peer-ai-standards 1.0.0-next.0

package/dist/core/money.d.ts

@@ -0,0 +1,81 @@
+export declare const money: ({
+    id: string;
+    domain: "money";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "prototype";
+    check: "auto";
+    severity: "critical";
+} | {
+    id: string;
+    domain: "money";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "mvp";
+    check: "ai-review";
+    severity: "high";
+} | {
+    id: string;
+    domain: "money";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "prototype";
+    check: "ai-review";
+    severity: "high";
+} | {
+    id: string;
+    domain: "money";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "prototype";
+    check: "auto";
+    severity: "medium";
+} | {
+    id: string;
+    domain: "money";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "mvp";
+    check: "auto";
+    severity: "high";
+} | {
+    id: string;
+    domain: "money";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "mvp";
+    check: "ai-review";
+    severity: "critical";
+} | {
+    id: string;
+    domain: "money";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "production";
+    check: "ai-review";
+    severity: "medium";
+} | {
+    id: string;
+    domain: "money";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "prototype";
+    check: "ai-review";
+    severity: "critical";
+})[];

package/dist/core/money.js

@@ -0,0 +1,135 @@
+// For products with the money trait. The project's add-on names its currency's smallest unit.
+export const money = [
+    {
+        id: "MONEY-01",
+        domain: "money",
+        title: "Money is a whole number in the currency's smallest unit",
+        rule: "Money is stored and calculated as a whole number in the currency's smallest unit (pence, kobo, cents), and named for it, such as `amountMinor` or `amount_minor`. A decimal number touching money is a critical problem on sight, even for display.",
+        why: "Decimal fractions can't hold most money amounts exactly. The errors are tiny, silent, and they add up.",
+        ask: "Is any money held or calculated as a decimal number?",
+        stage: "prototype",
+        check: "auto",
+        severity: "critical",
+    },
+    {
+        id: "MONEY-02",
+        domain: "money",
+        title: "Each amount has one authoritative value",
+        rule: "Each amount has one authoritative field. Any other copy is a mirror on its way out, and deciding anything from it is a defect, even when it gives the right answer.",
+        why: "Two copies of an amount drift apart, and a decision made from the wrong one is wrong in a way nobody notices.",
+        ask: "Does any decision in this change read a copy of an amount rather than its authoritative value?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "high",
+    },
+    {
+        id: "MONEY-03",
+        domain: "money",
+        title: "Money maths has one implementation",
+        rule: "Rounding, splitting, conversion and commission each have exactly one implementation, used everywhere.",
+        why: "A second implementation will disagree with the first, a penny at a time.",
+        ask: "Does this change calculate money anywhere other than the one money module?",
+        stage: "prototype",
+        check: "ai-review",
+        severity: "high",
+    },
+    {
+        id: "MONEY-04",
+        domain: "money",
+        title: "Money is formatted in one place",
+        rule: "Every amount shown to a person goes through one formatting function.",
+        why: "Two formatters show the same amount two ways, and people stop trusting the numbers.",
+        ask: "Does this change format money anywhere other than the one formatter?",
+        stage: "prototype",
+        check: "auto",
+        severity: "medium",
+    },
+    {
+        id: "MONEY-05",
+        domain: "money",
+        title: "No money maths in the user interface",
+        rule: "Totals come from the server or from tested money code, never from arithmetic in a screen.",
+        why: "Maths in a screen is untested, and a screen that shows a different total from the receipt is a support call at best.",
+        ask: "Does any screen or component in this change do arithmetic on money?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "high",
+    },
+    {
+        id: "MONEY-06",
+        domain: "money",
+        title: "A money movement is never negative; its direction is a type",
+        rule: "A money movement's amount is always positive, and its direction is a named type: income, expense, transfer, payment, refund. A balance can be negative.",
+        why: "A minus sign is easy to lose or to double, and a lost sign sends money the wrong way.",
+        ask: "Does any money movement in this change carry its direction in its sign?",
+        stage: "mvp",
+        check: "auto",
+        severity: "high",
+    },
+    {
+        id: "MONEY-07",
+        domain: "money",
+        title: "The books balance",
+        rule: "Every ledger entry has its counterpart, and any change to how entries are posted comes with a test that proves the books still balance.",
+        why: "An unbalanced ledger means money has appeared or vanished, and finding where takes far longer than preventing it.",
+        ask: "If this change affects ledger entries, does a test prove the books still balance?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "critical",
+    },
+    {
+        id: "MONEY-08",
+        domain: "money",
+        title: "Anything that moves money is safe to repeat",
+        rule: "A request, job or webhook that moves money can run twice without moving it twice. It's keyed on something the caller supplies, never on timing, and every API that creates or moves money accepts an idempotency key.",
+        why: "Phones retry on patchy connections, people double-tap, and queues redeliver. Repeats are normal, not rare.",
+        ask: "What happens if this money operation runs twice?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "critical",
+    },
+    {
+        id: "MONEY-09",
+        domain: "money",
+        title: "A payment provider's webhook is verified before it does anything",
+        rule: "A webhook's signature is verified before it has any effect, and an event already seen is ignored.",
+        why: "Anyone can send a request that looks like a payment notification, and a replayed one can credit money twice.",
+        ask: "Is this webhook's signature verified before anything happens, and are replays ignored?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "critical",
+    },
+    {
+        id: "MONEY-10",
+        domain: "money",
+        title: "Every money path is tested for its amounts",
+        rule: "Every path that calculates or moves money has a test that checks the amounts, not just that the request succeeded.",
+        why: "A money bug that returns a success is the most expensive kind: it looks fine until the books are reconciled.",
+        ask: "Does every money path in this change have a test that checks the amounts?",
+        stage: "mvp",
+        check: "auto",
+        severity: "high",
+    },
+    {
+        id: "MONEY-11",
+        domain: "money",
+        title: "Money moving is visible",
+        rule: "Money movements emit a metric, so a person can see whether money is moving normally right now without querying the database by hand.",
+        why: "When payments quietly stop, every minute of not knowing costs real money and real trust.",
+        ask: "Would a sudden change in money movements show up on a dashboard or an alert?",
+        stage: "production",
+        check: "ai-review",
+        severity: "medium",
+    },
+    {
+        id: "MONEY-12",
+        domain: "money",
+        title: "Full card numbers and security codes never touch your servers",
+        rule: "Card details go straight from the person to the payment provider, and your servers receive only the provider's token and, at most, the card's last four digits. A full card number or security code is never received, logged or stored.",
+        why: "Storing card data brings the whole system under PCI DSS, which forbids keeping the security code at all, and a leak of card numbers is one of the most damaging breaches a business can have.",
+        ask: "Could a full card number or security code reach your servers, logs or database through this change?",
+        stage: "prototype",
+        check: "ai-review",
+        severity: "critical",
+    },
+];

