The CamelHive Standard
What every rule requires (the enunciado), whether it is measured by machine or by human judgment, and whether our benchmark corpus can measure it. Cite a rule by its stable ID — CH-SEC-003 resolves at /standard/CH-SEC-003 for as long as the rule exists.
- Version
- v3.42.0
- Active rules
- 184 of 241
Category weights
- quality
- 20 pts
- security
- 20 pts
- scalability
- 20 pts
- reliability
- 20 pts
- governance
- 20 pts
Corpus coverage measured as of 9/2/2026 (commit 2c57d95600). A rule the corpus does not measure can only be checked by reading the code that changed, never confirmed by a benchmark run — changelog · version history.
SNAP
- CH-SNAP-001Repo can be cloned and runs todayruntimenot measured by the corpus
- CH-SNAP-002MVP contains 1–3 real functional flowsllmcorpus can measure detection
- CH-SNAP-003Tech stack clearly identifiablestaticcorpus can measure false positives only
- CH-SNAP-004Backend exists (not mock APIs)llmcorpus can measure detection
- CH-SNAP-005Data persistence exists and is realllmcorpus can measure detection
- CH-SNAP-006Deployment pipeline exists or is trivial to addstaticcorpus can measure detection
- CH-SNAP-007No secrets hardcoded in repoDeprecatedstaticcorpus can measure detection
- CH-SNAP-008Known technical debt is documented by the teamllmcorpus can measure detection
- CH-SNAP-009External service dependencies are identified and documentedllmcorpus can measure detection
- CH-SNAP-010Environment clearly separated (dev / staging / prod)llmcorpus can measure detection
ARCH
- CH-ARCH-001Clear separation of concernsjudgmentcorpus can measure detection
- CH-ARCH-002No circular dependenciesstaticcorpus can measure detection
- CH-ARCH-003Predictable folder structureDeprecatedjudgmentnot measured by the corpus
- CH-ARCH-004Controller → service → repository pattern OR equivalentllmcorpus can measure false positives only
- CH-ARCH-005Business logic not mixed with controllersDeprecatedllmnot measured by the corpus
- CH-ARCH-006Boundaries respected between modulesjudgmentcorpus can measure detection
- CH-ARCH-007Predictable and consistent folder structurejudgmentcorpus can measure detection
- CH-ARCH-008Business logic not mixed with controllers or route handlersllmcorpus can measure false positives only
- CH-ARCH-009No God objects or God services handling unrelated responsibilitiesllmcorpus can measure false positives only
- CH-ARCH-010Shared utilities isolated in a common/utils layerllmcorpus can measure false positives only
- CH-ARCH-011Architecture complexity is appropriate for the product stage — no over-engineeringjudgmentcorpus can measure detection
DATA
- CH-DATA-001Data normalized (typically 3NF) to prevent dangerous redundancyllmcorpus can measure detection
- CH-DATA-002Strict Foreign Key constraints enforced at the database levelstaticcorpus can measure detection
- CH-DATA-003Schema migrations governed by code (Prisma, TypeORM, Alembic, etc.)staticcorpus can measure detection
- CH-DATA-004ACID transactions used for multi-table mutations to prevent race conditionsllmcorpus can measure detection
- CH-DATA-005Soft deletes used for critical records instead of hard deletesllmcorpus can measure false positives only
- CH-DATA-006Timestamps (created_at, updated_at) present on all critical entitiesllmcorpus can measure false positives only
- CH-DATA-007No JSON blobs used as substitute for proper relational modelingllmcorpus can measure false positives only
- CH-DATA-008Data model reflects the real business domain — not a misunderstood version of itjudgmentnot measured by the corpus
- CH-DATA-009Las operaciones check-then-act sobre un único registro (códigos de un solo uso, cupones, tokens) son atómicasllmnot measured by the corpus
CODE
- CH-CODE-001Consistent naming conventionsDeprecatedllmnot measured by the corpus
- CH-CODE-002No duplicate logic across modulesDeprecatedstaticnot measured by the corpus
