@xenos1996/usa 2.0.0

package/dist/util/yaml.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"yaml.d.ts","sourceRoot":"","sources":["../../src/util/yaml.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,sFAAsF;AACtF,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE9C,wBAAgB,KAAK,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,OAAO,CAE9C;AAED,wBAAgB,KAAK,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAEzC;AAED,4BAA4B;AAC5B,wBAAgB,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAElD;AAED,4BAA4B;AAC5B,wBAAgB,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAElD;AAED,6BAA6B;AAC7B,wBAAgB,IAAI,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS,CAEpD;AAED,4BAA4B;AAC5B,wBAAgB,IAAI,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,EAAE,GAAG,SAAS,CAEtD;AAED,wDAAwD;AACxD,wBAAgB,OAAO,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,EAAE,GAAG,SAAS,CAExD;AAED,4DAA4D;AAC5D,wBAAgB,MAAM,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,CAI/E;AAED,2CAA2C;AAC3C,wBAAgB,IAAI,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,EAAE,CAE1C"}

package/dist/util/yaml.js

@@ -0,0 +1,48 @@
+/**
+ * Shape helpers for decoded YAML.
+ *
+ * `yaml.parse` hands back plain JS objects, which is exactly the *wrong* thing
+ * to sprinkle through the engine: every downstream field access would be `any`
+ * and a typo in a rule pack would surface as `undefined` three modules later.
+ * These helpers force the parse boundary to state up front what shape it
+ * expects, and make the "absent" case explicit rather than implicit.
+ */
+export function isMap(v) {
+    return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+export function asMap(v) {
+    return isMap(v) ? v : {};
+}
+/** Present and a string. */
+export function str(v) {
+    return typeof v === 'string' ? v : undefined;
+}
+/** Present and a number. */
+export function num(v) {
+    return typeof v === 'number' && Number.isFinite(v) ? v : undefined;
+}
+/** Present and a boolean. */
+export function bool(v) {
+    return typeof v === 'boolean' ? v : undefined;
+}
+/** Present and an array. */
+export function list(v) {
+    return Array.isArray(v) ? v : undefined;
+}
+/** Present and an array — every element stringified. */
+export function strList(v) {
+    return Array.isArray(v) ? v.map((x) => String(x)) : undefined;
+}
+/** A scalar suitable for `json_path.equals` comparisons. */
+export function scalar(v) {
+    if (v === null)
+        return null;
+    if (typeof v === 'string' || typeof v === 'number' || typeof v === 'boolean')
+        return v;
+    return undefined;
+}
+/** One entry of an array, as a mapping. */
+export function maps(v) {
+    return Array.isArray(v) ? v.filter(isMap) : [];
+}
+//# sourceMappingURL=yaml.js.map

package/dist/util/yaml.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"yaml.js","sourceRoot":"","sources":["../../src/util/yaml.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,MAAM,UAAU,KAAK,CAAC,CAAU;IAC9B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,CAAU;IAC9B,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3B,CAAC;AAED,4BAA4B;AAC5B,MAAM,UAAU,GAAG,CAAC,CAAU;IAC5B,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/C,CAAC;AAED,4BAA4B;AAC5B,MAAM,UAAU,GAAG,CAAC,CAAU;IAC5B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACrE,CAAC;AAED,6BAA6B;AAC7B,MAAM,UAAU,IAAI,CAAC,CAAU;IAC7B,OAAO,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAChD,CAAC;AAED,4BAA4B;AAC5B,MAAM,UAAU,IAAI,CAAC,CAAU;IAC7B,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAe,CAAC,CAAC,CAAC,SAAS,CAAC;AACzD,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,OAAO,CAAC,CAAU;IAChC,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAChE,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,MAAM,CAAC,CAAU;IAC/B,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IACvF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,IAAI,CAAC,CAAU;IAC7B,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACjD,CAAC"}

