peer-ai-standards 1.0.0-next.0

package/dist/core/privacy-compliance.d.ts

@@ -0,0 +1,68 @@
+export declare const privacyCompliance: ({
+    id: string;
+    domain: "privacy-compliance";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "prototype";
+    check: "auto";
+    severity: "high";
+    sources: {
+        name: string;
+        ref: string;
+        url: string;
+    }[];
+} | {
+    id: string;
+    domain: "privacy-compliance";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "prototype";
+    check: "ai-review";
+    severity: "high";
+    sources?: never;
+} | {
+    id: string;
+    domain: "privacy-compliance";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "mvp";
+    check: "ai-review";
+    severity: "high";
+    sources?: never;
+} | {
+    id: string;
+    domain: "privacy-compliance";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "mvp";
+    check: "ai-review";
+    severity: "high";
+    sources: {
+        name: string;
+        ref: string;
+        url: string;
+    }[];
+} | {
+    id: string;
+    domain: "privacy-compliance";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "production";
+    check: "ai-review";
+    severity: "medium";
+    sources: {
+        name: string;
+        ref: string;
+        url: string;
+    }[];
+})[];

package/dist/core/privacy-compliance.js

@@ -0,0 +1,77 @@
+// Personal data, and handling it the way the law and the people it belongs to expect. The laws
+// themselves, such as the NDPA or the GDPR, are rule packs a project chooses in its config.
+const ASVS = "OWASP ASVS 5.0";
+const V14 = "https://github.com/OWASP/ASVS/blob/master/5.0/en/0x23-V14-Data-Protection.md";
+const V16 = "https://github.com/OWASP/ASVS/blob/master/5.0/en/0x25-V16-Security-Logging-and-Error-Handling.md";
+export const privacyCompliance = [
+    {
+        id: "PRIV-01",
+        domain: "privacy-compliance",
+        title: "Logs never hold secrets, tokens or personal data",
+        rule: "Passwords, tokens, keys, payment details and personal data are never written to logs. A redaction filter in the logging layer removes them, and it can't be bypassed.",
+        why: "Logs are copied, shipped and kept far more widely than the data they came from, and a password in a log is a password everyone with log access has.",
+        ask: "Could anything in this change write a secret or personal data to a log?",
+        stage: "prototype",
+        check: "auto",
+        severity: "high",
+        sources: [{ name: ASVS, ref: "16.2.5, level 2", url: V16 }],
+    },
+    {
+        id: "PRIV-02",
+        domain: "privacy-compliance",
+        title: "No real personal data in the repository",
+        rule: "Fixtures, seed data, screenshots, tests and examples use invented data. No real person's data goes into the repository.",
+        why: "Everything in a repository is copied to every machine that clones it, forever.",
+        ask: "Does this change add any real person's data to the repository?",
+        stage: "prototype",
+        check: "ai-review",
+        severity: "high",
+    },
+    {
+        id: "PRIV-03",
+        domain: "privacy-compliance",
+        title: "Only what's needed is collected",
+        rule: "A feature collects only the personal data it needs, at the precision it needs, and only while it needs it: a rough area rather than an exact location, and location only while searching rather than all the time.",
+        why: "Data you don't collect can't leak, can't be misused and doesn't need protecting. Collecting only what's needed is also what data protection laws require.",
+        ask: "Does this change collect more personal data, or more precise data, than it needs?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "high",
+    },
+    {
+        id: "PRIV-04",
+        domain: "privacy-compliance",
+        title: "Personal data goes only where people have been told",
+        rule: "Personal data is sent only to the services people have been told about, with their consent where the law requires it. Analytics and telemetry are off until the person opts in.",
+        why: "Sending data to a third party people didn't know about breaks their trust, and in most countries it breaks the law too.",
+        ask: "Does this change send personal data anywhere people haven't been told about?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "high",
+        sources: [{ name: ASVS, ref: "14.2.3, level 2", url: V14 }],
+    },
+    {
+        id: "PRIV-05",
+        domain: "privacy-compliance",
+        title: "Hidden details are removed from files before they leave",
+        rule: "Before a photo or file is shared or sent to another service, details the person may not know it carries, such as where a photo was taken, are removed, unless the person chose to keep them.",
+        why: "A photo's location can reveal where someone lives, and most people have no idea it's there.",
+        ask: "Does this change send or share files with hidden details, such as location, still in them?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "high",
+        sources: [{ name: ASVS, ref: "14.2.8, level 3", url: V14 }],
+    },
+    {
+        id: "PRIV-06",
+        domain: "privacy-compliance",
+        title: "Personal data is kept only as long as it's needed",
+        rule: "Each kind of personal data has a set time it's kept, such as location from a live stream, and a scheduled job deletes it when that time is up.",
+        why: 'Data kept forever is data that can leak forever, and "we\'ll delete it later" never happens without a job that does it.',
+        ask: "Does the personal data in this change have a set time it's kept, and a job that deletes it?",
+        stage: "production",
+        check: "ai-review",
+        severity: "medium",
+        sources: [{ name: ASVS, ref: "14.2.7, level 3", url: V14 }],
+    },
+];