- CH-CODE-003File size manageable (<300 lines ideally)staticcorpus can measure detection
- CH-CODE-004Dead/commented code removedDeprecatedstaticnot measured by the corpus
- CH-CODE-005Linting + formatting enforcedDeprecatedstaticnot measured by the corpus
- CH-CODE-006Consistent naming conventions (camelCase, snake_case — pick one)llmcorpus can measure false positives only
- CH-CODE-007No duplicate logic across modules (DRY principle respected)llmcorpus can measure false positives only
- CH-CODE-008Dead or commented-out code removedllmcorpus can measure false positives only
- CH-CODE-009Linting + formatting enforced via config (ESLint, Prettier, etc.)llmcorpus can measure false positives only
- CH-CODE-010No console.log or debug statements left in production codellmcorpus can measure false positives only
- CH-CODE-011Magic numbers and strings replaced with named constantsllmcorpus can measure false positives only
TEST
- CH-TEST-001Critical path test coverage existsllmcorpus can measure false positives only
- CH-TEST-002CI executes tests on every pushstaticcorpus can measure detection
- CH-TEST-003No failing testsDeprecatedruntimenot measured by the corpus
- CH-TEST-004No failing tests in main branchruntimenot measured by the corpus
- CH-TEST-005Integration tests cover at least the happy path of each functional flowjudgmentcorpus can measure false positives only
- CH-TEST-006Edge cases and failure scenarios have test coveragejudgmentcorpus can measure false positives only
- CH-TEST-007Tests cover what actually matters for the business — not just coverage metricsjudgmentcorpus can measure detection
- CH-TEST-008Every HTTP route of the backend is exercised by at least one teststaticnot measured by the corpus
LEGL
- CH-LEGL-001Sensitive data handled correctly (PII encryption, safe storage)Deprecatedllmnot measured by the corpus
- CH-LEGL-002GDPR/CCPA relevant exposure identifiedDeprecatedllmnot measured by the corpus
- CH-LEGL-003Safe storage of personal data (no plaintext passwords)Deprecatedstaticnot measured by the corpus
- CH-LEGL-004Dependency licenses verifiedDeprecatedstaticnot measured by the corpus
- CH-LEGL-005API Terms of Service not violatedDeprecatedjudgmentnot measured by the corpus
SEC
- CH-SEC-001All input validated/sanitizedllmcorpus can measure detection
- CH-SEC-002IDs/email/username validated on backendllmcorpus can measure detection
- CH-SEC-003Strict typing/schema validation at the boundary (Zod, Joi, class-validator)staticcorpus can measure detection
- CH-SEC-004Passwords hashed using bcrypt/scrypt/argon2staticcorpus can measure detection
- CH-SEC-005JWT tokens validated properlystaticcorpus can measure detection
- CH-SEC-006Access tokens not stored in localStorage (unless secure)staticcorpus can measure detection
- CH-SEC-007Role-based access control implementedllmcorpus can measure detection
- CH-SEC-008No secrets committed to repostaticcorpus can measure detection
- CH-SEC-009Environment variables correctly configuredstaticcorpus can measure detection
- CH-SEC-010Secret rotation procedure existsjudgmentnot measured by the corpus
- CH-SEC-011Rate limiting applied to sensitive endpointsllmcorpus can measure detection
- CH-SEC-012CORS strict (no wildcard)staticcorpus can measure detection
- CH-SEC-013Errors do not leak stack tracesstaticcorpus can measure detection
- CH-SEC-014No packages with critical vulnerabilitiesstaticcorpus can measure detection
- CH-SEC-015Prevencion de SQL injection verificada (queries parametrizadas o acceso solo por ORM)llmcorpus can measure detection
- CH-SEC-016Validacion de archivos subidos por el usuario, si aplica (tipo, tamano, MIME)llmcorpus can measure detection
- CH-SEC-017Endpoints de autenticacion protegidos contra fuerza bruta (rate limiting + lockout)llmcorpus can measure detection