package/package.json

@@ -0,0 +1,94 @@
+{
+  "name": "@xenos1996/usa",
+  "version": "2.0.0",
+  "description": "Universal Software Auditor — an open-source, self-adapting audit framework for any project, any stack, any stage",
+  "license": "MIT",
+  "type": "module",
+  "bin": {
+    "usa": "dist/cli.js"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./rules": "./rules/index.yaml"
+  },
+  "files": [
+    "dist",
+    "rules",
+    "USA.md",
+    "README.md",
+    "LICENSE"
+  ],
+  "keywords": [
+    "audit",
+    "software-audit",
+    "security-audit",
+    "code-audit",
+    "code-review",
+    "openssf",
+    "owasp-asvs",
+    "slsa",
+    "sast",
+    "agent",
+    "llm",
+    "template",
+    "tech-debt",
+    "quality-gate"
+  ],
+  "author": "",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Er-Sajan-PLG/universal-software-auditor.git"
+  },
+  "bugs": {
+    "url": "https://github.com/Er-Sajan-PLG/universal-software-auditor/issues"
+  },
+  "homepage": "https://github.com/Er-Sajan-PLG/universal-software-auditor#readme",
+  "engines": {
+    "node": ">=20.0.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "usa": "node --experimental-strip-types src/cli.ts",
+    "lint": "eslint .",
+    "lint:fix": "eslint . --fix",
+    "format": "prettier --write .",
+    "format:check": "prettier --check .",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:cov": "vitest run --coverage",
+    "self-audit": "npm run build && node dist/cli.js audit . --out AUDIT.md",
+    "prepublishOnly": "npm run build"
+  },
+  "lint-staged": {
+    "*.{js,ts,mjs,cjs}": [
+      "eslint --fix",
+      "prettier --write"
+    ],
+    "*.{json,md,yaml,yml}": [
+      "prettier --write"
+    ]
+  },
+  "dependencies": {
+    "yaml": "^2.6.1"
+  },
+  "devDependencies": {
+    "@commitlint/cli": "^21.2.2",
+    "@commitlint/config-conventional": "^21.2.2",
+    "@eslint/js": "^10.0.1",
+    "@types/node": "^26.4.1",
+    "@vitest/coverage-v8": "^5.0.0",
+    "eslint": "^10.10.0",
+    "husky": "^9.1.7",
+    "lint-staged": "^17.5.0",
+    "prettier": "^3.4.2",
+    "typescript": "^5.7.3",
+    "typescript-eslint": "^8.20.0",
+    "vitest": "^5.0.0"
+  }
+}

package/rules/core/architecture.yaml

@@ -0,0 +1,190 @@
+id: core/architecture
+title: Architecture & Design
+section: S4
+section_title: Architecture & Design
+description: >
+  Structure, boundaries, and the decisions behind them. Mostly judgement —
+  USA automates the parts that show up as files and flags the rest for
+  review rather than pretending a regex can measure coupling.
+version: '1.0'
+
+rules:
+  - id: ARCH-001
+    title: Architecture is documented
+    section: S4
+    section_title: Architecture & Design
+    severity: MEDIUM
+    class: documentation
+    applies_when:
+      not: { fact: 'maturity:prototype' }
+    check:
+      kind: any_file
+      patterns:
+        [
+          'ARCHITECTURE.md',
+          'docs/ARCHITECTURE.md',
+          'docs/architecture/**',
+          'docs/design/**',
+          'docs/overview.md',
+        ]
+    why: 'Undocumented architecture is whatever the last person to touch it believed.'
+    remediation: 'One page: components, data flow, external dependencies, and the three decisions a newcomer would question.'
+    references: ['arc42', 'C4-Model']
+
+  - id: ARCH-002
+    title: Architecture decisions are recorded (ADRs)
+    section: S4
+    section_title: Architecture & Design
+    severity: LOW
+    class: documentation
+    applies_when:
+      not: { fact: 'maturity:prototype' }
+    check:
+      kind: any_file
+      patterns:
+        ['**/adr-*.md', '**/ADR-*.md', 'docs/adrs/**', 'docs/adr/**', 'docs/decisions/**', 'adr/**']
+    why: 'Six months from now nobody will remember why Postgres won over Mongo, and someone will relitigate it.'
