peer-ai-standards 1.0.0-next.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Qudus Lawal
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,62 @@
+# peer-ai-standards
+
+Peer AI's engineering standards: the rules every project follows, in any language.
+
+- **Readable pages:** [`docs/`](https://github.com/AbuMahir980/peer-ai/blob/main/packages/standards/docs/README.md), one page per domain, and one per stack profile in [`docs/profiles/`](https://github.com/AbuMahir980/peer-ai/blob/main/packages/standards/docs/README.md#stack-profiles).
+- **The rules themselves:** `src/core/`, written as typed data, so Peer AI's review can cite them and `standards_for_file` can hand the right ones to an AI tool.
+- **Stack profiles:** `src/profiles/`, how to follow the core rules in one stack, and the tool that enforces each automatic rule.
+- **The design:** [RFC 0003](https://github.com/AbuMahir980/peer-ai/blob/main/rfcs/0003-how-a-standard-is-written.md) for the rules, and [RFC 0006](https://github.com/AbuMahir980/peer-ai/blob/main/rfcs/0006-stack-profiles-and-their-enforcers.md) for the profiles.
+
+## What every rule has
+
+| Part | What it says |
+|------|--------------|
+| ID | Stable and never reused, such as `MONEY-01` |
+| Rule | The rule, in plain words |
+| Why | What goes wrong without it |
+| Ask | The question a reviewer answers |
+| Applies from | Prototype, MVP or production |
+| Checked by | A tool, AI review, or a person |
+| Severity | How serious breaking it usually is |
+| Applies when | The traits a product needs for the rule to apply, such as `money` |
+| Source | The outside standard it comes from, such as OWASP, where there is one |
+
+## Choosing the rules that apply
+
+```ts
+import { rulesFor } from "peer-ai-standards";
+
+rulesFor({ stage: "mvp", traits: ["money"], domains: ["money", "code-quality"] });
+```
+
+## Adding or changing a rule
+
+1. Add or edit it in `src/core/`. A rule with a missing part, an id that doesn't match its domain, or an id used twice fails the build.
+2. Regenerate the pages: `pnpm --filter peer-ai-standards generate`. A test fails if you forget.
+3. Changing what an existing rule requires needs an RFC.
+
+## Stack profiles
+
+A profile rule has every part a core rule has, and four more:
+
+| Part | What it says |
+|------|--------------|
+| Carries | The core rule it carries out, such as `CODE-14` |
+| Architectures | The architecture labels it applies to, such as `layered`; none means every architecture |
+| Default | A number or choice the project may change in `standards.overrides`, which `{value}` in its text stands for |
+| Enforcer | For an automatic rule, the tool and setting that checks it, such as ESLint's `max-depth` |
+
+A project lists its profiles in `standards.profiles`. A profile applies to a part whose stack has one of its tags, and brings the profiles it builds on:
+
+```ts
+import { profileRulesFor } from "peer-ai-standards";
+
+profileRulesFor({ listed: ["typescript"], stack: ["typescript", "react"], stage: "mvp" });
+```
+
+## Adding a profile or a profile rule
+
+1. Add the profile to `src/profiles/`, and list it in `src/index.ts`. A rule that carries no core rule, an id without the profile's prefix, or an automatic rule without its enforcer and examples fails the build.
+2. Give each automatic rule an example that must fail and one that must pass. The tests run the real tool on both: the compiler here, ESLint in `peer-ai-eslint-config`, and Ruff in `peer-ai`, through `@astral-sh/ruff-wasm-nodejs`. The GitHub Actions profile's examples are proven in CI instead: `scripts/pipeline-proof.ts` installs the tools its pipeline uses and runs them on each example.
+3. Regenerate the pages: `pnpm --filter peer-ai-standards generate`.
+4. A new profile doesn't need an RFC; changing what a rule requires does.