- CH-SEC-018Flujo de refresh de tokens implementado correctamente, sin access tokens de larga vidallmcorpus can measure detection
- CH-SEC-019El flujo de reset de password usa tokens de un solo uso y con expiracionllmcorpus can measure detection
- CH-SEC-020Secretos gestionados via vault o secret manager (no solo variables de entorno planas)llmcorpus can measure detection
- CH-SEC-021Headers de seguridad configurados (Helmet o equivalente): CSP, HSTS, X-Frame-Optionsllmcorpus can measure detection
- CH-SEC-022HTTPS forzado en produccion, sin fallback a HTTPruntimecorpus can measure detection
- CH-SEC-023Dependencias actualizadas dentro de un rango razonablejudgmentnot measured by the corpus
- CH-SEC-024Auditoria de dependencias automatizada en el pipeline de CIllmcorpus can measure detection
- CH-SEC-025El sistema no se entrega con credenciales por defecto que funcionen en produccionllmnot measured by the corpus
- CH-SEC-026La validación en el borde no se puede evadir por una normalización inconsistente del mismo input en dos caminos distintosllmnot measured by the corpus
- CH-SEC-027El hashing de contraseñas usa un salt generado por el propio algoritmo y un costo/rounds suficientestaticnot measured by the corpus
- CH-SEC-028Valores sensibles (tokens de reset, códigos de verificación) emitidos por un endpoint público, nunca en el cuerpo de la respuestallmnot measured by the corpus
- CH-SEC-029El callback de OAuth/OIDC valida state/nonce/PKCE atados a la sesión, y rechaza cuando falta cualquiera de los dos ladosllmnot measured by the corpus
- CH-SEC-030La validación de Origin/Referer usa comparación exacta o una lista cerrada, no match de prefijollmnot measured by the corpus
- CH-SEC-031La validación de JWT verifica issuer (iss) y audience (aud) entre distintos emisores, y verifica el tipo/propósito del token (typ/purpose) cuando el MISMO emisor firma tokens de distinto usollmnot measured by the corpus
- CH-SEC-032El flujo de login no revela si un usuario existe por timing o diferencia de respuestallmnot measured by the corpus
- CH-SEC-033Una URL provista por el usuario, consultada desde el servidor, bloquea rangos privados/internos y valida cada redirectllmnot measured by the corpus
- CH-SEC-034Credentials and personal data never travel in the URL: every form that sends a password, a token or personal data uses an explicit POST (or a server action), and no code reads credentials from the query string or logs themstaticnot measured by the corpus
- CH-SEC-036The session cookie is HttpOnly, Secure and SameSite (Lax or Strict)staticnot measured by the corpus
- CH-SEC-044The session cookie uses the __Host- prefix in productionstaticnot measured by the corpus
- CH-SEC-035Every access to a resource is checked against its owner (user or tenant), not just against being signed inllmnot measured by the corpus
- CH-SEC-037An unverified account cannot sign in, and an external identity is linked only to a verified accountllmnot measured by the corpus
- CH-SEC-040Sessions are revoked on the server when signing out, when credentials change, and on requestllmnot measured by the corpus
- CH-SEC-041CI workflows don't interpolate variable data into shell commandsstaticnot measured by the corpus
- CH-SEC-042Emails the system sends to addresses chosen by a user are rate-limited and carry no free text from that userllmnot measured by the corpus
- CH-SEC-043Scheduled jobs (cron) triggered over HTTP verify a secret before actingllmnot measured by the corpus
- CH-SEC-052User input never reaches an operating-system commandllmnot measured by the corpus
- CH-SEC-053User input never decides which file the server reads or writesllmnot measured by the corpus
- CH-SEC-054Untrusted data is never deserialized into live objectsllmnot measured by the corpus
- CH-SEC-055Merging user input into objects can't change their prototypellmnot measured by the corpus