package/dist/core/operations.d.ts

@@ -0,0 +1,108 @@
+export declare const operations: ({
+    id: string;
+    domain: "operations";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "mvp";
+    check: "ai-review";
+    severity: "high";
+    sources?: never;
+} | {
+    id: string;
+    domain: "operations";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "prototype";
+    check: "ai-review";
+    severity: "high";
+    sources?: never;
+} | {
+    id: string;
+    domain: "operations";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "production";
+    check: "person";
+    severity: "high";
+    sources?: never;
+} | {
+    id: string;
+    domain: "operations";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "production";
+    check: "ai-review";
+    severity: "medium";
+    sources?: never;
+} | {
+    id: string;
+    domain: "operations";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "production";
+    check: "person";
+    severity: "medium";
+    sources?: never;
+} | {
+    id: string;
+    domain: "operations";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "mvp";
+    check: "auto";
+    severity: "low";
+    sources?: never;
+} | {
+    id: string;
+    domain: "operations";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "mvp";
+    check: "ai-review";
+    severity: "medium";
+    sources?: never;
+} | {
+    id: string;
+    domain: "operations";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "mvp";
+    check: "ai-review";
+    severity: "medium";
+    sources: {
+        name: string;
+        ref: string;
+        url: string;
+    }[];
+} | {
+    id: string;
+    domain: "operations";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "production";
+    check: "ai-review";
+    severity: "medium";
+    sources: {
+        name: string;
+        ref: string;
+        url: string;
+    }[];
+})[];