package/dist/core/reliability.d.ts

@@ -0,0 +1,67 @@
+export declare const reliability: ({
+    id: string;
+    domain: "reliability";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "mvp";
+    check: "ai-review";
+    severity: "medium";
+    when?: never;
+} | {
+    id: string;
+    domain: "reliability";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "production";
+    check: "ai-review";
+    severity: "medium";
+    when?: never;
+} | {
+    id: string;
+    domain: "reliability";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "mvp";
+    check: "ai-review";
+    severity: "high";
+    when?: never;
+} | {
+    id: string;
+    domain: "reliability";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "production";
+    check: "auto";
+    severity: "high";
+    when?: never;
+} | {
+    id: string;
+    domain: "reliability";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "production";
+    check: "ai-review";
+    severity: "medium";
+    when: "real-time"[];
+} | {
+    id: string;
+    domain: "reliability";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "mvp";
+    check: "ai-review";
+    severity: "high";
+    when: "offline"[];
+})[];

package/dist/core/reliability.js

@@ -0,0 +1,105 @@
+// Staying up, and failing safely when something underneath fails.
+export const reliability = [
+    {
+        id: "REL-01",
+        domain: "reliability",
+        title: "Every call to another service has a timeout and handles failure",
+        rule: "Every call to another service or API has a timeout, and a failed or slow response is handled: retried when that's safe, reported when it isn't.",
+        why: "A call with no timeout waits forever, and one slow provider then ties up every request that depends on it.",
+        ask: "Does every call to another service in this change have a timeout and handle failure?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "medium",
+    },
+    {
+        id: "REL-02",
+        domain: "reliability",
+        title: "If the cache is down, requests are slower, not failed",
+        rule: "When a cache is unavailable, requests fall back to working without it. They get slower; they don't fail.",
+        why: "A cache is there to speed things up. If losing it takes the service down, it has become a single point of failure.",
+        ask: "Does everything in this change keep working if the cache is down?",
+        stage: "production",
+        check: "ai-review",
+        severity: "medium",
+    },
+    {
+        id: "REL-03",
+        domain: "reliability",
+        title: "Rate limiting never switches off",
+        rule: "If the rate limiter's shared store is down, it falls back to a limit on each server and raises an alert. For sign-in, password reset, two-factor and one-time codes, the fallback is at least as strict as normal. Limiting is never simply switched off.",
+        why: "Refusing every request would turn a cache outage into a total outage, and allowing unlimited sign-in attempts would open a window for guessing passwords.",
+        ask: "If the rate limiter's store fails, does this change still limit requests, as strictly for sign-in?",
+        stage: "production",
+        check: "ai-review",
+        severity: "medium",
+    },
+    {
+        id: "REL-04",
+        domain: "reliability",
+        title: "Configuration fails closed",
+        rule: "An unrecognised environment name is treated as production, and one function decides which environment is running.",
+        why: "A typo in an environment name must never switch production's safeguards off.",
+        ask: "Does this change decide the environment anywhere other than the one function, or treat an unknown one as safe?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "high",
+    },
+    {
+        id: "REL-05",
+        domain: "reliability",
+        title: "Demo shortcuts can't run in production",
+        rule: "Demo passwords, seed shortcuts and sandbox providers are refused when the app starts in production.",
+        why: "A convenience left switched on in production is a back door.",
+        ask: "Could any demo or test shortcut in this change run in production?",
+        stage: "production",
+        check: "auto",
+        severity: "high",
+    },
+    {
+        id: "REL-06",
+        domain: "reliability",
+        title: "Every process runs the same safety checks at start-up",
+        rule: "Every process that can move money or change data, including background workers and scripts, runs the same production safety checks when it starts as the main server.",
+        why: "The worker nobody thought about is the one that runs with the unsafe setting.",
+        ask: "Does every process in this change run the same start-up safety checks as the server?",
+        stage: "production",
+        check: "ai-review",
+        severity: "medium",
+    },
+    {
+        id: "REL-07",
+        domain: "reliability",
+        title: "A dropped live connection loses nothing that mattered",
+        rule: "Anything that matters is saved, not held only in a live connection, so a dropped connection loses nothing.",
+        why: "Live connections drop all the time on mobile networks. State that only existed in the stream is gone.",
+        ask: "Would a dropped connection lose anything that matters in this change?",
+        stage: "production",
+        check: "ai-review",
+        severity: "medium",
+        when: ["real-time"],
+    },
+    {
+        id: "REL-08",
+        domain: "reliability",
+        title: "When the device holds the only copy, it's protected",
+        rule: "When a person's device holds the only copy of their data, the app asks the platform to keep it rather than clear it when space runs short, and offers a way to back it up.",
+        why: "Browsers and phones clear stored data under pressure, and for an offline-first app that can mean everything the person ever entered.",
+        ask: "Is data that exists only on the device protected from being cleared, with a way to back it up?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "high",
+        when: ["offline"],
+    },
+    {
+        id: "REL-09",
+        domain: "reliability",
+        title: "An app that caches itself still updates",
+        rule: "An app that caches its own code to work offline checks for new versions and applies them, so every person gets updates.",
+        why: "An app that always serves its cached copy never gets fixes, including the fix for the bug that's hurting people.",
+        ask: "Will people running a cached copy of this app get the next version?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "high",
+        when: ["offline"],
+    },
+];