+    remediation: 'Keep short ADRs in docs/adrs: context, decision, consequences. One markdown file per decision.'
+    references: ['ADR-Nygard']
+
+  - id: ARCH-003
+    title: No god files
+    section: S4
+    section_title: Architecture & Design
+    severity: MEDIUM
+    class: maintainability
+    check:
+      kind: file_lines_max
+      patterns:
+        [
+          'src/**/*.{ts,tsx,js,jsx,py,go,rs,java,kt,rb,php,cs}',
+          'app/**/*.{ts,tsx,js,jsx,py,go,rs,java,kt}',
+          'lib/**/*.{ts,tsx,js,jsx,py,go,rs}',
+          'pkg/**/*.go',
+          'internal/**/*.go',
+        ]
+      max_lines: 800
+    why: 'A file nobody can hold in their head is a file nobody changes safely.'
+    remediation: 'Split by responsibility: extract the data access, the policy, or the formatting into its own module.'
+    references: ['Anti-pattern:God-Object', 'ISO-5055']
+
+  - id: ARCH-004
+    title: Layers are separated (transport / domain / data)
+    section: S4
+    section_title: Architecture & Design
+    severity: MEDIUM
+    class: maintainability
+    applies_when:
+      any:
+        - { fact: 'platform:server' }
+        - { fact: 'project:api' }
+        - { fact: 'has:database' }
+    check: { kind: manual }
+    why: >-
+      Business logic mixed into HTTP handlers cannot be tested, reused, or moved — and every new transport duplicates it.
+    evidence: 'Directory layout or file:line showing HTTP handlers delegating to a domain/service layer rather than querying the DB inline.'
+    remediation: 'Handlers parse and authorise; services hold business rules; repositories own persistence. No SQL in a controller.'
+    references: ['Clean-Architecture', 'Hexagonal-Architecture']
+
+  - id: ARCH-005
+    title: No circular dependencies between modules
+    section: S4
+    section_title: Architecture & Design
+    severity: HIGH
+    class: maintainability
+    depths: [deep]
+    check:
+      kind: command
+      run: '! (command -v npx >/dev/null && npx --yes dpdm@latest --exit-code circular:1 "src/**/*.ts" 2>/dev/null | grep -qi circular)'
+      expect_exit: 0
+    why: 'Cycles make modules untestable in isolation and turn every build order into a guess.'
+    evidence: 'Output of dpdm / madge --circular / dependency-cruiser, or a manual import-graph review.'
+    remediation: 'Break the cycle with an interface, an event, or by extracting the shared type into a leaf module.'
+    references: ['Anti-pattern:Circular-Dependency']
+
+  - id: ARCH-006
+    title: Module boundaries are enforced by tooling
+    section: S4
+    section_title: Architecture & Design
+    severity: LOW
+    class: maintainability
+    applies_when: { fact: 'project:monorepo' }
+    check:
+      kind: grep_present
+      pattern: '(enforce-module-boundaries|no-restricted-imports|dependency-cruiser|import/no-cycle|@nx/enforce-module-boundaries|boundaries/)'
+      include:
+        [
+          '**/.eslintrc*',
+          'eslint.config.*',
+          '.dependency-cruiser.*',
+          'nx.json',
+          'project.json',
+          '**/tsconfig*.json',
+        ]
+      flags: i
+    why: 'Boundaries that are not enforced decay within one sprint of the first deadline.'
+    remediation: 'Add nx enforce-module-boundaries or eslint no-restricted-imports between packages/layers.'
+    references: ['Nx', 'dependency-cruiser']
+
+  - id: ARCH-007
+    title: Configuration is externalised
+    section: S4
+    section_title: Architecture & Design
+    severity: MEDIUM
+    class: operations
+    check:
+      kind: grep_absent
+      pattern: '(process\.env\.[A-Z_]+\s*\|\|\s*[''"](?:prod|production|https?://)|\b(?:DATABASE_URL|API_URL|REDIS_URL)\s*[:=]\s*[''"](?:postgres|mysql|mongodb|redis|https?)://(?!localhost|127\.0\.0\.1))'
+      include: ['**/*.{ts,tsx,js,jsx,py,go,rs,java,kt,rb,php}']
+      exclude: ['**/*.test.*', '**/*.spec.*']
+      flags: i
+    why: 'A hardcoded production URL means the only way to run staging is to edit source.'
