peer-ai-standards 1.0.0-next.0

package/dist/core/security.js

@@ -0,0 +1,427 @@
+// Keeping people's data and the system itself safe from attack. Each rule cites the OWASP
+// Application Security Verification Standard (ASVS) 5.0 requirement it comes from, checked
+// against OWASP's own text. Rules with no source are engineering practice ASVS doesn't cover.
+const ASVS = "OWASP ASVS 5.0";
+const chapter = (file) => `https://github.com/OWASP/ASVS/blob/master/5.0/en/${file}`;
+const V1 = chapter("0x10-V1-Encoding-and-Sanitization.md");
+const V2 = chapter("0x11-V2-Validation-and-Business-Logic.md");
+const V3 = chapter("0x12-V3-Web-Frontend-Security.md");
+const V5 = chapter("0x14-V5-File-Handling.md");
+const V6 = chapter("0x15-V6-Authentication.md");
+const V7 = chapter("0x16-V7-Session-Management.md");
+const V8 = chapter("0x17-V8-Authorization.md");
+const V9 = chapter("0x18-V9-Self-contained-Tokens.md");
+const V12 = chapter("0x21-V12-Secure-Communication.md");
+const V13 = chapter("0x22-V13-Configuration.md");
+const V14 = chapter("0x23-V14-Data-Protection.md");
+const V16 = chapter("0x25-V16-Security-Logging-and-Error-Handling.md");
+export const security = [
+    {
+        id: "SEC-01",
+        domain: "security",
+        title: "Permission is checked per record, not per role",
+        rule: "Being signed in, or holding a role, is not permission to use *this* record. Every request that names a record proves the caller may use that record. Review every endpoint that takes an id, not a sample.",
+        why: "Changing an id in a URL is the easiest attack there is, and it leaks one customer's data to another.",
+        ask: "Does every endpoint that takes an id check that the caller may use that record?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "high",
+        sources: [{ name: ASVS, ref: "8.2.2, level 1", url: V8 }],
+    },
+    {
+        id: "SEC-02",
+        domain: "security",
+        title: "Each action checks the caller's role allows it",
+        rule: "Every action checks that the caller's role allows it, and different roles have different powers: releasing money needs the specific role for it, not just any staff role.",
+        why: "When every staff role can do everything, one compromised support account can do what only finance should.",
+        ask: "Does every action in this change check for the specific role it needs?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "high",
+        sources: [{ name: ASVS, ref: "8.2.1, level 1", url: V8 }],
+    },
+    {
+        id: "SEC-03",
+        domain: "security",
+        title: "Permission is decided on the server, on every request",
+        rule: "Permission checks happen on the server on every request, never based on anything the client can change, and never carried over from an earlier request.",
+        why: "Anything the client decides, an attacker can change: hiding a button isn't a permission check.",
+        ask: "Is every permission in this change decided on the server, from data the client can't change?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "high",
+        sources: [{ name: ASVS, ref: "8.3.1, level 1", url: V8 }],
+    },
+    {
+        id: "SEC-04",
+        domain: "security",
+        title: "A session is for one app, and the app says which",
+        rule: "Where one backend serves several apps or tenants, each session is issued for exactly one of them and accepted only there. The app always says which one it is signing in to; the server never guesses.",
+        why: "Guessing prefers the most powerful option, so a person with two roles can end up in the wrong app with the wrong powers, and the failure surfaces much later as confusing permission errors.",
+        ask: "Is every session in this change tied to one app or tenant, and does the app say which?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "high",
+        when: ["several-audiences"],
+        sources: [
+            { name: ASVS, ref: "9.2.3, level 2", url: V9 },
+            { name: ASVS, ref: "8.4.1, level 2", url: V8 },
+        ],
+    },
+    {
+        id: "SEC-05",
+        domain: "security",
+        title: "Input is validated on the server",
+        rule: "Every request that changes something is validated on the server against what's allowed. Checks in the app or the browser are for convenience, never a control.",
+        why: "Anyone can send a request without using your app, so a check that only runs in the app doesn't run at all for an attacker.",
+        ask: "Is every input in this change validated on the server?",
+        stage: "prototype",
+        check: "ai-review",
+        severity: "high",
+        sources: [
+            { name: ASVS, ref: "2.2.2, level 1", url: V2 },
