redlinegate 0.0.1

package/standards/manifest.json

@@ -0,0 +1,214 @@
+{
+  "$comment": "Single source of truth for Redline. scripts/render.mjs turns this into vendor-specific artifacts. Never hand-edit generated output.",
+  "version": "0.0.3",
+  "core": {
+    "title": "Redline Core Engineering Standards",
+    "source": "standards/core.md"
+  },
+  "stacks": {
+    "javascript": {
+      "title": "JavaScript",
+      "source": "standards/stacks/javascript.md",
+      "globs": [
+        "**/*.js",
+        "**/*.jsx",
+        "**/*.mjs",
+        "**/*.cjs"
+      ]
+    },
+    "react": {
+      "title": "React (web)",
+      "source": "standards/stacks/react.md",
+      "globs": [
+        "**/*.tsx",
+        "**/*.jsx",
+        "src/**/*.ts",
+        "app/**/*.ts",
+        "packages/**/src/**/*.ts",
+        "apps/**/src/**/*.ts"
+      ]
+    },
+    "react-native": {
+      "title": "React Native",
+      "source": "standards/stacks/react-native.md",
+      "extends": [
+        "react"
+      ],
+      "globs": [
+        "**/*.tsx",
+        "**/*.native.ts",
+        "app/**/*.ts",
+        "src/screens/**",
+        "src/components/**",
+        "packages/**/src/**/*.tsx",
+        "apps/**/src/**/*.tsx"
+      ]
+    },
+    "nodejs": {
+      "title": "Node.js (NestJS)",
+      "source": "standards/stacks/nodejs.md",
+      "globs": [
+        "src/**/*.ts",
+        "apps/**/src/**/*.ts",
+        "libs/**/src/**/*.ts",
+        "packages/**/src/**/*.ts"
+      ]
+    },
+    "microservices": {
+      "title": "Microservice cross-cutting",
+      "source": "standards/stacks/microservices.md",
+      "globs": [
+        "**/*.java",
+        "**/*.go",
+        "**/*.py",
+        "**/*.cs",
+        "src/**/*.ts",
+        "cmd/**",
+        "internal/**",
+        "services/**"
+      ]
+    },
+    "java": {
+      "title": "Java (Spring Boot)",
+      "source": "standards/stacks/java.md",
+      "globs": [
+        "**/*.java"
+      ]
+    },
+    "go": {
+      "title": "Go",
+      "source": "standards/stacks/go.md",
+      "globs": [
+        "**/*.go"
+      ]
+    },
+    "python": {
+      "title": "Python",
+      "source": "standards/stacks/python.md",
+      "globs": [
+        "**/*.py"
+      ]
+    },
+    "csharp": {
+      "title": "C# (.NET)",
+      "source": "standards/stacks/csharp.md",
+      "globs": [
+        "**/*.cs"
+      ]
+    },
+    "kotlin": {
+      "title": "Kotlin",
+      "source": "standards/stacks/kotlin.md",
+      "globs": [
+        "**/*.kt",
+        "**/*.kts"
+      ]
+    },
+    "swift": {
+      "title": "Swift (iOS)",
+      "source": "standards/stacks/swift.md",
+      "globs": [
+        "**/*.swift"
+      ]
+    },
+    "terraform": {
+      "title": "Terraform / HCL",
+      "source": "standards/stacks/terraform.md",
+      "globs": [
+        "**/*.tf",
+        "**/*.tfvars",
+        "**/*.hcl"
+      ]
+    }
+  },
+  "$profileComment": "A repo installs exactly one profile. Profiles are the disambiguation mechanism: glob negation is not portable across vendors, so we never install two rule sets that would contradict each other in the same repo.",
+  "profiles": {
+    "tooling": [
+      "javascript"
+    ],
+    "web": [
+      "javascript",
+      "react"
+    ],
+    "mobile-rn": [
+      "javascript",
+      "react",
+      "react-native"
+    ],
+    "mobile-android": [
+      "kotlin"
+    ],
+    "mobile-ios": [
+      "swift"
+    ],
+    "service-java": [
+      "microservices",
+      "java"
+    ],
+    "service-go": [
+      "microservices",
+      "go"
+    ],
+    "service-node": [
+      "javascript",
+      "microservices",
+      "nodejs"
+    ],
+    "service-python": [
+      "microservices",
+      "python"
+    ],
+    "service-dotnet": [
+      "microservices",
+      "csharp"
+    ],
+    "infra": [
+      "terraform"
+    ],
+    "fullstack-node": [
+      "javascript",
+      "react",
+      "microservices",
+      "nodejs"
+    ]
+  },
+  "$aliasComment": "Legacy profile names accepted by sync-targets.txt for backwards compatibility.",
+  "profileAliases": {
+    "mobile": "mobile-rn",
+    "java": "service-java",
+    "go": "service-go",
+    "node": "service-node",
+    "python": "service-python",
+    "dotnet": "service-dotnet"
+  },
+  "vendors": {
+    "copilot": {
+      "title": "GitHub Copilot code review",
+      "enabled": true
+    },
+    "agents": {
+      "title": "AGENTS.md (OpenAI Codex, Copilot coding agent, Jules, Cursor agent, Devin)",
+      "enabled": true
+    },
+    "claude": {
+      "title": "Claude Code / Claude in GitHub",
+      "enabled": true
+    },
+    "cursor": {
+      "title": "Cursor rules",
+      "enabled": false
+    },
+    "skills": {
+      "$comment": "Ships off. It renders the same rules as the claude vendor in a different shape, and a repository selecting both loads every stack twice. Select it INSTEAD of claude where per-stack loading is wanted: redline init --vendors skills,copilot,agents.",
+      "title": "Claude skills (per-stack, loaded on demand)",
+      "enabled": false
+    }
+  },
+  "$deterministicComment": "Rules a checker decides without a model. The classification lives HERE and not in the markdown deliberately: standards/*.md is what a reviewer reads, and removing a rule from it because a checker also covers it would narrow what the model considers. Every rule is classified by construction \u2014 listed here means deterministic, absent means judgement. Ids are permanent and are never rewritten by this list. scripts/validate.mjs fails the build if an id here has no implementation in cli/policy/checks.ts, which is the failure mode where a rule is silently enforced by nobody.",
+  "deterministic": [
+    "core/untracked-todo",
+    "core/type-checker-suppression",
+    "javascript/var-in-new-code",
+    "javascript/unsafe-numeric-coercion"
+  ]
+}