package/dist/core/operations.js

@@ -0,0 +1,177 @@
+// Environments, access to production, backups, logs, metrics, alerts and incidents. Keeping
+// environments apart and controlling access to production are what audits such as PCI DSS and
+// ISO 27001 check; Peer AI grades them by stage so a prototype isn't held to production's bar.
+const ASVS = "OWASP ASVS 5.0";
+const V16 = "https://github.com/OWASP/ASVS/blob/master/5.0/en/0x25-V16-Security-Logging-and-Error-Handling.md";
+export const operations = [
+    {
+        id: "OPS-01",
+        domain: "operations",
+        title: "Development and production are kept apart",
+        rule: "Development and test never share production's servers, databases or secrets: each environment has its own, so a mistake while building can't touch real customers.",
+        why: "A test run against the production database, or a development machine holding production's secrets, is how real data gets deleted or leaked. Audits such as PCI DSS and ISO 27001 check for this separation.",
+        ask: "Does anything in this change share a server, database or secret between development and production?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "high",
+    },
+    {
+        id: "OPS-02",
+        domain: "operations",
+        title: "Real people's data never goes into development or test",
+        rule: "Development and test use made-up data, or copies of production where personal data has been anonymised or replaced. A plain copy of production is never used for testing.",
+        why: "A copy of production puts real people's data somewhere less protected, where more people can see it. Data protection laws treat that as a breach waiting to happen, and PCI DSS forbids real card numbers in test outright.",
+        ask: "Does this change put real people's data into development or test?",
+        stage: "prototype",
+        check: "ai-review",
+        severity: "high",
+    },
+    {
+        id: "OPS-03",
+        domain: "operations",
+        title: "Nobody has everyday access to production",
+        rule: "Developers have no standing access to production. When someone truly needs it, such as during an outage, it's approved, time-limited and recorded.",
+        why: "Standing access means one stolen laptop or one mistyped command reaches production. Access that's approved and recorded can be explained afterwards.",
+        ask: "Who has access to production today, and is every use approved, time-limited and recorded?",
+        stage: "production",
+        check: "person",
+        severity: "high",
+    },
+    {
+        id: "OPS-04",
+        domain: "operations",
+        title: "A staging environment mirrors production",
+        rule: "A staging environment is set up like production, with anonymised data, and every change passes through it before it reaches production.",
+        why: '"It worked on my machine" is what staging exists to catch, before real customers find it instead.',
+        ask: "Does this change pass through a staging environment that mirrors production?",
+        stage: "production",
+        check: "ai-review",
+        severity: "medium",
+    },
+    {
+        id: "OPS-05",
+        domain: "operations",
+        title: "Backups are automatic",
+        rule: "Data is backed up automatically, at least daily, to somewhere separate from where it lives.",
+        why: "The backup you meant to set up is the one you need on the day the database is lost.",
+        ask: "Is the data in this change backed up automatically, somewhere separate?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "high",
+    },
+    {
+        id: "OPS-06",
+        domain: "operations",
+        title: "Restores are tested, and redundancy matches the uptime target",
+        rule: "Restoring from backup is tested on a schedule, and the system has enough redundancy to meet the uptime it promises.",
+        why: "A backup that has never been restored is a hope, not a backup.",
+        ask: "When was a restore from backup last tested, and does the redundancy match the uptime target?",
+        stage: "production",
+        check: "person",
+        severity: "medium",
+    },
+    {
+        id: "OPS-07",
+        domain: "operations",
+        title: "Logs are structured",
+        rule: "Logs are written as structured fields, not sentences built by pasting values together.",
+        why: "Structured logs can be searched and counted during an incident. Pasted-together text can't, and it's where secrets slip in.",
+        ask: "Does this change write any log line by pasting values into text?",
+        stage: "mvp",
+        check: "auto",
+        severity: "low",
+    },
+    {
+        id: "OPS-08",
+        domain: "operations",
+        title: "Every request can be traced end to end",
+        rule: "Each request carries one id, which appears in its log lines, its trace and the error the client sees.",
+        why: "When a customer reports an error, the id takes you straight to what happened instead of hours of searching.",