+            { name: ASVS, ref: "2.2.1, level 1", url: V2 },
+        ],
+    },
+    {
+        id: "SEC-06",
+        domain: "security",
+        title: "Data from outside is checked before it's trusted",
+        rule: "Data that crosses a boundary (an API response, stored data, an imported file, a message from another service) is checked against the shape it should have, never just assumed to have it.",
+        why: "Code that assumes the shape of outside data breaks, or worse carries on with wrong data, the first time that data is different.",
+        ask: "Is every piece of outside data in this change checked before it's used?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "medium",
+        sources: [{ name: ASVS, ref: "2.2.1, level 1", url: V2 }],
+    },
+    {
+        id: "SEC-07",
+        domain: "security",
+        title: "Database queries are parameterised",
+        rule: "Database queries never paste values into the query text. They use parameters or a query builder, so a value can never change what the query does.",
+        why: "A value pasted into a query can rewrite it: that's SQL injection, which can read or delete a whole database.",
+        ask: "Does any query in this change build its text from values?",
+        stage: "prototype",
+        check: "auto",
+        severity: "critical",
+        sources: [{ name: ASVS, ref: "1.2.4, level 1", url: V1 }],
+    },
+    {
+        id: "SEC-08",
+        domain: "security",
+        title: "Content from outside is never put into a page as HTML",
+        rule: "Content from people or outside services, including text an AI model produced, is shown as text. If it truly must be HTML, it goes through a well-known sanitiser first.",
+        why: "HTML inserted into a page can run a script in the viewer's browser, with their session.",
+        ask: "Does this change put any outside content into a page as HTML without a sanitiser?",
+        stage: "prototype",
+        check: "auto",
+        severity: "high",
+        sources: [
+            { name: ASVS, ref: "1.3.1, level 1", url: V1 },
+            { name: ASVS, ref: "1.2.1, level 1", url: V1 },
+        ],
+    },
+    {
+        id: "SEC-09",
+        domain: "security",
+        title: "No internal detail reaches the client",
+        rule: "Errors shown to the client are generic and actionable: no stack traces, file paths, queries or keys. The detail goes to the log, with an id the client can quote. Debug modes are off in production.",
+        why: "Internal detail is a map for an attacker: it shows what's running, where, and how it fails.",
+        ask: "Could any error in this change reveal internal detail to the client?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "medium",
+        sources: [
+            { name: ASVS, ref: "16.5.1, level 2", url: V16 },
+            { name: ASVS, ref: "13.4.2, level 2", url: V13 },
+        ],
+    },
+    {
+        id: "SEC-10",
+        domain: "security",
+        title: "No secret in code, ever",
+        rule: "Keys, passwords and tokens never live in code or in the repository. They come from a secrets manager or the environment.",
+        why: "A secret in a repository is readable by everyone who can ever read the repository, including from its history after the file is deleted.",
+        ask: "Does this change put a key, password or token in code or the repository?",
+        stage: "prototype",
+        check: "auto",
+        severity: "critical",
+        sources: [{ name: ASVS, ref: "13.3.1, level 2", url: V13 }],
+    },
+    {
+        id: "SEC-11",
+        domain: "security",
+        title: "Nothing secret is built into an app or a web page",
+        rule: "Anything shipped to a person's device (a web page's code, a mobile app) can be read by anyone, so no key or secret is ever built into it, even from an environment variable at build time. A call that needs a secret goes through your server.",
+        why: "A key built into an app is extracted within hours of release, and then it's everyone's key.",
+        ask: "Does this change build any key or secret into code that runs on a person's device?",
+        stage: "prototype",
+        check: "ai-review",
+        severity: "critical",
+    },
+    {
+        id: "SEC-12",
+        domain: "security",
+        title: "Sign-in is protected against guessing",
+        rule: "Sign-in, password reset, two-factor and one-time codes are rate limited, so passwords and codes can't be guessed at speed.",
+        why: "With unlimited attempts, a leaked list of passwords from another site opens accounts on yours.",
+        ask: "Is every sign-in, reset and code endpoint in this change rate limited?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "high",