package/standards/stacks/csharp.md

@@ -0,0 +1,29 @@
+# C# (.NET) Review Rules
+
+## BLOCKER — request changes
+
+- `csharp/async-void` — **`async void`** anywhere except event handlers — exceptions escape the caller and crash the process; return `Task`.
+- `csharp/sync-over-async` — **Sync-over-async**: `.Result`, `.Wait()`, `.GetAwaiter().GetResult()` on async calls — deadlock and thread-pool starvation; async all the way.
+- `csharp/httpclient-per-request` — **`HttpClient` instantiated per request** — socket exhaustion; use `IHttpClientFactory`.
+- `csharp/captive-dependencies` — **Captive dependencies**: scoped services (DbContext) injected into singletons — cross-request state bleed; inject `IServiceScopeFactory` or restructure.
+- `csharp/sql-string-concatenation` — **String-concatenated SQL with external input** — parameterized queries / EF LINQ only.
+- `csharp/swallowed-exceptions` — **Swallowed exceptions**: `catch { }` or catch-log-continue treating failure as success.
+- `csharp/missing-cancellation-token` — **Missing `CancellationToken` propagation** on new async endpoints and outbound calls.
+
+## HIGH
+
+- `csharp/ef-n-plus-one` — EF Core N+1: navigation properties accessed in loops — `.Include`/projection; and unbounded queries without paging.
+- `csharp/multiple-enumeration` — `IEnumerable` multiple enumeration of LINQ-to-entities queries — materialize once with `ToListAsync`.
+- `csharp/datetime-now` — DateTime.Now in new code — `DateTimeOffset.UtcNow` / `TimeProvider`.
+- `csharp/entity-in-controller-response` — Entities returned from controllers — DTOs/records only; entities leak lazy-nav and internal fields.
+- `csharp/missing-model-validation` — Missing model validation at the boundary (`[ApiController]` + data annotations or FluentValidation).
+- `csharp/lock-over-async` — `lock` over async operations (can't await inside lock) — `SemaphoreSlim`.
+- `csharp/fire-and-forget-task-run` — Fire-and-forget `Task.Run` without exception observation — use hosted services / background queues.
+- `csharp/exception-detail-in-response` — Exception details in API responses — ProblemDetails mapping.
+
+## SUGGESTION
+
+- `csharp/records-for-dtos` — Records for immutable DTOs; `required`/init-only properties over constructors with many args.
+- `csharp/nullable-reference-types` — Nullable reference types enabled and respected in new projects — no `!` dammit-operator without comment.
+- `csharp/structured-logging` — `ILogger<T>` structured logging with message templates, not string interpolation.
+- `csharp/api-style-consistency` — Minimal APIs vs controllers — follow whichever the service already uses.

