@xenos1996/usa 2.0.0

package/rules/core/supply-chain.yaml

@@ -0,0 +1,357 @@
+id: core/supply-chain
+title: Supply Chain & Build Provenance
+section: S3
+section_title: Supply Chain & Build Provenance
+description: >
+  Promoted to its own section in USA. You can write perfect code and still
+  ship someone else's backdoor: these controls cover the path from a
+  contributor's editor to the artifact your users run.
+  Aligned with SLSA v1.2, NIST SSDF (SP 800-218), and the OpenSSF Scorecard.
+version: '1.0'
+
+rules:
+  - id: SUP-001
+    title: A lockfile is committed
+    section: S3
+    section_title: Supply Chain & Build Provenance
+    severity: HIGH
+    class: supply-chain
+    check:
+      kind: any_file
+      patterns:
+        - 'package-lock.json'
+        - 'yarn.lock'
+        - 'pnpm-lock.yaml'
+        - 'bun.lockb'
+        - 'bun.lock'
+        - 'poetry.lock'
+        - 'uv.lock'
+        - 'pdm.lock'
+        - 'Pipfile.lock'
+        - 'Cargo.lock'
+        - 'go.sum'
+        - 'composer.lock'
+        - 'Gemfile.lock'
+        - 'flake.lock'
+    why: 'Without a lockfile every install resolves fresh, so your build is not reproducible and transitive hijacks go unnoticed.'
+    remediation: 'Commit the lockfile for your package manager and install with the frozen/immutable flag in CI.'
+    references: ['SLSA-Source', 'OpenSSF-Scorecard:Pinned-Dependencies', 'NIST-SSDF-PS.3.2']
+
+  - id: SUP-002
+    title: CI installs with a frozen lockfile
+    section: S3
+    section_title: Supply Chain & Build Provenance
+    severity: MEDIUM
+    class: supply-chain
+    applies_when: { fact: 'has:ci' }
+    check:
+      kind: grep_present
+      pattern: '(npm ci|npm install --frozen|--frozen-lockfile|--immutable|pip install --require-hashes|pipenv sync|cargo build --locked|--locked)'
+      include: ['**/*.{yml,yaml,sh,bash,toml,Makefile,mk,justfile,just}']
+      exclude: ['**/node_modules/**']
+      flags: i
+    why: '`npm install` in CI silently upgrades you. A frozen install fails loudly instead.'
+    remediation: 'Use `npm ci` (or `--frozen-lockfile` / `--immutable` / `--locked`) everywhere in CI.'
+    references: ['NIST-SSDF-PS.3.2', 'SLSA-Build-L1']
+
+  - id: SUP-003
+    title: Dependency versions are pinned, not floating
+    section: S3
+    section_title: Supply Chain & Build Provenance
+    severity: MEDIUM
+    class: supply-chain
+    check:
+      kind: grep_absent
+      # NOTE: every range operator must be listed, not just the `0.0` forms —
+      # an earlier revision missed `^1.2.3`, `~1.2`, `>=1.0` and `1.x`, so the
+      # most common floating ranges passed as "pinned". Exact versions
+      # (`"18.3.1"`) still pass: no alternative matches a bare digit run.
+      pattern: ':\s*[''"]?(\*|latest|x|~|\^|>=?|>|<=?|<|\d+\.[xX])[''"]?\s*[,}]'
+      include:
+        ['package.json', 'bower.json', 'composer.json', 'pyproject.toml', 'requirements*.txt']
+      exclude: []
+      flags: i
+    why: '`*` and `latest` mean a compromised publish lands in your build with no code review.'
+    remediation: 'Pin exact versions for applications. Ranges are acceptable for published libraries with a lockfile.'