+    remediation: 'Read every environment-specific value from configuration; keep defaults that are safe for local dev.'
+    references: ['12-Factor:Config', 'ASVS-14.1.3']
+
+  - id: ARCH-008
+    title: Side effects are isolated and testable
+    section: S4
+    section_title: Architecture & Design
+    severity: LOW
+    class: maintainability
+    check: { kind: manual }
+    why: >-
+      Side effects called inline cannot be tested without the network, the clock, or the database. That is why tests get slow and flaky.
+    evidence: 'Examples of I/O (network, disk, clock, randomness) being injected or wrapped rather than called inline from business logic.'
+    remediation: 'Inject the clock, the HTTP client, and the repository; keep pure functions pure.'
+    references: ['Functional-Core-Imperative-Shell']
+
+  - id: ARCH-009
+    title: Single points of failure are identified
+    section: S4
+    section_title: Architecture & Design
+    severity: MEDIUM
+    class: operations
+    applies_when:
+      any:
+        - { fact: 'maturity:production' }
+        - { fact: 'maturity:beta' }
+    check: { kind: manual }
+    why: >-
+      Availability incidents are almost always an SPOF somebody already knew about. Writing it down is what turns it into a project.
+    evidence: 'A list of SPOFs (single DB, single region, single queue, single vendor) and the mitigation for each.'
+    remediation: 'For each SPOF: replica, failover, or an explicitly accepted risk with a documented recovery time.'
+    references: ['AWS-Well-Architected:Reliability']
+
+  - id: ARCH-010
+    title: Async work is offloaded to a queue
+    section: S4
+    section_title: Architecture & Design
+    severity: LOW
+    class: performance
+    applies_when: { fact: 'platform:server' }
+    check:
+      kind: grep_present
+      pattern: '(bullmq|bull|amqplib|kafkajs|sqs|nats|temporal|celery|rq|sidekiq|taskiq|dramatiq|asynq)'
+      include: ['**/*.{ts,tsx,js,jsx,py,go,rs,rb}']
+      exclude: ['**/*.test.*']
+      flags: i
+    why: 'Anything slow inside a request handler is a timeout waiting for a busy day.'
+    remediation: 'Move email, image processing, webhooks, and report generation onto a queue with retries and a DLQ.'
+    references: ['12-Factor:Processes']

package/rules/core/cicd.yaml

@@ -0,0 +1,212 @@
+id: core/cicd
+title: CI/CD, Infrastructure & Observability
+section: S8
+section_title: CI/CD, Infrastructure & Observability
+description: >
+  How code becomes running software, and how you find out when it breaks.
+  Heavily informed by the OpenSSF Scorecard and DORA's delivery metrics.
+version: '1.0'
+
+rules:
+  - id: CICD-001
+    title: A CI pipeline exists
+    section: S8
+    section_title: CI/CD, Infrastructure & Observability
+    severity: HIGH
+    class: operations
+    check:
+      kind: any_file
+      patterns:
+        - '.github/workflows/*.yml'
+        - '.github/workflows/*.yaml'
+        - '.gitlab-ci.yml'
+        - 'Jenkinsfile'
+        - '.circleci/config.yml'
+        - '.buildkite/**'
+        - 'azure-pipelines.yml'
+        - '.drone.yml'
+        - 'bitbucket-pipelines.yml'
+    why: 'Manual release steps work exactly until the person who knows them is on holiday.'
+    remediation: 'Add a minimal pipeline first: install → lint → test → build. Expand from there.'
+    references: ['OpenSSF-Scorecard:CI-Tests', 'DORA']
+
+  - id: CICD-002
+    title: CI runs lint, test, and build
+    section: S8
+    section_title: CI/CD, Infrastructure & Observability
+    severity: MEDIUM
+    class: operations
+    applies_when: { fact: 'has:ci' }
+    check: { kind: manual }
+    evidence: 'The workflow file: which of lint / typecheck / test / build run on pull_request?'