package/standards/stacks/go.md

@@ -0,0 +1,30 @@
+# Go Review Rules
+
+## BLOCKER — request changes
+
+- `go/ignored-errors` — **Ignored errors.** `_ = err`, unchecked returns, or `err` shadowed and never handled. Every error is handled, returned wrapped (`fmt.Errorf("...: %w", err)`), or explicitly justified.
+- `go/goroutine-leaks` — **Goroutine leaks.** Goroutine started without a way to stop: missing context cancellation, blocked forever on channel send/receive, no `WaitGroup`/errgroup ownership.
+- `go/missing-ctx-propagation` — **Missing `ctx` propagation.** Outbound calls (HTTP, DB, gRPC) must take the request's `context.Context`; no `context.Background()` inside request handling.
+- `go/data-races` — **Data races.** Shared map/slice/struct written from multiple goroutines without mutex or channel ownership; loop variable captured by reference in goroutine (pre-1.22 semantics or when version unknown).
+- `go/writing-nil-map` — **Writing to a nil map.**
+- `go/copying-sync-primitive` — **Copying a struct containing `sync.Mutex`/`sync.WaitGroup`** (passing by value, range over slice of them).
+- `go/defer-in-loop` — **`defer` in a loop for per-iteration resources** (files, rows, locks) — defers pile up until function exit; extract loop body into a function.
+- `go/panic-for-expected-failure` — **Panics for expected failures** — panic only for programmer errors; return errors otherwise.
+
+## HIGH
+
+- `go/missing-client-server-timeout` — `http.Client`/`http.Server` without timeouts (`Timeout`, `ReadTimeout`, `WriteTimeout`) — zero values mean infinite.
+- `go/response-body-not-drained` — Response body not closed, or closed without being drained (breaks connection reuse).
+- `go/errors-is-as` — `errors.Is`/`errors.As` not used where sentinel/typed errors are compared with `==` or type assertion.
+- `go/interface-at-implementation` — Interfaces defined next to the implementation instead of the consumer; interfaces with one implementation and no test need.
+- `go/waitgroup-add-inside-goroutine` — `sync.WaitGroup.Add` inside the goroutine instead of before starting it.
+- `go/unbuffered-channel-blocks-producer` — Unbuffered channel used where the producer must never block, or buffer sizes chosen arbitrarily without comment.
+- `go/time-after-in-loop` — `time.After` in a loop (leaks timers until fire) — use `time.NewTimer`/`Ticker` with Stop.
+- `go/package-level-mutable-state` — Package-level mutable state in new code.
+
+## SUGGESTION
+
+- `go/naked-returns` — Naked returns in functions longer than a few lines.
+- `go/any-over-concrete-type` — `interface{}`/`any` where a concrete type or generic works.
+- `go/error-string-style` — Error strings capitalized or ending with punctuation (Go convention: lowercase, no period).
+- `go/receiver-consistency` — Struct field alignment/pointer-vs-value receiver inconsistency within a type.

package/standards/stacks/java.md

@@ -0,0 +1,30 @@
+# Java (Spring Boot) Review Rules
+
+## BLOCKER — request changes
+
+- `java/entity-in-controller-response` — **JPA entities returned from controllers.** Endpoints return DTOs; entities leak lazy-loading proxies, internal fields, and cause serialization surprises.
+- `java/n-plus-one-queries` — **N+1 queries.** Lazy association accessed in a loop or during serialization — require fetch join, `@EntityGraph`, or a projection.
+- `java/transactional-self-invocation` — **`@Transactional` on private/self-invoked methods** — proxy is bypassed, annotation silently does nothing.
+- `java/broad-catch` — **Catching `Exception`/`Throwable` broadly and continuing** — catch specific types; rethrow or fail the operation.
+- `java/field-injection` — **Field injection (`@Autowired` on fields)** in new code — constructor injection only; field injection breaks testability and hides dependencies.
+- `java/mutable-singleton-state` — **Mutable shared state in singleton beans** without synchronization — services/components are singletons; instance fields must be immutable or thread-safe.
+- `java/blocking-in-reactive` — **Blocking calls inside reactive pipelines** (WebFlux: `block()`, JDBC, `RestTemplate` inside `Mono`/`Flux` chains).
+- `java/jpql-string-concatenation` — **String-concatenated JPQL/SQL with external input** — parameterized queries / criteria API only.
+
+## HIGH
+
+- `java/optional-misuse` — `Optional` misuse: `Optional.get()` without presence check, `Optional` as field or method parameter.
+- `java/entity-equals-hashcode` — `equals`/`hashCode` on JPA entities using generated IDs incorrectly (breaks in sets before persist) — or missing entirely on value objects.
+- `java/missing-bean-validation` — Missing `@Valid` + Bean Validation on request DTOs at controller boundary.
+- `java/transaction-scope-too-wide` — Transaction scope too wide: external HTTP calls or message publishing inside `@Transactional` — holds connections, couples commit to remote latency.
+- `java/async-without-executor` — `@Async`/`CompletableFuture` work without dedicated executor — default pool starvation.
+- `java/exception-detail-in-response` — Exception details (stack traces, SQL) returned in API error responses — map to problem-detail responses.
+- `java/legacy-date-api` — New Date/`Calendar`/`SimpleDateFormat` in new code — `java.time` only; `SimpleDateFormat` is not thread-safe.
+- `java/stream-side-effects` — Streams with side effects (`forEach` mutating external collections) — collect instead.
+
+## SUGGESTION
+
+- `java/lombok-data-on-entity` — Lombok `@Data` on entities (equals/hashCode/toString pitfalls) — prefer `@Getter` + explicit methods, or records for DTOs.
+- `java/records-for-dtos` — Records for immutable DTOs where Java version allows.
+- `java/var-usage` — `var` for obviously-typed locals; explicit types where inference hurts readability.
+- `java/magic-values` — Magic numbers/strings for business values — extract named constants.