package/dist/core/ai-features.d.ts

@@ -0,0 +1,65 @@
+export declare const aiFeatures: ({
+    id: string;
+    domain: "ai-features";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "prototype";
+    check: "ai-review";
+    severity: "high";
+    when: "ai-features"[];
+    sources: {
+        name: string;
+        ref: string;
+        url: string;
+    }[];
+} | {
+    id: string;
+    domain: "ai-features";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "mvp";
+    check: "ai-review";
+    severity: "high";
+    when: "ai-features"[];
+    sources: {
+        name: string;
+        ref: string;
+        url: string;
+    }[];
+} | {
+    id: string;
+    domain: "ai-features";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "prototype";
+    check: "ai-review";
+    severity: "medium";
+    when: "ai-features"[];
+    sources: {
+        name: string;
+        ref: string;
+        url: string;
+    }[];
+} | {
+    id: string;
+    domain: "ai-features";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "mvp";
+    check: "ai-review";
+    severity: "medium";
+    when: "ai-features"[];
+    sources: {
+        name: string;
+        ref: string;
+        url: string;
+    }[];
+})[];

package/dist/core/ai-features.js

@@ -0,0 +1,113 @@
+// For products with the ai-features trait: features that use AI models. Rules cite the entry of
+// the OWASP Top 10 for Large Language Model Applications (2025) they come from, checked against
+// OWASP's own repository.
+const LLM = "OWASP Top 10 for LLM Applications 2025";
+const entry = (file) => `https://github.com/OWASP/www-project-top-10-for-large-language-model-applications/blob/main/2_0_vulns/${file}.md`;
+export const aiFeatures = [
+    {
+        id: "AI-01",
+        domain: "ai-features",
+        title: "An AI's output is untrusted input",
+        rule: "Output from an AI model is checked and escaped like any outside input before it's shown, stored, or passed to code, a database, a shell or another service.",
+        why: "What a model says can be steered by what it was given, so its output can carry an attack as easily as a user's input can.",
+        ask: "Is every AI output in this change checked and escaped before it's used?",
+        stage: "prototype",
+        check: "ai-review",
+        severity: "high",
+        when: ["ai-features"],
+        sources: [{ name: LLM, ref: "LLM05, Improper Output Handling", url: entry("LLM05_ImproperOutputHandling") }],
+    },
+    {
+        id: "AI-02",
+        domain: "ai-features",
+        title: "An AI's guess is never shown as fact",
+        rule: "An AI's answer is shown as a suggestion, never as fact. Anything about safety, health, money or the law also tells the person to check with someone qualified.",
+        why: "Models state wrong answers as confidently as right ones, and a wrong answer about whether a plant is safe for a pet can hurt someone.",
+        ask: "Does this change show any AI answer as fact, or give safety advice without telling the person to check?",
+        stage: "prototype",
+        check: "ai-review",
+        severity: "high",
+        when: ["ai-features"],
+        sources: [{ name: LLM, ref: "LLM09, Misinformation", url: entry("LLM09_Misinformation") }],
+    },
+    {
+        id: "AI-03",
+        domain: "ai-features",
+        title: "People know what's sent to an AI service, and nothing sensitive goes without need",
+        rule: "People are told what's sent to an AI service before it's sent. Personal or sensitive data is sent only when the feature needs it, and removed when it doesn't.",
+        why: "Data sent to a model provider can be logged, kept or used for training, and people didn't agree to that just by using a feature.",
+        ask: "Does this change send an AI service anything people haven't been told about, or don't need to send?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "high",
+        when: ["ai-features"],
+        sources: [
+            { name: LLM, ref: "LLM02, Sensitive Information Disclosure", url: entry("LLM02_SensitiveInformationDisclosure") },
+        ],
+    },
+    {
+        id: "AI-04",
+        domain: "ai-features",
+        title: "Content can't change what the model is allowed to do",
+        rule: "Instructions to the model and the content it works on are kept apart, and the model's permissions are enforced outside it, so text in a document, email or web page can't change what it's allowed to do.",
+        why: "A line hidden in a web page can tell a model to ignore its instructions, and the model can't reliably tell instructions from content.",
+        ask: "Could content the model reads in this change make it do something it shouldn't?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "high",
+        when: ["ai-features"],
+        sources: [{ name: LLM, ref: "LLM01, Prompt Injection", url: entry("LLM01_PromptInjection") }],
+    },
+    {
+        id: "AI-05",
+        domain: "ai-features",
+        title: "An AI does only what it needs to, and a person confirms what matters",
+        rule: "An AI can call only the tools and data its task needs, with the least permission they allow, and anything that moves money, changes data or acts on someone's account needs a person's confirmation.",
+        why: "A model given broad powers will eventually use them wrongly, whether by mistake or because someone tricked it.",
+        ask: "Does the AI in this change have more access than its task needs, or act on anything important without confirmation?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "high",
+        when: ["ai-features"],
+        sources: [{ name: LLM, ref: "LLM06, Excessive Agency", url: entry("LLM06_ExcessiveAgency") }],
+    },
+    {
+        id: "AI-06",
+        domain: "ai-features",
+        title: "Instructions to the model hold no secrets",
+        rule: "The instructions given to a model hold no secrets, credentials or rules that only work if nobody sees them.",
+        why: "People can get a model to repeat its instructions, so anything in them should be safe to read.",
+        ask: "Do the model's instructions in this change hold anything that would matter if someone read them?",
+        stage: "prototype",
+        check: "ai-review",
+        severity: "medium",
+        when: ["ai-features"],
+        sources: [{ name: LLM, ref: "LLM07, System Prompt Leakage", url: entry("LLM07_SystemPromptLeakage") }],
+    },
+    {
+        id: "AI-07",
+        domain: "ai-features",
+        title: "AI calls have limits",
+        rule: "Every call to an AI service has a timeout and a size limit, and each person has a spending or usage limit.",
+        why: "AI calls are slow and paid per use, so one runaway loop or one abusive user can take the feature down or run up a large bill.",
+        ask: "Does every AI call in this change have a timeout, a size limit and a per-person limit?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "medium",
+        when: ["ai-features"],
+        sources: [{ name: LLM, ref: "LLM10, Unbounded Consumption", url: entry("LLM10_UnboundedConsumption") }],
+    },
+    {
+        id: "AI-08",
+        domain: "ai-features",
+        title: "An AI feature is tested on fixed examples, attacks included",
+        rule: "An AI feature has a set of example inputs with the behaviour expected for each, including attacks such as prompt injection and attempts to make it leak data or go beyond its permissions. They're run before every change to its instructions or its model.",
+        why: "A small change to a prompt or a model version can quietly break answers that used to be right, and a model that resisted an attack last month may not after an update.",
+        ask: "Were the AI feature's examples, attacks included, run for this change to its instructions or model?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "medium",
+        when: ["ai-features"],
+        sources: [{ name: LLM, ref: "LLM01, Prompt Injection", url: entry("LLM01_PromptInjection") }],
+    },
+];