+        sources: [{ name: ASVS, ref: "6.3.1, level 1", url: V6 }],
+    },
+    {
+        id: "SEC-13",
+        domain: "security",
+        title: "Rate limits are named policies in one place",
+        rule: "Rate limits are defined as named policies in one place, not numbers scattered through the code.",
+        why: 'Scattered limits drift apart, and nobody can answer "what are our limits?" when an attack is happening.',
+        ask: "Does this change add a rate limit anywhere other than the shared policies?",
+        stage: "production",
+        check: "ai-review",
+        severity: "low",
+    },
+    {
+        id: "SEC-14",
+        domain: "security",
+        title: "Sessions end",
+        rule: "Sessions expire after a period of inactivity and after a maximum lifetime. Signing out ends the session on the server, not just in the app, and disabling an account ends all its sessions.",
+        why: "A session that never ends turns one stolen token, or one shared computer, into permanent access.",
+        ask: "In this change, can a session outlive sign-out, account removal or its maximum lifetime?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "medium",
+        sources: [
+            { name: ASVS, ref: "7.4.1, level 1", url: V7 },
+            { name: ASVS, ref: "7.4.2, level 1", url: V7 },
+            { name: ASVS, ref: "7.3.2, level 2", url: V7 },
+        ],
+    },
+    {
+        id: "SEC-15",
+        domain: "security",
+        title: "Everything travels encrypted",
+        rule: "All traffic between apps and services uses TLS, never falls back to an unencrypted connection, and no platform setting allows unencrypted traffic.",
+        why: "Unencrypted traffic can be read and changed by anyone on the same network, such as public Wi-Fi.",
+        ask: "Does anything in this change send or allow traffic without TLS?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "high",
+        sources: [
+            { name: ASVS, ref: "12.2.1, level 1", url: V12 },
+            {
+                name: "OWASP MASVS 2.1.0",
+                ref: "MASVS-NETWORK-1",
+                url: "https://github.com/OWASP/masvs/blob/master/controls/MASVS-NETWORK-1.md",
+            },
+        ],
+    },
+    {
+        id: "SEC-16",
+        domain: "security",
+        title: "Which websites may call the API is a fixed list",
+        rule: "The websites allowed to call the API from a browser are a fixed list. The API never echoes back whatever origin asked, least of all when requests carry credentials.",
+        why: "An API that allows any origin with credentials lets any website act as a signed-in visitor.",
+        ask: "Is every allowed origin in this change on a fixed list?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "medium",
+        sources: [{ name: ASVS, ref: "3.4.2, level 1", url: V3 }],
+    },
+    {
+        id: "SEC-17",
+        domain: "security",
+        title: "Web responses set their security headers",
+        rule: "Web responses set Strict-Transport-Security, so browsers always use HTTPS, and a Content-Security-Policy, so the browser runs only trusted scripts.",
+        why: "These headers stop whole classes of attack in the browser, for the cost of a line of configuration.",
+        ask: "Do the web responses in this change set Strict-Transport-Security and a Content-Security-Policy?",
+        stage: "mvp",
+        check: "auto",
+        severity: "medium",
+        sources: [
+            { name: ASVS, ref: "3.4.1, level 1", url: V3 },
+            { name: ASVS, ref: "3.4.3, level 2", url: V3 },
+        ],
+    },
+    {
+        id: "SEC-18",
+        domain: "security",
+        title: "The server names stored files",
+        rule: "Stored files get names and paths the server makes. A name supplied by the client is never used as a path.",
+        why: "A client-supplied name like `../../config` can read or overwrite files it should never reach.",
+        ask: "Does this change use any client-supplied name as a storage path?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "high",
+        when: ["uploads"],
+        sources: [{ name: ASVS, ref: "5.3.2, level 1", url: V5 }],
+    },
+    {
+        id: "SEC-19",
+        domain: "security",
+        title: "An upload's content and size are checked",
+        rule: "An uploaded file's content is checked to be the type it claims, not just its extension, and its size is limited.",
+        why: "A renamed file slips past an extension check, and an unlimited upload is an easy way to take a service down.",
+        ask: "Does this change check an upload's content and size, not just its extension?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "medium",
+        when: ["uploads"],
+        sources: [