- CH-SEC-056Redirects never send users to an address taken from the request without checking itllmnot measured by the corpus
- CH-SEC-057User input is never compiled as a server-side templatellmnot measured by the corpus
- CH-SEC-058XML from outside is parsed with external entities disabledllmnot measured by the corpus
- CH-SEC-059API responses return only the fields the client needs, never whole database recordsllmnot measured by the corpus
- CH-SEC-060Passwords, tokens and personal data are never written to logsllmnot measured by the corpus
- CH-SEC-061Personal data isn't sent to analytics, tracking or error-reporting services without needllmnot measured by the corpus
- CH-SEC-038Payment webhooks verify the provider's signature and reject replayed eventsllmnot measured by the corpus
- CH-SEC-045The amount and product of a payment are decided on the server, never taken from the clientllmnot measured by the corpus
- CH-SEC-046Payment operations are idempotentllmnot measured by the corpus
- CH-SEC-047The application never receives or stores card numbers itselfllmnot measured by the corpus
- CH-SEC-039Text from users or third parties is treated as data, not instructions, in prompts sent to an AI modelllmnot measured by the corpus
- CH-SEC-048Tools an AI agent can call have the least privilege they needllmnot measured by the corpus
- CH-SEC-049Secrets and personal data are not sent to an AI provider without needDeprecatedllmnot measured by the corpus
- CH-SEC-050Calls to AI models have a spending or usage limitllmnot measured by the corpus
- CH-SEC-051The output of an AI model is never executed or rendered as trusted codellmnot measured by the corpus
- CH-SEC-062CI workflows don't interpolate variable data into action inputs that run as codestaticnot measured by the corpus
- CH-SEC-063Secrets never go into AI prompts, and personal data only goes to AI providers the privacy policy namesllmnot measured by the corpus
SCAL
- CH-SCAL-001No blocking operations on main threadDeprecatedstaticnot measured by the corpus
- CH-SCAL-002Async tasks offloaded to queues/workersDeprecatedllmnot measured by the corpus
- CH-SCAL-003Caching strategy implementedDeprecatedllmnot measured by the corpus
- CH-SCAL-004Indexes validated on frequently queried columnsDeprecatedllmnot measured by the corpus
- CH-SCAL-005No N+1 queries in ORM fetch logicllmcorpus can measure false positives only
- CH-SCAL-006Database connection pooling implemented (e.g., PgBouncer, RDS Proxy)Deprecatedstaticnot measured by the corpus
- CH-SCAL-007Soft deletes used instead of hard deletes for critical recordsDeprecatedstaticnot measured by the corpus
- CH-SCAL-008Autoscaling enabled (if applicable)Deprecatedruntimenot measured by the corpus
- CH-SCAL-009RDS size appropriateDeprecatedruntimenot measured by the corpus
- CH-SCAL-010No unlimited log retentionDeprecatedruntimenot measured by the corpus
- CH-SCAL-011Assets served via CDNDeprecatedruntimenot measured by the corpus
- CH-SCAL-012Bundles reasonably sizedDeprecatedruntimenot measured by the corpus
- CH-SCAL-013No blocking synchronous operations on the main threadllmcorpus can measure detection
- CH-SCAL-014Heavy or long-running tasks offloaded to queues or background workersllmcorpus can measure detection
- CH-SCAL-015Caching strategy implemented for expensive or repeated operationsllmcorpus can measure detection
- CH-SCAL-016External API calls have timeout and retry logicllmcorpus can measure false positives only
- CH-SCAL-017Indexes validated on all frequently queried columnsllmcorpus can measure false positives only
- CH-SCAL-018No N+1 queries in ORM fetch logicDeprecatedllmnot measured by the corpus
- CH-SCAL-019Database connection pooling implemented (PgBouncer, RDS Proxy, or ORM-level)llmcorpus can measure detection
- CH-SCAL-020Query performance validated for the largest expected data setsjudgmentnot measured by the corpus