package/standards/stacks/javascript.md

@@ -0,0 +1,42 @@
+# JavaScript Review Rules
+
+Applies to untyped and loosely-typed JS (`.js`, `.jsx`, `.mjs`, `.cjs`), including build
+scripts, config files, serverless handlers, and legacy app code. TypeScript rules in the
+core standard apply wherever the file is typed.
+
+## BLOCKER — request changes
+
+- `javascript/prototype-pollution` — **Prototype pollution sinks.** Recursive merge/`Object.assign` over external input
+  without rejecting `__proto__`, `constructor`, `prototype` keys.
+- `javascript/dynamic-code-execution` — **`eval`, `new Function`, `setTimeout("string")`** on anything derived from external input.
+- `javascript/floating-promises` — **Floating promises.** Every promise is `await`ed, returned, or `.catch`-handled. An
+  unhandled rejection terminates the process on modern Node.
+- `javascript/loose-equality-coercion` — **`==` against `null`/`undefined`/`0`/`''` where coercion changes the branch** — use
+  `===`, or `== null` only as a deliberate nullish check with a comment.
+- `javascript/shared-module-state-mutation` — **Mutating a shared module-scope object/array** used across requests or components.
+- `javascript/unvalidated-boundary-input` — **Missing input validation at the boundary** — `JSON.parse` of external payloads without
+  try/catch and a size limit; `req.body` fields consumed without a schema check.
+- `javascript/scattered-env-access` — **Secrets read ad hoc from `process.env` scattered across modules** — one validated
+  config module, fail fast at startup.
+- `javascript/shell-injection` — **`child_process.exec` with an interpolated string** — use `execFile`/`spawn` with argv.
+
+## HIGH
+
+- `javascript/var-in-new-code` — `var` in new code — `const` by default, `let` when reassigned.
+- `javascript/for-in-over-arrays` — `for...in` over arrays, or without `hasOwnProperty` filtering over objects.
+- `javascript/unchecked-index-access` — Array index access assumed defined (`arr[0].x`) without a length or nullish check.
+- `javascript/unsafe-numeric-coercion` — `parseInt` without radix; `Number()`/`+` coercion of user input without `Number.isFinite`.
+- `javascript/async-callback-ignored-promise` — `async` callbacks passed to APIs that ignore the returned promise (`array.forEach`,
+  most event emitters) — rejections vanish.
+- `javascript/hand-rolled-deep-clone` — Deep-equality or deep-clone hand-rolled instead of `structuredClone`/a maintained util.
+- `javascript/unsafe-date-arithmetic` — Date arithmetic on `Date` objects across DST boundaries or with implicit local timezone.
+- `javascript/try-catch-whole-function` — `try`/`catch` around a whole function body instead of the failing boundary call.
+- `javascript/redos` — Regexes built from external input (ReDoS), or catastrophic backtracking patterns
+  (nested quantifiers over user-controlled length).
+
+## SUGGESTION
+
+- `javascript/prefer-optional-chaining` — Optional chaining and nullish coalescing over `&&`/`||` ladders.
+- `javascript/prefer-named-exports` — Named exports over default exports for tree-shaking and refactor safety.
+- `javascript/jsdoc-on-exports` — JSDoc types on exported functions in files that will not be converted to TS soon.
+- `javascript/array-at-negative-index` — `Array.prototype.at(-1)` over `arr[arr.length - 1]`.

package/standards/stacks/kotlin.md

@@ -0,0 +1,27 @@
+# Kotlin Review Rules (Android + backend)
+
+## BLOCKER — request changes
+
+- `kotlin/force-unwrap` — **`!!` non-null assertions** in production paths — restructure with `?.`, `?:`, `requireNotNull` with a message, or fix the type.
+- `kotlin/globalscope` — **`GlobalScope.launch`** — coroutines must live in a structured scope (`viewModelScope`, `lifecycleScope`, injected `CoroutineScope`); GlobalScope leaks work past the owner's lifetime.
+- `kotlin/blocking-in-coroutine` — **Blocking inside coroutines**: `Thread.sleep`, blocking IO, or `runBlocking` on `Dispatchers.Main` / inside `suspend` functions — use `delay`, suspending clients, or `withContext(Dispatchers.IO)`.
+- `kotlin/context-leak` — **Android `Context` held by singletons / companion objects** — activity context leaks the whole view tree; application context only, and only when unavoidable.
+- `kotlin/broad-catch-cancellation` — **Catching `Exception`/`Throwable` broadly and continuing** — also swallows `CancellationException`, breaking coroutine cancellation; catch specific types and rethrow `CancellationException`.
+- `kotlin/unconfined-shared-state` — **Mutable shared state across coroutines without confinement** — use `Mutex`, `StateFlow`, or single-thread confinement.
+- `kotlin/lateinit-misuse` — **`lateinit` used to dodge nullability logic** — acceptable only for framework-injected fields (DI, Android lifecycle).
+
+## HIGH
+
+- `kotlin/public-mutable-state` — Public `MutableStateFlow` / `MutableLiveData` — expose read-only `StateFlow`/`LiveData`, mutate privately.
+- `kotlin/lifecycle-unaware-collection` — Flow collection in UI without `repeatOnLifecycle` / `collectAsStateWithLifecycle` — collects while backgrounded.
+- `kotlin/hardcoded-dispatcher` — Hardcoded `Dispatchers.*` in classes — inject dispatchers for testability.
+- `kotlin/data-class-var` — `data class` with `var` properties — copy/equality semantics break; use `val` + `copy`.
+- `kotlin/companion-mutable-state` — Companion-object mutable state (global by another name).
+- `kotlin/runcatching-silent-default` — `runCatching` chains that map failure to a default silently.
+- `kotlin/force-unwrap-in-tests` — `!!` in tests hiding what the test actually asserts — use `assertNotNull` semantics.
+
+## SUGGESTION
+
+- `kotlin/prefer-sealed-state` — Sealed interfaces/classes for UI and result states instead of nullable-field combinations.
+- `kotlin/value-class-identifiers` — `value class` for domain identifiers (MSISDN, AccountId) instead of raw `String`.
+- `kotlin/deep-scope-function-nesting` — Nested `let`/`apply`/`run` chains more than two deep — extract a function.