package/dist/core/requirements.d.ts

@@ -0,0 +1,41 @@
+export declare const requirements: ({
+    id: string;
+    domain: "requirements";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "prototype";
+    check: "ai-review";
+    severity: "low";
+} | {
+    id: string;
+    domain: "requirements";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "mvp";
+    check: "ai-review";
+    severity: "medium";
+} | {
+    id: string;
+    domain: "requirements";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "mvp";
+    check: "ai-review";
+    severity: "low";
+} | {
+    id: string;
+    domain: "requirements";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "mvp";
+    check: "ai-review";
+    severity: "high";
+})[];

package/dist/core/requirements.js

@@ -0,0 +1,58 @@
+// What the product must do, for whom, and how anyone will know it works.
+export const requirements = [
+    {
+        id: "REQ-01",
+        domain: "requirements",
+        title: "A requirement names who it's for and the problem",
+        rule: "A requirement says who it's for and the problem it solves, not only the solution someone has in mind.",
+        why: "A solution with no stated problem can't be questioned or improved, and often solves the wrong thing well.",
+        ask: "Does this requirement say who it's for and what problem it solves?",
+        stage: "prototype",
+        check: "ai-review",
+        severity: "low",
+    },
+    {
+        id: "REQ-02",
+        domain: "requirements",
+        title: "Every feature has acceptance criteria before it's built",
+        rule: "Before a feature is built, it has acceptance criteria: what done looks like, written so it can be tested.",
+        why: 'Without them, "done" means whatever the builder thought, and disagreements surface after the work is finished.',
+        ask: "Does this feature have testable acceptance criteria?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "medium",
+    },
+    {
+        id: "REQ-03",
+        domain: "requirements",
+        title: "The needs behind the features are written down",
+        rule: "The needs that shape everything are written down: who uses the product and what they need to access it, how many people and how much data, where it operates and which laws apply, and how available it must be.",
+        why: "These needs decide the architecture, and discovering them late means rebuilding it.",
+        ask: "Are the product's users, scale, laws and availability needs written down?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "medium",
+    },
+    {
+        id: "REQ-04",
+        domain: "requirements",
+        title: "Ideas outside the agreed scope go to the backlog",
+        rule: "An idea outside the agreed scope of a piece of work goes to the backlog, not into the change.",
+        why: "Scope that grows inside a change makes it late, hard to review and risky to ship.",
+        ask: "Does this change include anything outside its agreed scope?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "low",
+    },
+    {
+        id: "REQ-05",
+        domain: "requirements",
+        title: "A feature ships only when every acceptance criterion holds",
+        rule: "A feature ships only when every one of its acceptance criteria holds. A criterion that doesn't is fixed first, or changed or dropped by whoever agreed it, never shipped broken or quietly skipped.",
+        why: "The acceptance criteria are what was agreed. A feature that fails one does something nobody agreed to, and the people relying on it find out first.",
+        ask: "Does every acceptance criterion of this feature hold in the code?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "high",
+    },
+];