package/dist/core/api-design.d.ts

@@ -0,0 +1,41 @@
+export declare const apiDesign: ({
+    id: string;
+    domain: "api-design";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "mvp";
+    check: "ai-review";
+    severity: "medium";
+} | {
+    id: string;
+    domain: "api-design";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "mvp";
+    check: "ai-review";
+    severity: "high";
+} | {
+    id: string;
+    domain: "api-design";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "mvp";
+    check: "auto";
+    severity: "medium";
+} | {
+    id: string;
+    domain: "api-design";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "mvp";
+    check: "ai-review";
+    severity: "low";
+})[];

package/dist/core/api-design.js

@@ -0,0 +1,91 @@
+// How services and clients agree on what they send each other.
+export const apiDesign = [
+    {
+        id: "API-01",
+        domain: "api-design",
+        title: "Requests and responses are typed schemas",
+        rule: "Every request and response body is a typed schema, not a loose map or dictionary. The schema is the contract.",
+        why: "A loose response becomes a loose client type, in every app that uses the API, at once.",
+        ask: "Is every request and response body in this change a typed schema?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "medium",
+    },
+    {
+        id: "API-02",
+        domain: "api-design",
+        title: "The contract has one source of truth",
+        rule: "The API's contract has one source of truth, whether it's generated from the code's schemas or written by hand, and every client works from it.",
+        why: "Two descriptions of one API disagree, and the client finds out in production.",
+        ask: "Does this change keep the API contract's one source of truth up to date?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "high",
+    },
+    {
+        id: "API-03",
+        domain: "api-design",
+        title: "Client types come from the contract",
+        rule: "Client code gets its API types from the contract, never by writing them by hand, and CI fails if they fall behind it.",
+        why: "Hand-written types are a copy of the contract that silently goes out of date.",
+        ask: "Does this change write any API type by hand instead of generating it from the contract?",
+        stage: "mvp",
+        check: "auto",
+        severity: "medium",
+    },
+    {
+        id: "API-04",
+        domain: "api-design",
+        title: "Errors have one shape",
+        rule: "Every error response from the API has the same shape.",
+        why: "A client that has to handle four error formats will handle three of them.",
+        ask: "Does every error in this change use the API's one error shape?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "medium",
+    },
+    {
+        id: "API-05",
+        domain: "api-design",
+        title: "Lists have one shape",
+        rule: "Every list response has the same shape, everywhere in the API. The profile gives a default.",
+        why: "A client can't write one list component against four conventions.",
+        ask: "Does every list in this change use the API's one list shape?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "low",
+    },
+    {
+        id: "API-06",
+        domain: "api-design",
+        title: "Changing a field breaks clients: add, migrate, then remove",
+        rule: "Adding a field is safe. Removing, renaming or retyping one breaks clients, so it's done in steps: add the new one, move every client across, then remove the old one.",
+        why: "Clients aren't updated at the same moment as the server, and some, like installed phone apps, are never updated at all.",
+        ask: "Does this change remove, rename or retype a field that clients may still use?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "high",
+    },
+    {
+        id: "API-07",
+        domain: "api-design",
+        title: "Every list is paged",
+        rule: "Every endpoint that returns a list returns it a page at a time. None returns everything.",
+        why: "An endpoint that returns everything passes every test on sample data, then falls over on real data.",
+        ask: "Does every list endpoint in this change return pages?",
+        stage: "mvp",
+        check: "auto",
+        severity: "medium",
+    },
+    {
+        id: "API-08",
+        domain: "api-design",
+        title: "Page sizes come from one place",
+        rule: "The default and largest page sizes come from one shared place, not each endpoint's own numbers.",
+        why: '"What\'s the largest page a client can ask for?" should have one answer, especially under load.',
+        ask: "Does this change set a page size anywhere other than the shared place?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "low",
+    },
+];

package/dist/core/architecture.d.ts

@@ -0,0 +1,41 @@
+export declare const architecture: ({
+    id: string;
+    domain: "architecture";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "prototype";
+    check: "ai-review";
+    severity: "medium";
+} | {
+    id: string;
+    domain: "architecture";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "mvp";
+    check: "ai-review";
+    severity: "medium";