package/standards/stacks/microservices.md

@@ -0,0 +1,37 @@
+# Microservice Cross-Cutting Review Rules
+
+**Scope:** backend service code in any language. Applies in addition to the
+language-specific rules, never instead of them.
+
+Apply to all backend services regardless of language, in addition to the language-specific rules.
+
+## BLOCKER — request changes
+
+- `microservices/missing-timeout` — **Outbound calls without timeouts.** Every HTTP/gRPC/DB/queue call must have an explicit timeout; no infinite defaults.
+- `microservices/unversioned-breaking-change` — **Breaking API changes without versioning.** Removing/renaming fields, changing types, or tightening validation on a published API contract requires a version bump or an approved deprecation path. Additive changes only on existing versions.
+- `microservices/pii-in-telemetry` — **PII in logs, traces, or metrics labels** — MSISDN, email, account IDs, tokens. Log opaque IDs only.
+- `microservices/secrets-in-config` — **Secrets in code, Dockerfiles, compose files, Helm values, or CI YAML** — vault/secret-manager references only.
+- `microservices/non-idempotent-consumer` — **Non-idempotent consumers/handlers for at-least-once delivery** (Kafka, SQS, retries on POST). Duplicate delivery must not double-apply.
+- `microservices/swallowed-errors` — **Swallowed errors** — catch-and-ignore, error logged then treated as success, or error branch returning 200.
+
+## HIGH
+
+- `microservices/retry-without-backoff` — Retries without backoff + jitter, or retrying non-idempotent operations.
+- `microservices/missing-circuit-breaker` — Missing circuit breaker / bulkhead on dependencies known to degrade (peer services, third parties).
+- `microservices/unauthenticated-endpoint` — New endpoint without authn/authz middleware — even "internal" services; do not trust the network.
+- `microservices/dual-write-no-outbox` — DB work and message publish in one logical step without outbox or equivalent — dual-write inconsistency.
+- `microservices/unbounded-work` — Unbounded work from external input: no pagination limits, unbounded batch sizes, unbounded payload accepted.
+- `microservices/readiness-liveness-conflated` — Missing health/readiness distinction: readiness must fail when dependencies are down; liveness must not.
+- `microservices/missing-trace-propagation` — New external call without propagating trace context / correlation ID.
+- `microservices/incompatible-migration` — Migration not backward-compatible with the currently deployed version (rename/drop column while old pods still run).
+
+## SUGGESTION
+
+- `microservices/undocumented-config` — New config value without a sane default and documentation in the service README/values file.
+- `microservices/missing-metrics` — Metrics for new critical paths (rate, errors, duration) missing.
+- `microservices/missing-dlq-handling` — Consumer lag / DLQ handling absent on new consumers.
+
+## What NOT to flag
+
+- Existing contract shapes the PR does not modify.
+- Infrastructure choices (broker, DB engine) already established in the service.

