible agent actions require a human | MUST | P1 | ai | no | active |
+| [AI-005](ai/AI-005.md) | Prompts, tools and model versions are versioned artifacts | SHOULD | P2 | ai | yes | active |
+| [API-001](api/API-001.md) | Requests are validated against an explicit schema | MUST | P0 | api | yes | active |
+| [API-002](api/API-002.md) | Errors use one envelope and a stable code | MUST | P1 | api | yes | active |
+| [API-003](api/API-003.md) | Breaking changes are versioned | MUST | P1 | api | no | active |
+| [API-004](api/API-004.md) | Retryable state changes are idempotent | MUST | P1 | api | no | active |
+| [API-005](api/API-005.md) | Collections are bounded | MUST | P1 | api | yes | active |
+| [API-006](api/API-006.md) | One capability, one surface | SHOULD | P2 | api | no | active |
+| [ARC-001](architecture/ARC-001.md) | Layer boundaries are respected | MUST | P1 | architecture | no | active |
+| [ARC-002](architecture/ARC-002.md) | Non-trivial decisions are recorded | MUST | P1 | architecture | no | active |
+| [ARC-003](architecture/ARC-003.md) | Complexity must be earned | MUST | P1 | architecture | no | active |
+| [ARC-004](architecture/ARC-004.md) | Every new dependency is justified | MUST | P1 | architecture | yes | active |
+| [ARC-005](architecture/ARC-005.md) | Business rules live outside transport and framework code | SHOULD | P2 | architecture | no | active |
+| [ARC-006](architecture/ARC-006.md) | Environment-specific values come from configuration | MUST | P1 | architecture | yes | active |
+| [DB-001](database/DB-001.md) | Every schema change is a versioned migration | MUST | P0 | database | yes | active |
+| [DB-002](database/DB-002.md) | Applied migrations are immutable | MUST NOT | P0 | database | no | active |
+| [DB-003](database/DB-003.md) | Money is exact and carries its currency | MUST | P0 | database | yes | active |
+| [DB-004](database/DB-004.md) | Backups exist and restore has been rehearsed | MUST | P0 | database | no | active |
+| [DB-005](database/DB-005.md) | Destructive operations are recoverable where the domain requires it | SHOULD | P2 | database | no | active |
+| [DB-006](database/DB-006.md) | Queries the application actually runs are indexed | SHOULD | P2 | database | no | active |
+| [DB-007](database/DB-007.md) | Sensitive actions are written to an append-only audit trail | MUST | P1 | database | no | active |
+| [DB-008](database/DB-008.md) | Queries are parameterised | MUST NOT | P0 | database | yes | active |
+| [OBS-001](observability/OBS-001.md) | Logs are structured, correlated, and free of secrets | MUST | P1 | observability | yes | active |
+| [OBS-002](observability/OBS-002.md) | Errors reach a system a human watches | MUST | P1 | observability | yes | active |
+| [OBS-003](observability/OBS-003.md) | Alerts are actionable and owned | MUST | P1 | observability | no | active |
+| [OBS-004](observability/OBS-004.md) | Deployables expose health and readiness | SHOULD | P2 | observability | yes | active |
+| [OPS-001](devops/OPS-001.md) | CI runs on every pull request with required gates | MUST | P0 | devops | yes | active |
+| [OPS-002](devops/OPS-002.md) | No direct pushes to the default branch | MUST | P0 | devops | yes | active |
+| [OPS-003](devops/OPS-003.md) | Never bypass a hook or a check | MUST NOT | P0 | devops | yes | active |
+| [OPS-004](devops/OPS-004.md) | Builds are reproducible | MUST | P1 | devops | yes | active |
+| [OPS-005](devops/OPS-005.md) | There is a rollback path and it has been used | MUST | P1 | devops | no | active |
+| [OPS-006](devops/OPS-006.md) | Staging behaves like production | SHOULD | P2 | devops | no | active |
+| [OPS-007](devops/OPS-007.md) | Production state is never mutated by hand | MUST | P0 | devops | no | active |
+| [PRIV-001](privacy/PRIV-001.md) | Collect the minimum personal data | MUST | P1 | privacy | no | active |
+| [PRIV-002](privacy/PRIV-002.md) | Retention and deletion are defined and implemented | MUST | P1 | privacy | no | active |
+| [PRIV-003](privacy/PRIV-003.md) | Users can obtain and erase their data | MUST | P1 | privacy | no | active |