package/dist/core/safety-critical.d.ts

@@ -0,0 +1,41 @@
+export declare const safetyCritical: ({
+    id: string;
+    domain: "safety-critical";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "prototype";
+    check: "auto";
+    severity: "critical";
+} | {
+    id: string;
+    domain: "safety-critical";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "prototype";
+    check: "ai-review";
+    severity: "high";
+} | {
+    id: string;
+    domain: "safety-critical";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "mvp";
+    check: "ai-review";
+    severity: "high";
+} | {
+    id: string;
+    domain: "safety-critical";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "mvp";
+    check: "auto";
+    severity: "high";
+})[];

package/dist/core/safety-critical.js

@@ -0,0 +1,71 @@
+// For products with the safety-critical trait: data where a wrong value could hurt someone, such
+// as allergens, medical dosage, legal deadlines, or eligibility that affects a person's rights.
+// The project's add-on names what counts.
+export const safetyCritical = [
+    {
+        id: "SAFE-01",
+        domain: "safety-critical",
+        title: "Safety checks block; they never just warn",
+        rule: "A check on safety-critical data blocks the action. Nobody can get past it: not a user, not an administrator, not a direct call to the API.",
+        why: "A warning people can click past isn't a safety check. They will click past it.",
+        ask: "Can anyone get past this safety check?",
+        stage: "prototype",
+        check: "auto",
+        severity: "critical",
+    },
+    {
+        id: "SAFE-02",
+        domain: "safety-critical",
+        title: "States that differ stay distinct",
+        rule: 'Distinct states stay distinct. "Present", "may be present" and "absent" are three states, never a yes-or-no.',
+        why: 'The person relying on the answer is the one at risk, and "may contain" squeezed into "no" can hurt them.',
+        ask: "Does any safety-critical value in this change lose a state it should have?",
+        stage: "prototype",
+        check: "auto",
+        severity: "critical",
+    },
+    {
+        id: "SAFE-03",
+        domain: "safety-critical",
+        title: "Safety-critical data is structured, never free text",
+        rule: "Safety-critical data is stored as structured fields the system can reason about, never as free text.",
+        why: "A system can't check, filter or warn about something written in a sentence.",
+        ask: "Is any safety-critical information in this change held as free text?",
+        stage: "prototype",
+        check: "ai-review",
+        severity: "high",
+    },
+    {
+        id: "SAFE-04",
+        domain: "safety-critical",
+        title: "Editing sends it through the check again",
+        rule: "Editing a record that already passed a safety check sends it through the check again.",
+        why: "Otherwise one edit after approval quietly undoes the check.",
+        ask: "Does editing an approved record in this change repeat the safety check?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "high",
+    },
+    {
+        id: "SAFE-05",
+        domain: "safety-critical",
+        title: "It's shown where the decision is made",
+        rule: "Safety-critical information is shown where the person makes the decision, never behind a tab, a toggle, a disclosure or a scroll.",
+        why: "Information a person has to go looking for is information they won't see at the moment it matters.",
+        ask: "Is safety-critical information visible, without any extra step, where the decision is made?",
+        stage: "prototype",
+        check: "ai-review",
+        severity: "high",
+    },
+    {
+        id: "SAFE-06",
+        domain: "safety-critical",
+        title: "Every change to it is tested",
+        rule: "Any change that touches safety-critical data comes with a test that proves it's still stored, checked and shown correctly.",
+        why: "A refactor that drops a warning looks harmless in review. Only a test catches it every time.",
+        ask: "Does this change to safety-critical data come with a test that proves it still works end to end?",
+        stage: "mvp",
+        check: "auto",
+        severity: "high",
+    },
+];