+} | {
+    id: string;
+    domain: "architecture";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "mvp";
+    check: "auto";
+    severity: "medium";
+} | {
+    id: string;
+    domain: "architecture";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "mvp";
+    check: "ai-review";
+    severity: "high";
+})[];

package/dist/core/architecture.js

@@ -0,0 +1,93 @@
+// How a system is divided, and which way its parts depend on each other. These hold for any
+// architecture: a modular monolith, microservices, a mobile app or a library. A folder layout
+// is a stack profile's default, never a core rule.
+export const architecture = [
+    {
+        id: "ARC-01",
+        domain: "architecture",
+        title: "Code is judged against the project's own architecture",
+        rule: "Code is judged against the architecture the project has declared (its tracks, each track's architecture and its decision records), never against a structure from somewhere else.",
+        why: "A review that expects a layout the project never chose buries the real problems under false ones.",
+        ask: "Does this review check the code against the architecture the project declared?",
+        stage: "prototype",
+        check: "ai-review",
+        severity: "medium",
+    },
+    {
+        id: "ARC-02",
+        domain: "architecture",
+        title: "One module owns each area",
+        rule: "Each area of the business is owned by one module. Another area that needs its logic calls it; it never copies it.",
+        why: "Two implementations of one business rule will disagree, and nobody will know which is right.",
+        ask: "Does this change put its logic in the module that owns that area?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "medium",
+    },
+    {
+        id: "ARC-03",
+        domain: "architecture",
+        title: "Modules don't reach into each other's internals",
+        rule: "A module has a deliberate public surface, and nothing uses its internals. Something several modules need is moved somewhere shared and named honestly.",
+        why: "Marking something internal tells the next person they may change it freely. Using it from elsewhere breaks that promise, and the break shows up later as someone else's bug.",
+        ask: "Does anything in this change use another module's internals?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "medium",
+    },
+    {
+        id: "ARC-04",
+        domain: "architecture",
+        title: "Business rules are plain code",
+        rule: "Business rules, calculations and validation live in plain code, with no database, network, framework or user interface in it, so they can be tested with plain values.",
+        why: "Rules tangled with a framework can only be tested slowly and partly. Plain rules can be tested exhaustively, which is where the hardest rules need it most.",
+        ask: "Could the business logic in this change be tested without a database, a network or a user interface?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "medium",
+    },
+    {
+        id: "ARC-05",
+        domain: "architecture",
+        title: "Business logic doesn't know how it's called",
+        rule: "Business logic never deals in HTTP: no status codes, no request objects, no HTTP errors. It raises or returns its own errors, and the layer that received the request translates them.",
+        why: "Logic that knows about HTTP can't be reused by a background job, a script or a different interface.",
+        ask: "Does any business logic in this change refer to HTTP?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "medium",
+    },
+    {
+        id: "ARC-06",
+        domain: "architecture",
+        title: "Dependencies point inward",
+        rule: "Code depends toward the business rules, never away from them, and features don't depend on each other.",
+        why: "Without a direction, every part ends up coupled to every other, and nothing can change on its own.",
+        ask: "Does any dependency in this change point outward, or from one feature to another?",
+        stage: "mvp",
+        check: "auto",
+        severity: "medium",
+    },
+    {
+        id: "ARC-07",
+        domain: "architecture",
+        title: "Data is reached through an interface",
+        rule: "Screens and business logic reach data through an interface, never a storage engine or the network directly.",
+        why: "Then changing where data lives, from local storage to an API or from one API to another, touches one place.",
+        ask: "Does anything outside the data layer talk to storage or the network directly?",
+        stage: "mvp",
+        check: "auto",
+        severity: "medium",
+    },
+    {
+        id: "ARC-08",
+        domain: "architecture",
+        title: "There is one managed way to reach the database",
+        rule: "The database is reached one managed way, so transactions and connection pooling can't be bypassed.",
+        why: "Code that opens its own connection escapes the transaction it should be part of, and exhausts the connection pool under load.",
+        ask: "Does anything in this change open its own database connection?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "high",
+    },
+];