package/standards/stacks/nodejs.md

@@ -0,0 +1,34 @@
+# Node.js (NestJS) Service Review Rules
+
+**Scope:** server-side TypeScript in a NestJS service. Do not apply these rules to
+`.tsx` files, test specs, or front-end code; if you see React in the file, this rule
+set does not apply.
+
+## BLOCKER — request changes
+
+- `nodejs/floating-promises` — **Floating promises.** Every promise is `await`ed, returned, or explicitly handled with `.catch` — an unhandled rejection crashes the process on modern Node.
+- `nodejs/blocking-event-loop` — **Blocking the event loop.** Sync APIs in request paths (`fs.*Sync`, `child_process.execSync`, `crypto.pbkdf2Sync`), or CPU-heavy loops/JSON parsing of large payloads without worker threads.
+- `nodejs/missing-dto-validation` — **Missing validation at the boundary.** Request DTOs must use `class-validator` decorators with a global `ValidationPipe` (`whitelist: true`); no raw `@Body() body: any`.
+- `nodejs/request-state-on-singleton` — **Request-scoped data in singleton providers.** NestJS providers are singletons by default — storing per-request state on `this` bleeds data across users. Use `REQUEST` scope deliberately or AsyncLocalStorage.
+- `nodejs/await-in-loop` — **`await` in a loop for independent operations** — require `Promise.all` / `Promise.allSettled` with a bounded batch size.
+- `nodejs/config-outside-configservice` — **Secrets/config read via `process.env` scattered through code** — access only through the typed `ConfigService`/config module, validated at startup (fail fast on missing).
+- `nodejs/error-detail-swallowed` — **Errors caught and converted to generic 500 with details swallowed** — use exception filters; preserve cause in logs (structured), never in the response body.
+
+## HIGH
+
+- `nodejs/logic-in-controller` — Business logic in controllers — controllers translate HTTP only; logic lives in providers/services.
+- `nodejs/forwardref-circular-dependency` — Circular module dependencies "solved" with `forwardRef` where extraction of a shared module is possible.
+- `nodejs/raw-http-client` — Raw `axios`/`fetch` calls without timeout, and without going through the service's shared HTTP client (interceptors carry auth, tracing, retries).
+- `nodejs/missing-guard` — New endpoint missing guard coverage (authn/authz) — verify global guard applies or explicit guard present.
+- `nodejs/orm-n-plus-one` — TypeORM/Prisma queries inside loops (N+1) — batch with `In()`/`findMany`.
+- `nodejs/transaction-spans-remote-call` — Transactions spanning external HTTP calls or message publishes.
+- `nodejs/json-parse-external-input` — `JSON.parse` on external input without size limits or try/catch at the boundary.
+- `nodejs/missing-listener-teardown` — Event emitter / interval / stream listeners registered without teardown in `onModuleDestroy`.
+- `nodejs/console-logging` — Logging via `console.*` instead of the injected structured logger.
+
+## SUGGESTION
+
+- `nodejs/dto-input-output-shared` — DTO classes reused for both input and output — split; output shape is a contract.
+- `nodejs/lazy-import-heavy-modules` — Heavy modules imported at top level but used in one rarely-hit path — lazy import.
+- `nodejs/magic-values` — Magic status codes/strings — use `HttpStatus` and shared enums.
+- `nodejs/hot-loop-allocation` — Repeated `Date.now()` / `new Intl.*` in hot loops — hoist.

package/standards/stacks/python.md

@@ -0,0 +1,29 @@
+# Python Review Rules
+
+## BLOCKER — request changes
+
+- `python/mutable-default-argument` — **Mutable default arguments** (`def f(items=[])`) — shared across calls; use `None` + assign inside.
+- `python/bare-except` — **Bare `except:` or `except Exception: pass`** — catch specific exceptions; never silence. Bare `except` also eats `KeyboardInterrupt`/`SystemExit`.
+- `python/sql-string-interpolation` — **SQL built with f-strings/`%`/`.format` from external input** — parameterized queries only.
+- `python/subprocess-shell-injection` — **`subprocess` with `shell=True`** on anything derived from external input; prefer list-form argv always.
+- `python/dynamic-code-execution` — **`eval`/`exec`/`pickle.loads` on external data.**
+- `python/blocking-in-async` — **Blocking calls inside `async def`**: `requests`, `time.sleep`, sync DB drivers — use `httpx`/`aiohttp`, `asyncio.sleep`, async drivers, or `run_in_executor`.
+- `python/secrets-not-centralised` — **Secrets hardcoded or read ad hoc** — central config module, validated at startup.
+
+## HIGH
+
+- `python/missing-type-hints` — Missing type hints on new public functions — new code is typed; assume mypy/pyright strict.
+- `python/missing-context-manager` — Files/connections/locks without context managers (`with`) — leaks on exception paths.
+- `python/module-level-mutable-state` — Module-level mutable state used as implicit singleton across requests (Lambda warm starts share it — intentional caching must be explicit and documented).
+- `python/broad-except-in-loop` — Broad `except Exception` that logs and continues in loops — one poisoned item must not silently vanish; dead-letter or re-raise policy required.
+- `python/naive-datetime` — Datetime handling: naive `datetime.now()` in new code — `datetime.now(timezone.utc)` and timezone-aware throughout.
+- `python/assert-for-validation` — `assert` for runtime validation — stripped under `-O`; raise proper exceptions.
+- `python/boto3-client-per-call` — Boto3 clients created per call inside handlers/loops — create at module scope (Lambda) or inject.
+- `python/http-call-without-timeout` — Unbounded `requests`/`httpx` calls without timeout.
+
+## SUGGESTION
+
+- `python/prefer-typed-models` — Dataclasses/pydantic models over dict-shaped data crossing function boundaries.
+- `python/prefer-pathlib` — `pathlib` over `os.path` string juggling in new code.
+- `python/prefer-f-strings` — f-strings over `%`/`.format`.
+- `python/prefer-comprehensions` — Comprehensions over `map`/`filter` with lambdas; but no nested comprehensions beyond two levels.