+    references: ['OpenSSF-Scorecard:Pinned-Dependencies', 'NIST-SSDF-PS.3.2']
+
+  - id: SUP-004
+    title: Automated dependency updates are configured
+    section: S3
+    section_title: Supply Chain & Build Provenance
+    severity: MEDIUM
+    class: supply-chain
+    check:
+      kind: any_file
+      patterns:
+        [
+          '.github/dependabot.yml',
+          '.gitlab/dependabot.yml',
+          'renovate.json',
+          'renovate.json5',
+          '.github/renovate.json',
+          '.renovaterc',
+          '.renovaterc.json',
+        ]
+    why: 'The only thing worse than updating dependencies is updating them two years late, all at once.'
+    remediation: 'Enable Dependabot or Renovate with grouped PRs and a weekly schedule.'
+    references: ['OpenSSF-Scorecard:Dependency-Update-Tool', 'NIST-SSDF-PW.4']
+
+  - id: SUP-005
+    title: Dependency vulnerability scanning runs in CI
+    section: S3
+    section_title: Supply Chain & Build Provenance
+    severity: HIGH
+    class: supply-chain
+    applies_when: { fact: 'has:ci' }
+    check:
+      kind: grep_present
+      pattern: '(npm audit|pnpm audit|yarn audit|pip-audit|osv-scanner|snyk (test|monitor)|trivy (fs|repo)|grype|dependency-check|govulncheck|cargo audit|bundler-audit)'
+      include:
+        [
+          '.github/workflows/*.yml',
+          '.github/workflows/*.yaml',
+          '.gitlab-ci.yml',
+          'Jenkinsfile',
+          '.circleci/config.yml',
+          'azure-pipelines.yml',
+        ]
+      flags: i
+    why: 'Most breaches in modern stacks arrive through a transitive dependency, not your own code.'
+    remediation: 'Add a scanner step that fails on HIGH/CRITICAL advisories; wire it to your advisory source (OSV/GHSA).'
+    references: ['OpenSSF-Scorecard:Vulnerabilities', 'NIST-SSDF-RV.1.1', 'SLSA']
+
+  - id: SUP-006
+    title: SAST runs in CI
+    section: S3
+    section_title: Supply Chain & Build Provenance
+    severity: MEDIUM
+    class: supply-chain
+    applies_when: { fact: 'has:ci' }
+    check:
+      kind: grep_present
+      pattern: '(codeql|semgrep|snyk code|sonar|bandit|gosec|brakeman|clippy-sarif|eslint-plugin-security|spotbugs|detekt)'
+      include:
+        [
+          '.github/workflows/*.yml',
+          '.github/workflows/*.yaml',
+          '.gitlab-ci.yml',
+          'Jenkinsfile',
+          '.circleci/config.yml',
+        ]
+      flags: i
+    why: 'Static analysis catches the bug class a reviewer skips at 5pm on a Friday.'
+    remediation: 'Add CodeQL or Semgrep with a ruleset tuned to your stack; block on new high-confidence findings only.'
+    references: ['OpenSSF-Scorecard:SAST', 'NIST-SSDF-RV.1.1']
+
+  - id: SUP-007
+    title: Secret scanning runs in CI
+    section: S3
+    section_title: Supply Chain & Build Provenance
+    severity: MEDIUM
+    class: supply-chain
+    applies_when: { fact: 'has:ci' }
+    check:
+      kind: grep_present
+      pattern: '(gitleaks|trufflehog|detect-secrets|secretlint|git-secrets|secret scanning)'
+      include:
+        [
+          '.github/workflows/*.yml',
+          '.github/workflows/*.yaml',
+          '.gitlab-ci.yml',
+          '.pre-commit-config.yaml',
+        ]
+      flags: i
+    why: 'A pre-commit secret scan is the cheapest control in this entire template.'
+    remediation: 'Add gitleaks as a pre-commit hook and a CI job on pull_request.'