+        ask: "Can every request in this change be traced by one id from the client's error to the logs?",
+        stage: "production",
+        check: "ai-review",
+        severity: "medium",
+    },
+    {
+        id: "OPS-09",
+        domain: "operations",
+        title: "An alert fires only on something a person would act on",
+        rule: "Every alert is about something a person needs to act on, and says what to do.",
+        why: "Alerts that don't need action teach people to ignore alerts, including the one that matters.",
+        ask: "Does every alert in this change need a person to act?",
+        stage: "production",
+        check: "ai-review",
+        severity: "medium",
+    },
+    {
+        id: "OPS-10",
+        domain: "operations",
+        title: "Health checks are cheap and honest",
+        rule: "Health and readiness checks are cheap to run and tell the truth: ready means able to serve requests, not just that the process started.",
+        why: "A readiness check that always says yes sends traffic to a server that can't handle it.",
+        ask: "Do the health checks in this change say whether the service can really serve requests?",
+        stage: "production",
+        check: "ai-review",
+        severity: "medium",
+    },
+    {
+        id: "OPS-11",
+        domain: "operations",
+        title: "There's a plan for a security incident",
+        rule: "A short written plan says what happens in a security incident: who leads, how an attacker's access is cut off, which secrets are replaced, how the system gets back to a known good state, and who tells affected people and regulators within the law's deadline. Afterwards, a review records what happened and what will stop it happening again.",
+        why: "Under pressure, people make worse decisions and lose hours working out who does what. Data protection laws such as the GDPR give as little as 72 hours to tell the regulator.",
+        ask: "Is there a written incident plan, and does this change add something it should cover, such as a new secret or a new store of personal data?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "medium",
+    },
+    {
+        id: "OPS-12",
+        domain: "operations",
+        title: "Security logs can't be changed by an attacker",
+        rule: "Security logs are sent to a separate system as they're written, where the app can add to them but can't change or delete them, and only the people who need them can read them.",
+        why: "Someone who breaks in often tries to erase their tracks next. Logs kept only on the server they broke into can't be trusted afterwards.",
+        ask: "Does this change keep security logs anywhere the app, or someone who breaks into it, could change or delete them?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "medium",
+        sources: [
+            { name: ASVS, ref: "16.4.2, level 2", url: V16 },
+            { name: ASVS, ref: "16.4.3, level 2", url: V16 },
+        ],
+    },
+    {
+        id: "OPS-13",
+        domain: "operations",
+        title: "Signs of attack raise an alert",
+        rule: "Security logs are watched for signs of attack, such as a burst of failed sign-ins, many refused permission checks for one account, repeated hits on a rate limit, or an admin action at an unusual time. Each raises an alert that reaches a person and says what to do.",
+        why: "Without anyone watching, an attack is found weeks later, often by someone outside. One caught in minutes does far less harm.",
+        ask: "Does this change add a security event that should raise an alert, and does it?",
+        stage: "production",
+        check: "ai-review",
+        severity: "medium",
+        sources: [{ name: ASVS, ref: "16.4.3, level 2", url: V16 }],
+    },
+    {
+        id: "OPS-14",
+        domain: "operations",
+        title: "Every release can be undone",
+        rule: "Every release has a tested way back to the version before it, and its database changes still work with that version, so undoing the release doesn't need an emergency fix.",
+        why: "A release that can't be undone turns every bad deploy into an outage that lasts until someone writes a fix under pressure.",
+        ask: "If this release goes wrong, can it be undone, and will the previous version still run on the changed database?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "high",
+    },
+    {
+        id: "OPS-15",
+        domain: "operations",
+        title: "The product's service targets are written down and watched",
+        rule: "The product's targets for its main journeys, such as how often they work and how fast, are written down, measured in production, and raise an alert before they're missed.",
+        why: "Without a target, nobody can tell a slow week from an outage, or decide when reliability work should come before features.",
+        ask: "Does this change affect a main journey's target, and is that target still measured and alerted on?",
+        stage: "production",
+        check: "ai-review",
+        severity: "medium",
+    },
+];