+    why: 'A pipeline that only builds is a compiler with a dashboard.'
+    remediation: 'Add steps in fail-fast order: lint (5s) → typecheck → unit → build → integration.'
+    references: ['OpenSSF-Scorecard:CI-Tests', 'DORA']
+
+  - id: CICD-003
+    title: Deployment is automated
+    section: S8
+    section_title: CI/CD, Infrastructure & Observability
+    severity: HIGH
+    class: operations
+    applies_when:
+      any:
+        - { fact: 'maturity:production' }
+        - { fact: 'maturity:beta' }
+    check: { kind: manual }
+    evidence: 'The path from merged commit to production: is there a human typing commands into a server?'
+    why: 'Manual deploys are unrepeatable, unauditable, and always happen at the worst possible time.'
+    remediation: 'Automate deploy from a tagged commit or main-branch push with an approval step if governance requires one.'
+    references: ['DORA:Deployment-Frequency', 'NIST-SSDF-PO.5']
+
+  - id: CICD-004
+    title: A rollback path exists and has been exercised
+    section: S8
+    section_title: CI/CD, Infrastructure & Observability
+    severity: HIGH
+    class: operations
+    applies_when:
+      any:
+        - { fact: 'maturity:production' }
+        - { fact: 'maturity:beta' }
+    check: { kind: manual }
+    evidence: 'Documented rollback command/action, and the date it was last actually used (successfully).'
+    why: 'An untested rollback is a second outage with extra panic.'
+    remediation: 'Make rollback a one-command operation; rehearse it; record the last successful rollback date.'
+    references: ['DORA:Time-to-Restore', 'NIST-SSDF-RV.3']
+
+  - id: CICD-005
+    title: Separate environments exist
+    section: S8
+    section_title: CI/CD, Infrastructure & Observability
+    severity: MEDIUM
+    class: operations
+    applies_when:
+      not: { fact: 'maturity:prototype' }
+    check: { kind: manual }
+    evidence: 'dev / staging / production configuration, and confirmation that dev cannot reach production data.'
+    why: 'Testing in production is a slogan, not a strategy.'
+    remediation: 'At minimum: local + staging + production, with separate credentials and datasets per environment.'
+    references: ['NIST-SSDF-PO.5', 'ASVS-14.1.3']
+
+  - id: CICD-006
+    title: Infrastructure is defined as code
+    section: S8
+    section_title: CI/CD, Infrastructure & Observability
+    severity: MEDIUM
+    class: operations
+    applies_when:
+      not: { fact: 'maturity:prototype' }
+    check:
+      kind: any_file
+      patterns:
+        [
+          '**/*.tf',
+          '**/*.tfvars',
+          'pulumi/**',
+          '**/Pulumi.*.yaml',
+          'cdk.json',
+          '**/*.cdk.ts',
+          'ansible/**',
+          '**/playbook*.yml',
+          'k8s/**/*.yaml',
+          'manifests/**/*.yaml',
+          'charts/**/Chart.yaml',
+          'docker-compose*.yml',
+          'compose.yaml',
+          'serverless.yml',
+          'Dockerfile*',
+        ]
+    why: 'Infrastructure that only exists in a console cannot be reviewed, diffed, or rebuilt after an incident.'
+    remediation: 'Move environments into Terraform/Pulumi/CDK (or at least declarative compose + helm manifests).'
+    references: ['NIST-SSDF-PO.5']
+
+  - id: CICD-007
+    title: Health check endpoints exist
+    section: S8
+    section_title: CI/CD, Infrastructure & Observability
+    severity: MEDIUM
+    class: operations
+    applies_when: { fact: 'platform:server' }
+    check:
+      kind: grep_present
+      pattern: '(/(health|healthz|readyz|livez|ready|live|status|ping)[''"`\s]|healthCheck|health_check|app\.get\(\s*[''"]/health)'
+      include: ['**/*.{ts,tsx,js,jsx,py,go,rs,java,kt,rb,php,yml,yaml}']
+      exclude: ['**/*.test.*', '**/*.spec.*', '**/node_modules/**']
+      flags: i
+    why: 'Without /health and /ready, orchestrators cannot tell a booting service from a dead one.'