+    references: ['OpenSSF-Scorecard:Binary-Artifacts', 'NIST-SSDF-PO.3']
+
+  - id: SUP-008
+    title: CI workflows avoid script-injection patterns
+    section: S3
+    section_title: Supply Chain & Build Provenance
+    severity: HIGH
+    class: supply-chain
+    applies_when: { fact: 'ci:github-actions' }
+    check:
+      kind: grep_absent
+      pattern: '\$\{\{\s*github\.event\.(pull_request|issue|comment|discussion|review)\.[^}]*\}\}'
+      include: ['.github/workflows/*.yml', '.github/workflows/*.yaml']
+    why: 'Interpolating untrusted event data into a `run:` block is arbitrary code execution on your runner — and on your secrets.'
+    remediation: 'Pass event data through `env:` and reference it as a shell variable instead of ${{ }} inside run.'
+    references: ['OpenSSF-Scorecard:Dangerous-Workflow', 'CWE-94']
+
+  - id: SUP-009
+    title: Workflows declare least-privilege token permissions
+    section: S3
+    section_title: Supply Chain & Build Provenance
+    severity: MEDIUM
+    class: supply-chain
+    applies_when: { fact: 'ci:github-actions' }
+    check:
+      kind: grep_present
+      # NOTE: a bare `permissions:` line proves nothing — the grants live on
+      # the following lines, which a per-line check cannot see. Only an
+      # explicit same-line `read-all`, or a scoped `contents:`/`id-token:` /
+      # `pull-requests:` grant, counts as evidence. `write-all` and bare
+      # `permissions:` yield MISSING (unverifiable), never PASS.
+      pattern: '^\s*permissions\s*:\s*read-all\s*$|^\s{2,}(contents|id-token|pull-requests)\s*:\s*(read|write)\s*$'
+      include: ['.github/workflows/*.yml', '.github/workflows/*.yaml']
+    why: 'A default GITHUB_TOKEN with write-all turns any compromised action into a supply-chain incident.'
+    remediation: 'Set `permissions: contents: read` at the top of each workflow and grant write only where needed.'
+    references: ['OpenSSF-Scorecard:Token-Permissions', 'SLSA-Build-L2']
+    tags: [github-actions]
+
+  - id: SUP-010
+    title: Third-party actions are pinned to a version or SHA
+    section: S3
+    section_title: Supply Chain & Build Provenance
+    severity: MEDIUM
+    class: supply-chain
+    applies_when: { fact: 'ci:github-actions' }
+    check:
+      kind: grep_absent
+      pattern: 'uses:\s*[^@\s]+@(main|master|latest)\s*$'
+      include: ['.github/workflows/*.yml', '.github/workflows/*.yaml']
+      flags: i
+    why: '`@main` on a third-party action means their next commit runs with your secrets.'
+    remediation: 'Pin to a full commit SHA; enable Dependabot for github-actions to keep them current.'
+    references: ['OpenSSF-Scorecard:Pinned-Dependencies']
+
+  - id: SUP-011
+    title: No secrets in CI configuration
+    section: S3
+    section_title: Supply Chain & Build Provenance
+    severity: CRITICAL
+    class: supply-chain
+    applies_when: { fact: 'has:ci' }
+    check:
+      kind: grep_absent
+      pattern: '(password|passwd|token|secret|api[_-]?key|access[_-]?key)\s*[:=]\s*[''"]?[A-Za-z0-9/+_-]{16,}'
+      include:
+        [
+          '.github/workflows/*.yml',
+          '.github/workflows/*.yaml',
+          '.gitlab-ci.yml',
+          'Jenkinsfile',
+          '.circleci/config.yml',
+          'azure-pipelines.yml',
+          '.travis.yml',
+        ]
+      flags: i
+    why: 'Values in workflow files are visible to every contributor and preserved in every fork.'
+    remediation: 'Move to repository/environment secrets and reference them as ${{ secrets.NAME }}.'
+    references: ['CWE-798', 'OpenSSF-Scorecard:Dangerous-Workflow']
+
+  - id: SUP-012
+    title: Default branch is protected
+    section: S3
+    section_title: Supply Chain & Build Provenance
+    severity: HIGH
+    class: supply-chain
+    applies_when:
+      not: { fact: 'maturity:prototype' }
+    check: { kind: manual }
+    why: >-
+      Without protection, anyone with push access can rewrite history, skip review, and ship untested code straight to main.