+            { name: ASVS, ref: "5.2.2, level 1", url: V5 },
+            { name: ASVS, ref: "5.2.1, level 1", url: V5 },
+        ],
+    },
+    {
+        id: "SEC-20",
+        domain: "security",
+        title: "Private files are shared through short-lived links",
+        rule: "Private files are served through signed links that expire soon, and every access is recorded.",
+        why: "A permanent link to a private file stays valid after it's forwarded, leaked or no longer allowed.",
+        ask: "Are the private files in this change served through expiring links, with access recorded?",
+        stage: "production",
+        check: "ai-review",
+        severity: "medium",
+        when: ["uploads"],
+    },
+    {
+        id: "SEC-21",
+        domain: "security",
+        title: "Every live event is authorised, not just the connection",
+        rule: "A live subscription checks permission for every event it sends, not once when it connects, and events go only to the people they're for.",
+        why: "Permissions change while a connection stays open, and a connection authorised once keeps receiving what it's no longer allowed to see.",
+        ask: "Does every event in this change check permission, and reach only the people it's for?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "high",
+        when: ["real-time"],
+    },
+    {
+        id: "SEC-22",
+        domain: "security",
+        title: "Nothing sensitive goes in a URL",
+        rule: "Tokens, keys and personal data never go in a URL or its query string. They travel in the request body or headers.",
+        why: "URLs are kept in server logs, browser history and the referrer sent to other sites, long after the request.",
+        ask: "Does this change put a token, key or personal data in a URL?",
+        stage: "prototype",
+        check: "ai-review",
+        severity: "medium",
+        sources: [{ name: ASVS, ref: "14.2.1, level 1", url: V14 }],
+    },
+    {
+        id: "SEC-23",
+        domain: "security",
+        title: "Only modern TLS, with strong ciphers",
+        rule: "Only current TLS versions are switched on (TLS 1.2 and 1.3, with 1.3 preferred), only recommended cipher suites are allowed, strongest first, and public services use publicly trusted certificates. On a hosting platform that manages TLS, its settings are checked rather than assumed.",
+        why: "Old TLS versions and weak ciphers have known breaks, so traffic that uses them can be read or changed even though it's encrypted.",
+        ask: "Does this change switch on an old TLS version, a weak cipher or a certificate that isn't publicly trusted?",
+        stage: "mvp",
+        check: "auto",
+        severity: "medium",
+        sources: [
+            { name: ASVS, ref: "12.1.1, level 1", url: V12 },
+            { name: ASVS, ref: "12.1.2, level 2", url: V12 },
+            { name: ASVS, ref: "12.2.2, level 1", url: V12 },
+        ],
+    },
+    {
+        id: "SEC-24",
+        domain: "security",
+        title: "Security events are logged",
+        rule: "Sign-ins, failed sign-ins, refused permission checks and attempts to get past a security control, such as input that fails validation or a hit on a rate limit, are logged with who, what and when, but never the password, token or personal data involved.",
+        why: "You can't stop or recover from an attack you can't see. These logs are how an attack gets noticed, and how anyone works out afterwards what it reached.",
+        ask: "Does this change add a sign-in, permission check or security control that refuses someone without logging it?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "medium",
+        sources: [
+            { name: ASVS, ref: "16.3.1, level 2", url: V16 },
+            { name: ASVS, ref: "16.3.2, level 2", url: V16 },
+            { name: ASVS, ref: "16.3.3, level 2", url: V16 },
+        ],
+    },
+    {
+        id: "SEC-25",
+        domain: "security",
+        title: "The threat model changes when the ways in change",
+        rule: "When a change adds a new way into the system, such as an endpoint, an upload, a webhook, a sign-in method or an outside service, the same change updates the threat model: what could go wrong through it, and what stops it.",
+        why: "A threat model written once describes the system as it was. Attacks come through the parts added since.",
+        ask: "Does this change add a way into the system that the threat model doesn't cover yet?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "medium",
+    },
+    {
+        id: "SEC-26",
+        domain: "security",
+        title: "Every secret can be replaced quickly",