+| [PRIV-004](privacy/PRIV-004.md) | Personal data stays out of logs, analytics and prompts | MUST | P1 | privacy | yes | active |
+| [SEC-001](security/SEC-001.md) | Server-side authorization on every sensitive operation | MUST | P0 | security | no | active |
+| [SEC-002](security/SEC-002.md) | No secrets in source, config, logs or client bundles | MUST NOT | P0 | security | yes | active |
+| [SEC-003](security/SEC-003.md) | External input is validated before use | MUST | P0 | security | yes | active |
+| [SEC-004](security/SEC-004.md) | Internal error detail never reaches a production client | MUST | P0 | security | yes | active |
+| [SEC-005](security/SEC-005.md) | Tenant and user isolation is enforced and tested | MUST | P0 | security | no | active |
+| [SEC-006](security/SEC-006.md) | Sessions expire, rotate and can be revoked | MUST | P1 | security | no | active |
+| [SEC-007](security/SEC-007.md) | Webhooks are verified and replay-protected | MUST | P0 | security | no | active |
+| [SEC-008](security/SEC-008.md) | Abuse surfaces are rate limited | MUST | P1 | security | no | active |
+| [SEC-009](security/SEC-009.md) | Transport and browser security headers are set | MUST | P1 | security | yes | active |
+| [SEC-010](security/SEC-010.md) | Least privilege for every credential and role | MUST | P1 | security | no | active |
+| [SEC-011](security/SEC-011.md) | Dependency and secret scanning run in CI | MUST | P1 | security | yes | active |
+| [SEC-012](security/SEC-012.md) | Credentials are stored irreversibly and compared safely | MUST | P0 | security | no | active |
+| [TST-001](testing/TST-001.md) | Business rules are covered by automated tests | MUST | P0 | testing | yes | active |
+| [TST-002](testing/TST-002.md) | Authorization and isolation paths are tested | MUST | P0 | testing | no | active |
+| [TST-003](testing/TST-003.md) | Never disable or weaken a test to make CI pass | MUST NOT | P0 | testing | yes | active |
+| [TST-004](testing/TST-004.md) | Every bug fix ships with a regression test | MUST | P1 | testing | no | active |
+| [TST-005](testing/TST-005.md) | Critical journeys are covered end to end | SHOULD | P2 | testing | no | active |
+| [TST-006](testing/TST-006.md) | Tests are deterministic and independent | MUST | P1 | testing | yes | active |
+
+## Design
+
+| ID | Title | Severity | Priority | Domain | Auto | Status |
+|---|---|---|---|---|---|---|
+| [A11Y-001](accessibility/A11Y-001.md) | Accessible name | MUST | P0 | accessibility | yes | active |
+| [A11Y-002](accessibility/A11Y-002.md) | Follow APG keyboard pattern | MUST | P1 | accessibility | no | active |
+| [A11Y-003](accessibility/A11Y-003.md) | Prefer native over ARIA | SHOULD | P2 | accessibility | no | active |
+| [A11Y-004](accessibility/A11Y-004.md) | Keyboard operable | MUST | P0 | accessibility | yes | active |
+| [A11Y-005](accessibility/A11Y-005.md) | No unexpected keyboard traps | MUST | P0 | accessibility | no | active |
+| [A11Y-006](accessibility/A11Y-006.md) | Visible focus | MUST | P0 | accessibility | yes | active |
+| [A11Y-007](accessibility/A11Y-007.md) | Focus restoration | MUST | P1 | accessibility | no | active |
+| [A11Y-008](accessibility/A11Y-008.md) | Text contrast AA | MUST | P0 | accessibility | yes | active |
+| [A11Y-009](accessibility/A11Y-009.md) | UI component contrast | MUST | P1 | accessibility | yes | active |
+| [A11Y-010](accessibility/A11Y-010.md) | Target size | MUST | P1 | accessibility | no | active |
+| [A11Y-011](accessibility/A11Y-011.md) | Reflow without loss of use | MUST | P1 | accessibility | no | active |
+| [A11Y-012](accessibility/A11Y-012.md) | Respect reduced motion | MUST | P1 | accessibility | yes | active |
+| [CMP-001](components/CMP-001.md) | Button hierarchy | MUST | P1 | components | no | active |
+| [CMP-002](components/CMP-002.md) | Disabled action explains enablement | SHOULD | P2 | components | no | active |
+| [CMP-003](components/CMP-003.md) | Data table headers | MUST | P1 | components | yes | active |
+| [CMP-004](components/CMP-004.md) | Row actions usable on small widths | SHOULD | P2 | components | no | active |