+    evidence: 'Branch protection settings: required review, required status checks, no force-push, no bypass for admins.'
+    remediation: 'Require ≥1 review, dismiss stale approvals, require CI to pass, and block force-push on the default branch.'
+    references: ['OpenSSF-Scorecard:Branch-Protection', 'SLSA-Source-L2', 'NIST-SSDF-PO.2']
+
+  - id: SUP-013
+    title: Commits are signed or attested
+    section: S3
+    section_title: Supply Chain & Build Provenance
+    severity: LOW
+    class: supply-chain
+    applies_when:
+      any:
+        - { fact: 'maturity:production' }
+        - { fact: 'maturity:beta' }
+    check:
+      kind: grep_present
+      pattern: '(actions/attest|sigstore|slsa-framework|gpg-sign|commit\.gpgsign|ssh-sign|gh attestation)'
+      include: ['.github/workflows/*.yml', '.github/workflows/*.yaml', '.git/config', '.gitconfig']
+      flags: i
+    why: 'Unsigned history means anyone with push access can forge a commit attributed to someone else.'
+    remediation: 'Enable commit signing, then add build provenance attestation to your release workflow.'
+    references: ['SLSA-Build-L2', 'OpenSSF-Scorecard:Signed-Releases']
+
+  - id: SUP-014
+    title: An SBOM is generated for releases
+    section: S3
+    section_title: Supply Chain & Build Provenance
+    severity: LOW
+    class: supply-chain
+    applies_when:
+      any:
+        - { fact: 'maturity:production' }
+        - { fact: 'maturity:beta' }
+    check:
+      kind: grep_present
+      pattern: '(cyclonedx|spdx|sbom|anchore/sbom-action|syft)'
+      include:
+        [
+          '.github/workflows/*.yml',
+          '.github/workflows/*.yaml',
+          'Makefile',
+          'justfile',
+          'Taskfile.yml',
+        ]
+      exclude: ['**/node_modules/**']
+      flags: i
+    why: 'When the next Log4Shell drops, the first question is "are we affected?" An SBOM is the answer in seconds.'
+    remediation: 'Generate a CycloneDX or SPDX SBOM in CI and publish it with the release.'
+    references: ['SLSA', 'NIST-SSDF-PS.3.2', 'EU-CRA-Annex-I']
+
+  - id: SUP-015
+    title: Release artifacts carry provenance attestation
+    section: S3
+    section_title: Supply Chain & Build Provenance
+    severity: FUTURE
+    class: supply-chain
+    applies_when: { fact: 'maturity:production' }
+    check: { kind: manual }
+    why: >-
+      When an artifact is compromised, provenance is the only thing that answers "was this built by us, from this source?"
+    evidence: 'Release workflow producing a SLSA/in-toto attestation, verified at deploy time by consumers.'
+    remediation: 'Enable GitHub Artifact Attestations (SLSA Build L2 by default) or npm trusted publishing; verify with slsa-verifier.'
+    references: ['SLSA-Build-L2', 'SLSA-v1.2']
+
+  - id: SUP-016
+    title: Container images are scanned before publish
+    section: S3
+    section_title: Supply Chain & Build Provenance
+    severity: MEDIUM
+    class: supply-chain
+    applies_when: { fact: 'has:containers' }
+    check:
+      kind: grep_present
+      pattern: '(trivy|grype|snyk container|docker scan|anchore|cosign)'
+      include:
+        [
+          '.github/workflows/*.yml',
+          '.github/workflows/*.yaml',
+          '.gitlab-ci.yml',
+          'Dockerfile*',
+          'Makefile',
+          'justfile',
+        ]
+      flags: i
+    why: 'Base images ship CVEs. Scanning at build time is the last cheap moment to catch them.'