+    remediation: 'Expose /health (liveness) and /ready (dependencies reachable); wire them into the orchestrator and the LB.'
+    references: ['K8s-Probes', 'OpenSSF-Scorecard']
+
+  - id: CICD-008
+    title: Error tracking / APM is configured
+    section: S8
+    section_title: CI/CD, Infrastructure & Observability
+    severity: MEDIUM
+    class: operations
+    applies_when:
+      not: { fact: 'maturity:prototype' }
+    check:
+      kind: grep_present
+      pattern: '(sentry|opentelemetry|datadog|newrelic|new-relic|rollbar|bugsnag|honeycomb|grafana|prometheus|betterstack|axiom)'
+      include: ['**/*.{ts,tsx,js,jsx,py,go,rs,java,kt,rb,yml,yaml,json,toml}']
+      exclude: ['**/node_modules/**', '**/*.test.*']
+      flags: i
+    why: 'Your users will find the bugs. The only question is whether they tell you.'
+    remediation: 'Add Sentry (or equivalent) with source maps and release tracking; alert on new error types.'
+    references: ['DORA:Monitoring', 'OpenTelemetry']
+
+  - id: CICD-009
+    title: Alerting is configured for critical failures
+    section: S8
+    section_title: CI/CD, Infrastructure & Observability
+    severity: MEDIUM
+    class: operations
+    applies_when: { fact: 'maturity:production' }
+    check: { kind: manual }
+    evidence: 'Alert rules, their thresholds, and who gets paged. Bonus: the last time one fired and what happened.'
+    why: 'Monitoring without alerting is a dashboard nobody opens until after the outage.'
+    remediation: 'Alert on symptoms users feel (error rate, latency, saturation), not on every CPU blip.'
+    references: ['Google-SRE:Monitoring', 'DORA']
+
+  - id: CICD-010
+    title: Backups exist AND restores have been tested
+    section: S8
+    section_title: CI/CD, Infrastructure & Observability
+    severity: HIGH
+    class: operations
+    applies_when:
+      any:
+        - { fact: 'has:database' }
+        - { fact: 'maturity:production' }
+    check: { kind: manual }
+    evidence: 'Backup schedule, retention, encryption at rest, and — critically — the date of the last successful restore drill.'
+    why: 'Nobody has ever been fired for having backups. Plenty of teams have died from never testing the restore.'
+    remediation: 'Automate backups, encrypt them, store them off-site, and run a restore drill quarterly with a recorded RTO.'
+    references: ['NIST-SSDF-RV.3', 'CIS-Control-11']
+
+  - id: CICD-011
+    title: A disaster recovery plan exists
+    section: S8
+    section_title: CI/CD, Infrastructure & Observability
+    severity: MEDIUM
+    class: operations
+    applies_when: { fact: 'maturity:production' }
+    check: { kind: manual }
+    evidence: 'Documented RTO/RPO, the failover procedure, and who is authorised to declare a disaster.'
+    why: 'At 3am, the plan is the only thing between you and ad-hoc database surgery.'
+    remediation: 'Write a one-page DR runbook: trigger, failover steps, rollback, comms template, and owner.'
+    references: ['NIST-SSDF-RV.3', 'AWS-Well-Architected:Reliability']
+
+  - id: CICD-012
+    title: Observability covers the golden signals
+    section: S8
+    section_title: CI/CD, Infrastructure & Observability
+    severity: LOW
+    class: operations
+    applies_when: { fact: 'maturity:production' }
+    check: { kind: manual }
+    evidence: 'A dashboard or metric set covering latency, traffic, errors, and saturation for the primary service.'
+    why: 'Four signals answer "is it broken, how bad, and where" in under five minutes.'
+    remediation: 'Instrument RED/USE metrics; put them on one dashboard linked from the runbook.'
+    references: ['Google-SRE:Golden-Signals']