package/standards/stacks/react-native.md

@@ -0,0 +1,29 @@
+# React Native Review Rules
+
+All React rules apply. Additionally:
+
+## BLOCKER — request changes
+
+- `react-native/unvirtualised-list` — **Large lists without virtualization.** `ScrollView` + `.map()` over dynamic data, or `FlatList` where FlashList is the project standard — require FlashList (or FlatList minimum) for lists that can exceed ~20 items.
+- `react-native/unmemoised-list-item` — **Non-memoized list item components** — every list item must be `React.memo` with stable callback references (no inline arrow closures over changing values passed to items).
+- `react-native/animating-layout-properties` — **Animating layout properties** (`width`, `height`, `top`, `left`, `margin`) — animations must use `transform` and `opacity` only; layout properties run on the JS thread and jank.
+- `react-native/bare-strings-outside-text` — **Bare strings outside `<Text>`** — crashes on Android.
+- `react-native/falsy-and-rendering` — **Falsy `&&` rendering** (`count && <X/>`) — renders `0`/`NaN` as text and crashes on Android; require ternary.
+- `react-native/blocking-gesture-handler` — **Blocking the JS thread in gesture/scroll handlers** — heavy work in `onScroll` without Reanimated worklets or throttling.
+
+## HIGH
+
+- `react-native/inline-props-in-list-items` — Inline style objects / inline functions in list item props — hoist or memoize; breaks item memoization.
+- `react-native/remote-image-component` — `Image` from react-native for remote images where `expo-image` is available — no caching, no placeholder handling.
+- `react-native/prefer-pressable` — `TouchableOpacity` in new code — use `Pressable`.
+- `react-native/js-navigator` — JS-based navigators where native stack (`@react-navigation/native-stack`) is available.
+- `react-native/missing-safe-area` — Missing safe-area handling in full-screen ScrollViews.
+- `react-native/measure-over-onlayout` — `measure()` calls where `onLayout` suffices.
+- `react-native/native-dep-in-shared-package` — Native dependencies added to shared monorepo packages instead of the app package.
+- `react-native/reanimated-shared-value-misuse` — Reanimated shared values read during render or mutated outside worklets/handlers.
+
+## SUGGESTION
+
+- `react-native/intl-in-render` — `Intl.NumberFormat` / `Intl.DateTimeFormat` created inside render or loops — hoist to module scope.
+- `react-native/missing-getitemtype` — Heterogeneous lists without `getItemType` (FlashList).
+- `react-native/derived-animation-in-render` — Derived animation values computed in render instead of `useDerivedValue`.

package/standards/stacks/react.md

@@ -0,0 +1,46 @@
+# React Review Rules
+
+**Scope:** web React. Where a file is also matched by the React Native rules, the
+React Native rules extend these — they do not replace them. Do not flag web-only
+concerns (DOM, `next/dynamic`, bundle splitting) on React Native files.
+
+## BLOCKER — request changes
+
+- `react/effect-derived-state` — **`useEffect` for derived state.** State computable from existing props/state must be computed during render, never synced via effect.
+
+  ```tsx
+  // WRONG
+  useEffect(() => { setFullName(first + ' ' + last); }, [first, last]);
+  // RIGHT
+  const fullName = first + ' ' + last;
+  ```
+
+- `react/effect-for-event-logic` — **`useEffect` for event logic.** Notifications, analytics, navigation triggered by a user action belong in the event handler, not an effect watching state.
+- `react/missing-effect-cleanup` — **Missing `useEffect` cleanup** for subscriptions, timers, listeners, and in-flight requests (AbortController).
+- `react/direct-state-mutation` — **Direct state mutation** (`arr.push`, `obj.x =`, `.splice`) followed by `setState` — silent update failure.
+- `react/conditional-hook-calls` — **Conditional hook calls** — hooks inside `if`, loops, or early returns.
+- `react/key-is-index` — **`key={index}`** on lists that reorder, insert, or delete.
+- `react/server-data-in-local-state` — **Server data copied into local state.** With TanStack Query / SWR, the query result IS the source of truth — never `useEffect(() => setLocal(data))`.
+- `react/nested-component-definition` — **Component defined inside another component** — remounts every render, loses state.
+- `react/useformstatus-placement` — **`useFormStatus` in the same component that renders the `<form>`** — always returns `pending: false`; must be in a child.
+- `react/promise-in-render` — **Promise created during render passed to `use()`** — infinite loop; promise must come from props, state, or cache.
+- `react/exhaustive-deps-disabled` — **`eslint-disable react-hooks/exhaustive-deps`** — hides stale-closure bugs; require refactor instead.
+
+## HIGH
+
+- `react/incomplete-dependency-array` — Incomplete dependency arrays (stale closures).
+- `react/sequential-awaits` — Sequential `await`s for independent operations — require `Promise.all`.
+- `react/barrel-file-imports` — Barrel-file imports (`import { X } from '@/components'`) — require direct imports; barrels bloat bundles and cause circular deps.
+- `react/heavy-component-static-import` — Heavy components (charts, editors, modals) imported statically — require `next/dynamic` / `React.lazy`.
+- `react/uncontrolled-to-controlled` — `useState(undefined)` for controlled inputs — uncontrolled→controlled warning; use `''`.
+- `react/missing-error-boundary` — Missing Error Boundary around subtrees that fetch or can throw.
+- `react/falsy-and-rendering` — `&&` conditional rendering with a possibly-falsy non-boolean left side (`count && <X/>` renders `0`) — require ternary or explicit boolean.
+
+## SUGGESTION
+
+- `react/trivial-memoisation` — `useMemo`/`useCallback` wrapping trivial primitives — remove.
+- `react/missing-lazy-initialiser` — Expensive `useState` initializer without lazy init — pass a function.
+- `react/starttransition-for-non-urgent` — `startTransition` for non-urgent updates driving expensive renders.
+- `react/oversized-component` — Component over ~300 lines — suggest split.
+- `react/prop-drilling` — Prop drilling beyond 2–3 levels — suggest composition or context.
+- `react/prefer-ref-over-state` — Interaction state read only inside callbacks — use a ref, not state, to avoid re-renders.