+        rule: "A list names each of the project's secrets, where it lives and how to replace it. Each can be replaced without changing code, and each is replaced on a schedule and at once if it may have leaked.",
+        why: "A leaked key keeps working until it's replaced. Deleting it from wherever it leaked doesn't stop anyone who already copied it.",
+        ask: "Can every secret this change adds be replaced without changing code, and is it on the list?",
+        stage: "production",
+        check: "ai-review",
+        severity: "medium",
+        sources: [
+            { name: ASVS, ref: "13.1.4, level 3", url: V13 },
+            { name: ASVS, ref: "13.3.4, level 3", url: V13 },
+        ],
+    },
+    {
+        id: "SEC-27",
+        domain: "security",
+        title: "Secret scanning runs on every change",
+        rule: "A secret scanner checks every change before it merges, and the repository's history once, and fails the build when it finds a secret. It's confirmed to have actually run.",
+        why: 'Secrets slip in by accident: a key pasted in to test something, an .env file added by mistake. A scanner catches them before they spread, and a crashed scanner reports the same "nothing found" as a clean one. A missing scanner is a gap in the safety net, not a leak, so it ranks below a secret actually in the code (SEC-10).',
+        ask: "Does every change pass a secret scan that fails the build when it finds a secret?",
+        stage: "mvp",
+        check: "auto",
+        severity: "medium",
+    },
+    {
+        id: "SEC-28",
+        domain: "security",
+        title: "Each service has only the access it needs",
+        rule: "Each service, job and part of the product reaches the others with an account of its own, allowed only what it needs: a service that reads one table can't drop the database, and none shares an administrator's account.",
+        why: "When one part is broken into, its account decides how far the attacker gets. An account that can do everything turns one weak part into the whole system.",
+        ask: "Does this change give a service, job or part more access than it needs, or a shared or administrator account?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "high",
+        sources: [
+            { name: ASVS, ref: "13.2.1, level 2", url: V13 },
+            { name: ASVS, ref: "13.2.2, level 2", url: V13 },
+        ],
+    },
+    {
+        id: "SEC-29",
+        domain: "security",
+        title: "Nothing is public unless it's meant to be",
+        rule: "Storage, databases, queues, admin and monitoring pages, internal documentation and debug modes are reachable only by who needs them. Each thing open to the internet is open on purpose, and says so in the configuration.",
+        why: "A storage bucket or database left open to the internet is found by automated scanners within hours, and everything in it is exposed at once.",
+        ask: "Does this change make anything reachable from the internet that isn't meant to be, or switch on a debug mode in production?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "critical",
+        sources: [
+            { name: ASVS, ref: "13.4.5, level 2", url: V13 },
+            { name: ASVS, ref: "13.4.2, level 2", url: V13 },
+        ],
+    },
+    {
+        id: "SEC-30",
+        domain: "security",
+        title: "Nothing from outside runs as code or a command",
+        rule: "Text is never run as code, such as with eval or by building a function from a string, and a system command never goes through a shell with outside data in it: commands take their arguments as a list.",
+        why: "Text that runs as code or as a shell command can do anything the process can: read its secrets, change its data, or take over the machine.",
+        ask: "Does this change run text as code, or pass outside data to a shell?",
+        stage: "prototype",
+        check: "ai-review",
+        severity: "critical",
+        sources: [
+            { name: ASVS, ref: "1.3.2, level 1", url: V1 },
+            { name: ASVS, ref: "1.2.5, level 1", url: V1 },
+        ],
+    },
+];

package/dist/core/system-design.d.ts

@@ -0,0 +1,31 @@
+export declare const systemDesign: ({
+    id: string;
+    domain: "system-design";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "mvp";
+    check: "ai-review";
+    severity: "high";
+} | {
+    id: string;
+    domain: "system-design";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "mvp";
+    check: "ai-review";
+    severity: "medium";
+} | {
+    id: string;
+    domain: "system-design";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "production";
+    check: "ai-review";
+    severity: "medium";
+})[];

package/dist/core/system-design.js

@@ -0,0 +1,69 @@
+// How the system behaves under load, concurrency and background work.