- CH-SCAL-021Read replicas or caching considered for read-heavy workloadsjudgmentnot measured by the corpus
RELI
- CH-RELI-001Automated DB backups configuredDeprecatedruntimenot measured by the corpus
- CH-RELI-002Backup restoration testedDeprecatedjudgmentnot measured by the corpus
- CH-RELI-003Versioning enabled for critical S3 bucketsruntimenot measured by the corpus
- CH-RELI-004Logs structured in JSONDeprecatedstaticnot measured by the corpus
- CH-RELI-005Metrics for CPU/memory/latency existDeprecatedruntimenot measured by the corpus
- CH-RELI-006Alerts configured for critical pathsDeprecatedruntimenot measured by the corpus
- CH-RELI-007Blue/Green or Rolling deploys implementedDeprecatedruntimenot measured by the corpus
- CH-RELI-008Zero-downtime migrationsDeprecatedllmnot measured by the corpus
- CH-RELI-009Health checks implementedDeprecatedstaticnot measured by the corpus
- CH-RELI-010Automated DB backups configured and verifiedruntimenot measured by the corpus
- CH-RELI-011Versioning enabled for critical S3 bucketsDeprecatedruntimenot measured by the corpus
- CH-RELI-012Backup restoration has been actually tested — not just configuredjudgmentnot measured by the corpus
- CH-RELI-013Recovery time objective (RTO) and recovery point objective (RPO) are defined and acceptablejudgmentnot measured by the corpus
- CH-RELI-014Logs structured in JSON with consistent fields (timestamp, level, traceId)llmcorpus can measure detection
- CH-RELI-015Metrics for CPU, memory, latency, and error rate availableruntimenot measured by the corpus
- CH-RELI-016Alerts configured for critical failure paths (downtime, high error rate, latency spike)runtimenot measured by the corpus
- CH-RELI-017Uptime monitoring in place (external ping, not just internal health checks)runtimenot measured by the corpus
- CH-RELI-018Blue/Green or Rolling deploys implemented — no big-bang deploymentsruntimenot measured by the corpus
- CH-RELI-019Zero-downtime database migrations validatedllmcorpus can measure detection
- CH-RELI-020Health check endpoints implemented and wired to load balancerllmcorpus can measure detection
- CH-RELI-021Rollback procedure documented and testedjudgmentnot measured by the corpus
- CH-RELI-022Database migrations are applied in order and verified against the database before new code is publishedllmnot measured by the corpus
COST
- CH-COST-001AWS resources right-sizedDeprecatedruntimenot measured by the corpus
- CH-COST-002Log retention cappedDeprecatedruntimenot measured by the corpus
- CH-COST-003No idle expensive servicesDeprecatedruntimenot measured by the corpus
- CH-COST-004Caching reduces DB loadruntimenot measured by the corpus
- CH-COST-005Log retention capped at a reasonable window (30-90 days typically)runtimenot measured by the corpus
- CH-COST-006Cost alerts configured in cloud provider (billing alarm at threshold)runtimenot measured by the corpus
- CH-COST-007Cloud resources are right-sized for actual current loadjudgmentnot measured by the corpus
- CH-COST-008No idle or forgotten expensive services runningjudgmentnot measured by the corpus
- CH-COST-009Monthly infrastructure cost is known, tracked, and acceptable for the current stagejudgmentnot measured by the corpus
GOVN
- CH-GOVN-001All AI-generated code reviewed by humanDeprecatedjudgmentnot measured by the corpus
- CH-GOVN-002AI does not modify architecture boundariesDeprecatedjudgmentnot measured by the corpus
- CH-GOVN-003Folder structure stays stableDeprecatedjudgmentnot measured by the corpus
- CH-GOVN-004API contract not altered without human approvalDeprecatedjudgmentnot measured by the corpus
- CH-GOVN-005Human-written rationale for major decisionsDeprecatedstaticnot measured by the corpus
- CH-GOVN-006All AI-generated code passes the same linting, testing, and review standards as human codeDeprecatedjudgmentnot measured by the corpus