+    remediation: 'Add trivy/grype to the image pipeline; fail on HIGH/CRITICAL; sign images with cosign.'
+    references: ['SLSA-Build-L2', 'NIST-SSDF-RV.1.1']
+
+  - id: SUP-017
+    title: Build pipeline is reproducible from source
+    section: S3
+    section_title: Supply Chain & Build Provenance
+    severity: FUTURE
+    class: supply-chain
+    depths: [deep]
+    check: { kind: manual }
+    why: >-
+      A build that cannot be reproduced cannot be verified, and an unverifiable build is an unverifiable supply chain.
+    evidence: 'A clean-machine build from a fresh clone produces a byte-identical (or digest-stable) artifact.'
+    remediation: 'Pin toolchains, vendor dependencies, remove timestamps, and document the build environment.'
+    references: ['SLSA-Build-L3', 'Reproducible-Builds']

package/rules/core/testing.yaml

@@ -0,0 +1,266 @@
+id: core/testing
+title: Testing & Quality Assurance
+section: S7
+section_title: Testing & Quality Assurance
+description: >
+  Coverage is a weak proxy for confidence; USA separates "tests exist",
+  "tests run in CI", and "tests actually cover the paths that matter".
+version: '1.0'
+
+rules:
+  - id: TEST-001
+    title: A test suite exists
+    section: S7
+    section_title: Testing & Quality Assurance
+    severity: HIGH
+    class: correctness
+    check:
+      kind: any_file
+      patterns:
+        - '**/*.test.{ts,tsx,js,jsx,mjs,cjs}'
+        - '**/*.spec.{ts,tsx,js,jsx,mjs,cjs}'
+        - '**/test_*.py'
+        - '**/*_test.py'
+        - '**/*_test.go'
+        - '**/*_spec.rb'
+        - '**/*Test.java'
+        - '**/*Test.kt'
+        - '**/*Test.php'
+        - '**/tests/**/*.rs'
+        - '**/__tests__/**'
+        - '**/Tests/**/*.swift'
+        - '**/*Tests.swift'
+    why: 'A project with zero tests has no definition of "working" that a machine can check.'
+    remediation: 'Start with the happy path of the main flow and every bug you have already fixed once.'
+    references: ['OpenSSF-Scorecard:CI-Tests', 'NIST-SSDF-RV.1.1']
+
+  - id: TEST-002
+    title: Tests run in CI on every pull request
+    section: S7
+    section_title: Testing & Quality Assurance
+    severity: HIGH
+    class: operations
+    applies_when: { fact: 'has:ci' }
+    check:
+      kind: grep_present
+      pattern: '(npm (run )?test|npm (run )?test:ci|vitest run|jest --ci|pytest|go test|cargo test|swift test|mvn test|gradle test|rspec|phpunit|dotnet test|make test)'
+      include:
+        [
+          '.github/workflows/*.yml',
+          '.github/workflows/*.yaml',
+          '.gitlab-ci.yml',
+          'Jenkinsfile',
+          '.circleci/config.yml',
+          'azure-pipelines.yml',
+          '.buildkite/**',
+        ]
+      flags: i
+    why: 'Tests that only run on a laptop are a memoir, not a control.'
+    remediation: 'Run the full suite on pull_request and on push to the default branch; block merge on failure.'
+    references: ['OpenSSF-Scorecard:CI-Tests', 'NIST-SSDF-PW.7']
+
+  - id: TEST-003
+    title: There is a meaningful number of tests
+    section: S7
+    section_title: Testing & Quality Assurance
+    severity: MEDIUM
+    class: correctness
+    applies_when: { fact: 'has:tests' }
+    check:
+      kind: count_min
+      patterns:
+        - '**/*.test.{ts,tsx,js,jsx,mjs,cjs}'
+        - '**/*.spec.{ts,tsx,js,jsx,mjs,cjs}'
+        - '**/test_*.py'
+        - '**/*_test.py'
+        - '**/*_test.go'
+        - '**/*_spec.rb'
+        - '**/*Test.java'
+      min: 5
+    why: 'One test file is a gesture. Five is a habit.'