+export const systemDesign = [
+    {
+        id: "SYS-01",
+        domain: "system-design",
+        title: "Background jobs are safe to run twice",
+        rule: "A background job gives the same result if it runs twice, because queues redeliver.",
+        why: "A job that assumes it runs exactly once corrupts data the first time a queue redelivers it.",
+        ask: "What happens if a job in this change runs twice?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "high",
+    },
+    {
+        id: "SYS-02",
+        domain: "system-design",
+        title: "Nothing slow blocks a request",
+        rule: "Slow work such as sending email, push notifications and processing documents goes to a queue. A request never waits for it.",
+        why: "A confirmation that waits on a mail server fails whenever the mail server is slow.",
+        ask: "Does any request in this change wait for slow work that could go to a queue?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "medium",
+    },
+    {
+        id: "SYS-03",
+        domain: "system-design",
+        title: "Two people will do the same thing at the same time",
+        rule: "If two people doing the same thing at once could corrupt data, the database prevents it, not the order the code happens to run in. Counting rows and adding one is not a way to make ids.",
+        why: "Two checkouts on the last slot, or two couriers accepting one job, happen every day under real load.",
+        ask: "What happens if two people run this change's code at the same moment?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "high",
+    },
+    {
+        id: "SYS-04",
+        domain: "system-design",
+        title: "What's read to be changed is locked first",
+        rule: "Reading a value, changing it and writing it back, such as a balance or a count of places left, locks the record while it happens, using one shared lock helper.",
+        why: "Without the lock, two changes read the same value and one of them is silently lost.",
+        ask: "Does any read, change and write in this change lock what it's changing?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "high",
+    },
+    {
+        id: "SYS-05",
+        domain: "system-design",
+        title: "A database guarantee beats a check in code",
+        rule: "Where a rule can be a database guarantee, such as a unique constraint, it is one, rather than a check in the code.",
+        why: "\"Check that it doesn't exist, then insert\" can be raced. A unique constraint can't.",
+        ask: "Does this change check a rule in code that the database could guarantee?",
+        stage: "mvp",
+        check: "ai-review",
+        severity: "medium",
+    },
+    {
+        id: "SYS-06",
+        domain: "system-design",
+        title: "Contested state is tested concurrently",
+        rule: "Anything with limited capacity, held money or payouts has a test that runs it concurrently.",
+        why: "A test that runs one step at a time can't find the bug that only happens when two run at once.",
+        ask: "Does this change to contested state come with a test that runs it concurrently?",
+        stage: "production",
+        check: "ai-review",
+        severity: "medium",
+    },
+];

package/dist/core/testing.d.ts

@@ -0,0 +1,51 @@
+export declare const testing: ({
+    id: string;
+    domain: "testing";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "mvp";
+    check: "ai-review";
+    severity: "medium";
+} | {
+    id: string;
+    domain: "testing";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "mvp";
+    check: "auto";
+    severity: "medium";
+} | {
+    id: string;
+    domain: "testing";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "mvp";
+    check: "ai-review";
+    severity: "low";
+} | {
+    id: string;
+    domain: "testing";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "production";
+    check: "person";
+    severity: "medium";
+} | {
+    id: string;
+    domain: "testing";
+    title: string;
+    rule: string;
+    why: string;
+    ask: string;
+    stage: "production";
+    check: "ai-review";
+    severity: "medium";
+})[];