- CH-GOVN-007AI does not autonomously modify architecture boundaries or module contractsDeprecatedjudgmentnot measured by the corpus
- CH-GOVN-008Naming conventions are consistent even across AI-generated sectionsDeprecatedllmnot measured by the corpus
- CH-GOVN-009No structural inconsistencies between AI-generated and human-written modulesDeprecatedllmnot measured by the corpus
- CH-GOVN-010Folder structure and module boundaries remain stable across AI-assisted iterationsjudgmentnot measured by the corpus
- CH-GOVN-011API contracts are versioned and not silently alteredjudgmentnot measured by the corpus
- CH-GOVN-012C4 architecture diagrams present (Context, Container, Component levels minimum)llmcorpus can measure detection
- CH-GOVN-013README with full local setup instructions — works without tribal knowledgellmcorpus can measure detection
- CH-GOVN-014Dev environment reproducible via Docker or equivalentruntimenot measured by the corpus
- CH-GOVN-015CI/CD pipeline documented and understandablellmcorpus can measure detection
- CH-GOVN-016Major architectural decisions have human-written rationale (ADRs or equivalent)judgmentnot measured by the corpus
- CH-GOVN-017The team can maintain what was built — no single point of knowledge or bus factor riskjudgmentnot measured by the corpus
- CH-GOVN-018Changes to sensitive parts of the code (authentication, payments, personal data) require an independent review -- human or automated -- before they are publishedllmnot measured by the corpus
- CH-GOVN-019Architecture documents match the code: the modules, layers and boundaries they describe are the ones the code implementsllmnot measured by the corpus
- CH-GOVN-020Every change can be traced to a task requested by a person (an issue, ticket or reviewed pull request)llmnot measured by the corpus
MANT
- CH-MANT-001C4 diagrams includedDeprecatedstaticnot measured by the corpus
- CH-MANT-002README with full setup instructionsDeprecatedllmnot measured by the corpus
- CH-MANT-003Dev environment reproducible via DockerDeprecatedruntimenot measured by the corpus
- CH-MANT-004CI/CD pipeline documentedDeprecatedstaticnot measured by the corpus
- CH-MANT-005Coding style guide availablestaticcorpus can measure detection
- CH-MANT-006Onboarding in <1 hour possibleDeprecatedjudgmentnot measured by the corpus
API
- CH-API-001RESTful conventions followed consistently (or GraphQL schema well-structured)judgmentcorpus can measure false positives only
- CH-API-002API versioning strategy defined (/v1/, headers, or explicit)staticcorpus can measure false positives only
- CH-API-003HTTP status codes used correctly (401 vs 403, 400 vs 422, etc.)llmcorpus can measure false positives only
- CH-API-004API contracts documented (OpenAPI / Swagger or equivalent)llmcorpus can measure false positives only
- CH-API-005No breaking changes introduced without version bumpjudgmentcorpus can measure detection
- CH-API-006Pagination implemented on list endpointsllmcorpus can measure detection
- CH-API-007Consistent error response shape across all endpointsllmcorpus can measure false positives only
PDAT
- CH-PDAT-001Sensitive data handled correctly (PII encryption, safe storage)Deprecatedllmcorpus can measure detection
- CH-PDAT-002Safe storage of personal data (no plaintext passwords or unencrypted highly sensitive PII)staticcorpus can measure detection
- CH-PDAT-003Cookie policy present and accurate if cookies are usedllmcorpus can measure detection
- CH-PDAT-004Privacy Policy published and accessiblellmcorpus can measure detection
- CH-PDAT-005Terms and Conditions published and accessiblellmcorpus can measure detection
- CH-PDAT-006Dependency licenses verified (no GPL-contaminated deps in commercial product)llmcorpus can measure detection
- CH-PDAT-007Explicit user consent collected before processing non-essential datallmcorpus can measure detection