+    remediation: 'Target the paths that carry money or data first: auth, payments, persistence, permissions.'
+    references: ['OpenSSF-Scorecard:CI-Tests']
+
+  - id: TEST-004
+    title: Coverage is measured
+    section: S7
+    section_title: Testing & Quality Assurance
+    severity: MEDIUM
+    class: correctness
+    applies_when: { fact: 'has:tests' }
+    check:
+      kind: grep_present
+      pattern: '(--coverage|--cov\b|coverage[_-]?threshold|coverageThreshold|--fail-under|codecov|coveralls|lcov|c8|nyc|go test -cover|tarpaulin|llvm-cov)'
+      include:
+        [
+          'package.json',
+          'pyproject.toml',
+          'setup.cfg',
+          '.coveragerc',
+          'Makefile',
+          'justfile',
+          'Taskfile.yml',
+          '.github/workflows/*.yml',
+          '.github/workflows/*.yaml',
+          'vitest.config.*',
+          'jest.config.*',
+        ]
+      flags: i
+    why: 'Unmeasured coverage drifts down silently, one "I''ll add tests later" at a time.'
+    remediation: 'Turn on coverage reporting; publish the number on every PR so it is visible when it moves.'
+    references: ['NIST-SSDF-RV.1.1']
+
+  - id: TEST-005
+    title: Coverage thresholds are enforced
+    section: S7
+    section_title: Testing & Quality Assurance
+    severity: LOW
+    class: correctness
+    applies_when:
+      any:
+        - { fact: 'maturity:production' }
+        - { fact: 'maturity:beta' }
+    check:
+      kind: grep_present
+      # NOTE: `coverage\s*:\s*\{` covers Vitest-style `coverage: { thresholds:
+      # … }` blocks — the earlier `coverage\s*{` (no colon) missed exactly
+      # the config form this repo itself uses, so the rule failed USA's own
+      # self-audit the week thresholds were added. Keep both alternatives.
+      pattern: '(coverageThreshold|failUnder|--fail-under|min-coverage|coverage\s*\{|coverage\s*:\s*\{|\[tool\.coverage\.report\]\s*\n[^\n]*fail_under)'
+      include:
+        [
+          'package.json',
+          'vitest.config.*',
+          'jest.config.*',
+          'pyproject.toml',
+          'setup.cfg',
+          '.coveragerc',
+          'codecov.yml',
+          '.codecov.yml',
+          'Cargo.toml',
+        ]
+      flags: i
+    why: "A gate stops the slide. Set it at today's number and ratchet upward."
+    remediation: 'Set a floor slightly below current coverage and raise it whenever it is comfortably met.'
+    references: ['NIST-SSDF-RV.1.1']
+
+  - id: TEST-006
+    title: Integration tests cover the seams
+    section: S7
+    section_title: Testing & Quality Assurance
+    severity: MEDIUM
+    class: correctness
+    applies_when:
+      any:
+        - { fact: 'has:database' }
+        - { fact: 'platform:server' }
+        - { fact: 'project:api' }
+    check: { kind: manual }
+    evidence: 'Tests that exercise a real database/queue/HTTP boundary (or a containerised test double) rather than mocking every collaborator.'
+    why: 'Unit tests with everything mocked verify your mock, not your integration.'
+    remediation: 'Add tests that run against a real Postgres/Redis via testcontainers or a docker-compose test profile.'
+    references: ['Testing-Trophy']
+
+  - id: TEST-007
+    title: End-to-end tests cover critical user journeys
+    section: S7
+    section_title: Testing & Quality Assurance
+    severity: MEDIUM
+    class: correctness
+    applies_when:
+      any:
+        - { fact: 'platform:web' }
+        - { fact: 'platform:mobile' }
+        - { fact: 'maturity:production' }
+    check:
+      kind: any_file
+      patterns:
+        [
+          'e2e/**',
+          'cypress/**',
+          'playwright.config.*',
+          'tests/e2e/**',
+          '**/*.e2e.{ts,js,py}',
+          '**/*.cy.{ts,js}',
+          '**/spec/features/**',
+        ]
+    why: 'Unit tests cannot tell you that checkout is broken because a button moved.'