package/standards/stacks/swift.md

@@ -0,0 +1,26 @@
+# Swift (iOS) Review Rules
+
+## BLOCKER — request changes
+
+- `swift/force-operations` — **Force operations in production paths**: `!` force-unwrap, `try!`, `as!` — restructure with `guard let`, `if let`, `try?` + handling, or fix the optionality.
+- `swift/retain-cycle` — **Retain cycles**: `self` captured strongly in `@escaping` closures stored by the object (handlers, subscriptions, timers) — require `[weak self]` and early-return pattern.
+- `swift/ui-off-main-actor` — **UI mutation off the main actor** — UIKit/SwiftUI state must be touched on `@MainActor` / main queue; no fire-and-forget background completion touching views.
+- `swift/blocking-main-thread` — **Blocking the main thread**: synchronous network/disk on main, `DispatchQueue.main.sync` from the main queue (deadlock).
+- `swift/uncancelled-task` — **Unstructured `Task {}` in views without cancellation** — tie to `.task {}` modifier or store and cancel; leaked tasks outlive the screen.
+- `swift/sensitive-data-in-userdefaults` — **Sensitive data in `UserDefaults`** — tokens/credentials belong in Keychain.
+
+## HIGH
+
+- `swift/unconfined-singleton-state` — Singletons with mutable state and no actor/queue confinement — convert to `actor` or confine.
+- `swift/completion-handler-in-new-code` — Completion-handler APIs in new code where async/await is available.
+- `swift/missing-mainactor` — Missing `@MainActor` on ObservableObject/ViewModel classes driving UI.
+- `swift/unremoved-observer` — `NotificationCenter` observers without removal (pre-iOS 9-style APIs) or Combine subscriptions without `cancellables` storage.
+- `swift/oversized-view` — Massive view controllers / SwiftUI views over ~300 lines — extract subviews and view models.
+- `swift/stringly-typed-identifiers` — Stringly-typed identifiers (segues, notification names, userInfo keys) — use enums/constants.
+- `swift/swallowed-decode-failure` — `Codable` decode failures swallowed with `try?` where the failure matters.
+
+## SUGGESTION
+
+- `swift/prefer-value-types` — Prefer `struct` value types; classes only for identity or reference semantics.
+- `swift/prefer-typed-throws` — `Result` grab-bags where typed `throws` is clearer.
+- `swift/prefer-guard-early-exit` — Prefer `guard` early-exit over nested `if let` pyramids.

package/standards/stacks/terraform.md

@@ -0,0 +1,27 @@
+# Terraform / HCL Review Rules
+
+## BLOCKER — request changes
+
+- `terraform/secrets-in-config` — **Secrets in `.tf`/`.tfvars`** — passwords, keys, tokens, connection strings. Reference Secrets Manager / SSM / vault data sources; mark variables `sensitive = true`.
+- `terraform/public-exposure` — **Public exposure**: `0.0.0.0/0` ingress on non-public ports, public S3 bucket ACLs/policies, `publicly_accessible = true` on databases — without an explicit justification comment and approval.
+- `terraform/missing-moved-block` — **Resource rename/move without `moved {}` block** — plan shows destroy+create; data loss on stateful resources.
+- `terraform/overly-broad-iam` — **Overly broad IAM**: `Action: "*"`, `Resource: "*"`, or `iam:PassRole` unscoped — least privilege, scoped ARNs.
+- `terraform/prevent-destroy-removed` — **`prevent_destroy` removed** or lifecycle guards deleted on stateful resources (DBs, buckets, tables) without stated intent.
+- `terraform/unpinned-source` — **Provider or module source unpinned** — exact version or bounded constraint (`~>`), never floating latest.
+
+## HIGH
+
+- `terraform/count-vs-for-each` — `count` on identity-bearing resources where `for_each` is correct — index shifts destroy/recreate siblings.
+- `terraform/hardcoded-env-values` — Cross-environment values hardcoded in modules (account IDs, ARNs, CIDRs) — pass as variables.
+- `terraform/missing-required-tags` — Missing required tags on new resources (owner, cost-centre, environment — per org tagging policy).
+- `terraform/wide-open-egress` — Wide-open egress added without comment.
+- `terraform/ambiguous-data-source` — Data sources fetching by name/tag that may match multiple resources — brittle; use IDs where stable.
+- `terraform/missing-backup-retention` — New stateful resource without backup/retention configuration (RDS retention, S3 versioning, DynamoDB PITR).
+- `terraform/missing-encryption` — Encryption not explicit on new data stores (at-rest KMS, in-transit enforced).
+
+## SUGGESTION
+
+- `terraform/variable-metadata` — Variables missing `description` and `type`.
+- `terraform/output-metadata` — Outputs missing `description`; sensitive outputs not marked `sensitive`.
+- `terraform/prefer-jsonencode` — Inline JSON policies over `jsonencode()`/data-source policy documents.
+- `terraform/repeated-literal` — Repeated literal in 3+ places — promote to local.