package/dist/core/performance.d.ts

@@ -0,0 +1,53 @@
+export declare const performance: ({
+    id: string;
+    domain: "performance";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "mvp";
+    check: "ai-review";
+    severity: "medium";
+    sources?: never;
+} | {
+    id: string;
+    domain: "performance";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "production";
+    check: "ai-review";
+    severity: "medium";
+    sources?: never;
+} | {
+    id: string;
+    domain: "performance";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "production";
+    check: "ai-review";
+    severity: "high";
+    sources: {
+        name: string;
+        ref: string;
+        url: string;
+    }[];
+} | {
+    id: string;
+    domain: "performance";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "production";
+    check: "ai-review";
+    severity: "medium";
+    sources: {
+        name: string;
+        ref: string;
+        url: string;
+    }[];
+})[];

package/dist/core/performance.js

@@ -0,0 +1,85 @@
+// Knowing what things cost, and caching only what's safe to cache.
+const ASVS = "OWASP ASVS 5.0";
+const V2 = "https://github.com/OWASP/ASVS/blob/master/5.0/en/0x11-V2-Validation-and-Business-Logic.md";
+const V14 = "https://github.com/OWASP/ASVS/blob/master/5.0/en/0x23-V14-Data-Protection.md";
+export const performance = [
+    {
+        id: "PERF-01",
+        domain: "performance",
+        title: "No list runs one query per row",
+        rule: "A list loads its related data in a fixed number of queries, never one extra query for each row.",
+        why: "One query per row passes every test on sample data and falls over on real data.",
+        ask: "Does any list in this change run a query for each of its rows?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "medium",
+    },
+    {
+        id: "PERF-02",
+        domain: "performance",
+        title: "A query's cost is known before it ships",
+        rule: "Before a query ships, someone knows what it costs: filters and sorts use indexes, joins are few, and maths done per request on large data is watched.",
+        why: "A slow query is invisible with little data and becomes an outage as the data grows.",
+        ask: "Is every new query in this change backed by the indexes it needs?",
+        stage: "production",
+        check: "ai-review",
+        severity: "medium",
+    },
+    {
+        id: "PERF-03",
+        domain: "performance",
+        title: "Cache only what's safe to be wrong about",
+        rule: "Cache only what's expensive to work out and cheap to get wrong. Never cache a decision about money, safety or permissions, and never cache one person's data where another could be served it.",
+        why: "A stale or shared cache entry can show one person another's data, or approve what's no longer allowed.",
+        ask: "Does anything in this change cache a sensitive decision, or one person's data where another could see it?",
+        stage: "production",
+        check: "ai-review",
+        severity: "high",
+        sources: [{ name: ASVS, ref: "14.2.2, level 2", url: V14 }],
+    },
+    {
+        id: "PERF-04",
+        domain: "performance",
+        title: "Expensive endpoints are rate limited too",
+        rule: "Endpoints that are cheap to call but expensive to serve, such as searches and exports, are rate limited, not just sign-in.",
+        why: "Cheap to ask for and expensive to answer is the shape of a denial-of-service attack.",
+        ask: "Is every expensive endpoint in this change rate limited?",
+        stage: "production",
+        check: "ai-review",
+        severity: "medium",
+        sources: [{ name: ASVS, ref: "2.4.1, level 2", url: V2 }],
+    },
+    {
+        id: "PERF-05",
+        domain: "performance",
+        title: "Long lists draw only what's on screen",
+        rule: "A list that can grow long draws only the items on screen, loading and releasing the rest as the person scrolls.",
+        why: "Drawing thousands of items at once freezes a phone and drains its battery.",
+        ask: "Does any list in this change draw every item at once when it could grow long?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "medium",
+    },
+    {
+        id: "PERF-06",
+        domain: "performance",
+        title: "What's started is stopped",
+        rule: "Timers, subscriptions, listeners and object URLs are released when the screen or component that created them goes away.",
+        why: "Anything left running keeps using memory, battery and network, and often keeps acting on a screen nobody can see.",
+        ask: "Does everything this change starts get stopped or released when it's no longer needed?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "medium",
+    },
+    {
+        id: "PERF-07",
+        domain: "performance",
+        title: "Images are resized before they're stored or sent",
+        rule: "Photos and large images are resized to what the product actually shows before they're stored or uploaded.",
+        why: "A full-size camera photo is often several megabytes, and a few hundred of them fill a device's storage or a person's data plan.",
+        ask: "Does this change store or send images larger than the product shows?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "medium",
+    },
+];