+    remediation: 'Three journeys: sign up/log in, the core money path, and the path that would lose data if it failed.'
+    references: ['Testing-Trophy']
+
+  - id: TEST-008
+    title: Security-relevant behaviour is tested
+    section: S7
+    section_title: Testing & Quality Assurance
+    severity: MEDIUM
+    class: security
+    applies_when:
+      any:
+        - { fact: 'auth:jwt' }
+        - { fact: 'auth:session' }
+        - { fact: 'auth:oauth' }
+        - { fact: 'has:database' }
+    check: { kind: manual }
+    evidence: "Tests asserting that user A cannot read or modify user B's resources, and that unauthenticated calls are rejected."
+    why: 'Authorization regressions are silent: nothing crashes, someone just sees data they should not.'
+    remediation: 'Add negative tests for every permission boundary — 401/403 paths and cross-tenant access attempts.'
+    references: ['ASVS-4.2.1', 'OWASP-A01:2021']
+
+  - id: TEST-009
+    title: Tests are independent and deterministic
+    section: S7
+    section_title: Testing & Quality Assurance
+    severity: MEDIUM
+    class: correctness
+    applies_when: { fact: 'has:tests' }
+    check: { kind: manual }
+    evidence: 'Run the suite in random order and twice in a row. Report failures and any test that depends on wall-clock time or network.'
+    why: 'Order-dependent tests are a distributed system with extra steps, and flaky tests train people to ignore red builds.'
+    remediation: 'Reset state per test; freeze the clock; seed randomness. Quarantine flaky tests and fix them within a sprint.'
+    references: ['Google-Testing-Blog:Flaky']
+
+  - id: TEST-010
+    title: Performance/load tests exist for critical paths
+    section: S7
+    section_title: Testing & Quality Assurance
+    severity: FUTURE
+    class: performance
+    applies_when:
+      any:
+        - { fact: 'maturity:production' }
+        - { fact: 'maturity:beta' }
+    check: { kind: manual }
+    evidence: 'A load-test script (k6, Locust, wrk, artillery) and the last recorded p95/p99 for the main endpoint.'
+    why: 'You do not know your ceiling until you have hit it.'
+    remediation: 'Script the top three endpoints; run them before each release; record the numbers.'
+    references: ['ISO-25010']
+
+  - id: TEST-011
+    title: Mutation testing or equivalent
+    section: S7
+    section_title: Testing & Quality Assurance
+    severity: FUTURE
+    class: correctness
+    depths: [deep]
+    check: { kind: manual }
+    evidence: 'Astryx/Stryker/mutmut/cargo-mutants score, or a documented decision not to use it.'
+    why: 'Coverage tells you which lines ran, not whether the test would have failed if the line were wrong.'
+    remediation: 'Run mutation testing on the highest-risk module first.'
+    references: ['Mutation-Testing']
+
+  - id: TEST-012
+    title: Test data comes from fixtures or factories
+    section: S7
+    section_title: Testing & Quality Assurance
+    severity: LOW
+    class: maintainability
+    applies_when: { fact: 'has:tests' }
+    check:
+      kind: grep_present
+      pattern: '(factory|fixture|faker|builder|testcontainers|factories)'
+      include: ['**/*.{ts,tsx,js,jsx,py,go,rs,java,kt,rb}']
+      exclude: ['**/node_modules/**']
+      flags: i
+    why: 'Hand-built object literals in 200 tests make every schema change a 200-file migration.'
+    remediation: 'Add a factory (fishery, factory_boy, faker) and generate data at the edges of tests.'
+    references: ['Testing-Patterns']