package/dist/core/backend.d.ts

@@ -0,0 +1,21 @@
+export declare const backend: ({
+    id: string;
+    domain: "backend";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "prototype";
+    check: "ai-review";
+    severity: "high";
+} | {
+    id: string;
+    domain: "backend";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "mvp";
+    check: "ai-review";
+    severity: "medium";
+})[];

package/dist/core/backend.js

@@ -0,0 +1,25 @@
+// How servers take requests and report what happened, whatever the language or framework.
+export const backend = [
+    {
+        id: "BE-01",
+        domain: "backend",
+        title: "A failed operation is reported as failed",
+        rule: "An operation that didn't happen is never reported as done: a payment that didn't go through is never shown as sent.",
+        why: "A false success is worse than an error. The person relies on it, and the problem surfaces much later, somewhere else.",
+        ask: "Could anything in this change report success for an operation that failed?",
+        stage: "prototype",
+        check: "ai-review",
+        severity: "high",
+    },
+    {
+        id: "BE-02",
+        domain: "backend",
+        title: "Request bodies have a size limit",
+        rule: "The server limits how large a request body can be, with a limit that fits what each endpoint really needs.",
+        why: "Without a limit, one oversized request can use up a server's memory and take it down for everyone.",
+        ask: "Does every endpoint in this change have a sensible limit on the size of what it accepts?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "medium",
+    },
+];

package/dist/core/code-quality.d.ts

@@ -0,0 +1,91 @@
+export declare const codeQuality: ({
+    id: string;
+    domain: "code-quality";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "prototype";
+    check: "ai-review";
+    severity: "low";
+} | {
+    id: string;
+    domain: "code-quality";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "mvp";
+    check: "ai-review";
+    severity: "low";
+} | {
+    id: string;
+    domain: "code-quality";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "prototype";
+    check: "ai-review";
+    severity: "high";
+} | {
+    id: string;
+    domain: "code-quality";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "mvp";
+    check: "ai-review";
+    severity: "medium";
+} | {
+    id: string;
+    domain: "code-quality";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "mvp";
+    check: "auto";
+    severity: "low";
+} | {
+    id: string;
+    domain: "code-quality";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "prototype";
+    check: "auto";
+    severity: "high";
+} | {
+    id: string;
+    domain: "code-quality";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "mvp";
+    check: "auto";
+    severity: "medium";
+} | {
+    id: string;
+    domain: "code-quality";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "prototype";
+    check: "auto";
+    severity: "medium";
+} | {
+    id: string;
+    domain: "code-quality";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "prototype";
+    check: "ai-review";
+    severity: "medium";
+})[];