- CH-PDAT-008GDPR/CCPA exposure is appropriate for the actual markets and user types this product targetsjudgmentnot measured by the corpus
- CH-PDAT-009Data retention, deletion rights, and processing purposes are appropriate for the business modeljudgmentnot measured by the corpus
- CH-PDAT-010Third-party data processors and API ToS exposure match actual usagejudgmentnot measured by the corpus
- CH-PDAT-011Highly sensitive personal fields are never stored in plain textllmnot measured by the corpus
INFR
- CH-INFR-001No unlimited log retention (retention policy set)runtimenot measured by the corpus
- CH-INFR-002Static assets served via CDNruntimenot measured by the corpus
- CH-INFR-003Infrastructure complexity and cost is appropriate for the current tractionjudgmentnot measured by the corpus
FSEC
- CH-FSEC-001No sensitive data (tokens, keys, PII) exposed in client-side code or localStorage without encryptionDeprecatedllmcorpus can measure detection
- CH-FSEC-002Environment variables validated at build time — no secrets exposed in the browser bundleDeprecatedllmcorpus can measure detection
- CH-FSEC-003No internal API structure, route logic, or business rules leaked through the frontendllmcorpus can measure detection
- CH-FSEC-004XSS prevention: user input never rendered as raw HTML (dangerouslySetInnerHTML or equivalent guarded)llmcorpus can measure detection
- CH-FSEC-005CSRF protection in place for mutation endpointsllmcorpus can measure detection
- CH-FSEC-006No server-side secret reaches the browser (public env prefixes, server-only modules imported from client code)llmnot measured by the corpus
- CH-FSEC-007Personal data is not exposed in client-side code or browser storage without need and protectionllmnot measured by the corpus
FSTA
- CH-FSTA-001Global state management is explicit and predictable (Redux, Zustand, Context — consistent usage)llmcorpus can measure detection
- CH-FSTA-002No prop drilling beyond 2–3 levels without a state solutionllmcorpus can measure detection
- CH-FSTA-003Stale data handled correctly — cache invalidation strategy definedllmcorpus can measure detection
- CH-FSTA-004Loading, error, and empty states handled in every data-fetching componentllmcorpus can measure false positives only
- CH-FSTA-005No silent failures — errors always surface to the user in a meaningful wayllmcorpus can measure false positives only
FARC
- CH-FARC-001Components have a single, clear responsibilityDeprecatedllmcorpus can measure detection
- CH-FARC-002Business logic extracted from UI components into hooks or servicesllmcorpus can measure detection
- CH-FARC-003API calls abstracted behind a service or query layer — no fetch/axios directly in componentsllmcorpus can measure detection
- CH-FARC-004Routing is centralized and access-controlled (protected routes implemented)llmcorpus can measure detection
- CH-FARC-005Folder structure reflects feature boundaries, not file typesDeprecatedllmcorpus can measure detection
FPRF
- CH-FPRF-001No unintentional full-library imports (only the part of a library that is used gets imported)llmcorpus can measure detection
- CH-FPRF-002Code splitting implemented for large route-based chunksllmcorpus can measure detection
- CH-FPRF-003Images optimized and served in modern formats (WebP, AVIF)llmcorpus can measure detection
- CH-FPRF-004No render-blocking scripts in critical pathllmcorpus can measure detection
- CH-FPRF-005Bundle size is analyzed (a bundle analyzer or a size budget is configured)llmnot measured by the corpus
FRES
- CH-FRES-001Global error boundary implemented to prevent full app crashesllmcorpus can measure detection
- CH-FRES-002Network failures handled gracefully (retry logic or user feedback)llmcorpus can measure detection
- CH-FRES-003App functional under slow network conditions (skeleton states, optimistic UI where appropriate)llmcorpus can measure detection