+| [CMP-005](components/CMP-005.md) | Dialog accessibility pattern | MUST | P0 | components | yes | active |
+| [CNT-001](content/CNT-001.md) | Action-oriented labels | SHOULD | P2 | content | no | active |
+| [DATA-001](data-display/DATA-001.md) | Currency context explicit | MUST | P1 | data-display | no | active |
+| [DATA-002](data-display/DATA-002.md) | Dates unambiguous | MUST | P1 | data-display | no | active |
+| [DATA-003](data-display/DATA-003.md) | Numeric alignment | SHOULD | P2 | data-display | no | active |
+| [DATA-004](data-display/DATA-004.md) | Sort and filter feedback | MUST | P1 | data-display | no | active |
+| [DS-001](design-system/DS-001.md) | Git is source of truth for tokens | MUST | P1 | design-system | yes | active |
+| [DS-002](design-system/DS-002.md) | Semantic tokens in components | SHOULD | P2 | design-system | no | active |
+| [DS-003](design-system/DS-003.md) | Breaking token changes versioned | MUST | P1 | design-system | no | active |
+| [I18N-001](localization/I18N-001.md) | No concatenated sentences | MUST | P1 | localization | no | active |
+| [I18N-002](localization/I18N-002.md) | Text expansion safe layouts | SHOULD | P2 | localization | no | active |
+| [I18N-003](localization/I18N-003.md) | RTL readiness for mirrored UI | SHOULD | P2 | localization | no | active |
+| [INT-001](interaction/INT-001.md) | Touch primary targets | MUST | P1 | interaction | no | active |
+| [INT-002](interaction/INT-002.md) | Keyboard parity for pointer features | MUST | P1 | interaction | no | active |
+| [MOT-001](motion/MOT-001.md) | Motion has a job | SHOULD | P2 | motion | no | active |
+| [RWD-001](responsive/RWD-001.md) | Touch targets adequate | MUST | P1 | responsive | no | active |
+| [RWD-002](responsive/RWD-002.md) | Core flows at 320px | MUST | P0 | responsive | no | active |
+| [RWD-003](responsive/RWD-003.md) | Hover not the only path | MUST | P0 | responsive | no | active |
+| [STATE-001](states/STATE-001.md) | Interaction state set | MUST | P1 | states | no | active |
+| [STATE-002](states/STATE-002.md) | Async outcome states | MUST | P1 | states | no | active |
+| [STATE-003](states/STATE-003.md) | Permission-denied and read-only | MUST | P1 | states | no | active |
+| [STATE-004](states/STATE-004.md) | Unsaved changes | SHOULD | P2 | states | no | active |
+| [UI-001](ui/UI-001.md) | Type from tokens | MUST | P1 | ui | yes | active |
+| [UI-002](ui/UI-002.md) | Readable body measure | SHOULD | P2 | ui | no | active |
+| [UI-003](ui/UI-003.md) | Semantic tokens over raw hex | MUST | P1 | ui | yes | active |
+| [UI-004](ui/UI-004.md) | Not color alone | MUST | P0 | ui | yes | active |
+| [UI-005](ui/UI-005.md) | Spacing scale | MUST | P1 | ui | yes | active |
+| [UI-006](ui/UI-006.md) | Consistent page chrome | SHOULD | P2 | ui | no | active |
+| [UI-007](ui/UI-007.md) | Icon-only controls named | MUST | P0 | ui | yes | active |
+| [UX-001](ux/UX-001.md) | One primary action per view | MUST | P1 | ux | no | active |
+| [UX-002](ux/UX-002.md) | System status visible | MUST | P1 | ux | yes | active |
+| [UX-003](ux/UX-003.md) | Navigation mirrors user mental model | SHOULD | P2 | ux | no | active |
+| [UX-004](ux/UX-004.md) | Depth with orientation | SHOULD | P2 | ux | no | active |
+| [UX-005](ux/UX-005.md) | Current location indicated | MUST | P1 | ux | yes | active |
+| [UX-006](ux/UX-006.md) | Skip to content | MUST | P1 | ux | yes | active |
+| [UX-007](ux/UX-007.md) | Persistent accessible labels | MUST | P0 | ux | yes | active |
+| [UX-008](ux/UX-008.md) | Field errors identifiable and actionable | MUST | P0 | ux | yes | active |
+| [UX-009](ux/UX-009.md) | Required fields indicated in text | MUST | P1 | ux | no | active |
+| [UX-010](ux/UX-010.md) | Complete UI states for data views | MUST | P1 | ux | no | active |
+| [UX-011](ux/UX-011.md) | Confirm irreversible actions | MUST | P0 | ux | no | active |
+| [UX-012](ux/UX-012.md) | Human-readable errors | MUST | P1 | ux | no | active |
+| [UX-013](ux/UX-013.md) | Progressive disclosure | SHOULD | P2 | ux | no | active |
+
+**Total:** 138 rules · 138 active · 53 automatable · schema v1
+
+Lifecycle and supersession: [`LIFECYCLE.md`](LIFECYCLE.md).

package/rules/accessibility/A11Y-001.md

@@ -0,0 +1,42 @@
+---
+id: A11Y-001
+title: Accessible name
+severity: MUST
+status: active
+priority: P0
+domain: accessibility
+source:
+  - WCAG-2.2
+  - WAI-ARIA-APG
+applies_to:
+  - button
+  - link
+  - input
+success_criteria:
+  - "4.1.2"
+requirement: >
+  Every interactive control MUST expose an accessible name.
+validation:
+  automated: true
+  manual: true
+exceptions: documented-only
+---
+
+# A11Y-001 — Accessible name
+
+**Requirement:** Every interactive control MUST expose an accessible name.
+
+**Bad:** Unlabeled custom div button.
+
+**Good:** Native button text or aria-label when icon-only.
+
+## Validation
+
+- Automated checks / lint / a11y tooling where applicable
+- Design or engineering review
+
+## Lifecycle
+
+- Status: `active`
+- Priority: `P0`
+- Exceptions: `documented-only`

package/rules/accessibility/A11Y-002.md

@@ -0,0 +1,41 @@
+---
+id: A11Y-002
+title: Follow APG keyboard pattern
+severity: MUST
+status: active
+priority: P1
+domain: accessibility
+source:
+  - WAI-ARIA-APG
+applies_to:
+  - tabs
+  - menu
+  - combobox
+  - dialog
+success_criteria:
+  []
+requirement: >
+  Composite widgets MUST follow the applicable APG keyboard interaction unless a documented exception exists.
+validation:
+  automated: false
+  manual: true
+exceptions: documented-only
+---
+
+# A11Y-002 — Follow APG keyboard pattern
+
+**Requirement:** Composite widgets MUST follow the applicable APG keyboard interaction unless a documented exception exists.
+
+**Bad:** Tabs only clickable; no arrow keys when role=tablist.
+
+**Good:** Implement APG pattern for that widget.
+
+## Validation
+
+- Design or engineering review
+
+## Lifecycle
+
+- Status: `active`
+- Priority: `P1`
+- Exceptions: `documented-only`

package/rules/accessibility/A11Y-003.md

@@ -0,0 +1,40 @@
+---
+id: A11Y-003
+title: Prefer native over ARIA
+severity: SHOULD
+status: active
+priority: P2
+domain: accessibility
+source:
+  - WAI-ARIA-APG
+applies_to:
+  - button
+  - link
+  - input
+success_criteria:
+  []
+requirement: >
+  Prefer native elements (button, a, input) over ARIA roles on divs.
+validation:
+  automated: false
+  manual: true
+exceptions: documented-only
+---
+
+# A11Y-003 — Prefer native over ARIA
+
+**Requirement:** Prefer native elements (button, a, input) over ARIA roles on divs.
+
+**Bad:** div role=button for primary actions.
+
+**Good:** button type="button".
+
+## Validation
+
+- Design or engineering review
+
+## Lifecycle
+
+- Status: `active`
+- Priority: `P2`
+- Exceptions: `documented-only`

package/rules/accessibility/A11Y-004.md

@@ -0,0 +1,40 @@
+---
+id: A11Y-004
+title: Keyboard operable
+severity: MUST
+status: active
+priority: P0
+domain: accessibility
+source:
+  - WCAG-2.2
+applies_to:
+  - web
+  - desktop
+success_criteria:
+  - "2.1.1"
+requirement: >
+  All functionality MUST be operable through a keyboard interface (exceptions per WCAG only).
+validation:
+  automated: true
+  manual: true
+exceptions: documented-only
+---
+
+# A11Y-004 — Keyboard operable
+
+**Requirement:** All functionality MUST be operable through a keyboard interface (exceptions per WCAG only).
+
+**Bad:** Drag-only reorder with no keyboard alternative.
+
+**Good:** Keyboard affordance or alternative flow.
+
+## Validation
+
+- Automated checks / lint / a11y tooling where applicable
+- Design or engineering review
+
+## Lifecycle
+
+- Status: `active`
+- Priority: `P0`
+- Exceptions: `documented-only`

package/rules/accessibility/A11Y-005.md

@@ -0,0 +1,39 @@
+---
+id: A11Y-005
+title: No unexpected keyboard traps
+severity: MUST
+status: active
+priority: P0
+domain: accessibility
+source:
+  - WCAG-2.2
+applies_to:
+  - web
+  - dialog
+success_criteria:
+  - "2.1.2"
+requirement: >
+  Focus MUST be able to move away unless a modal pattern intentionally traps and provides Escape/close.
+validation:
+  automated: false
+  manual: true
+exceptions: documented-only
+---
+
+# A11Y-005 — No unexpected keyboard traps
+
+**Requirement:** Focus MUST be able to move away unless a modal pattern intentionally traps and provides Escape/close.
+
+**Bad:** Widget eats Tab forever.
+
+**Good:** Trap only in dialogs with clear exit.
+
+## Validation
+
+- Design or engineering review
+
+## Lifecycle
+
+- Status: `active`
+- Priority: `P0`
+- Exceptions: `documented-only`