Standards Compositions¶

VibeCode QA standards are built from upstream authorities plus stack-specific glue needed to judge real repositories. This page is the map from reusable stack items to composed standards.

The machine-readable version lives at /standards/compositions.json.

Use the Standards Graph for the navigable visual version of this composition map.

Product-neutral reference implementations:

• vibecodeqa/ref-react-spa (published, primary standard react-spa): Small React SPA template: Vite, TypeScript, React Router, Vitest, Playwright, accessibility-oriented UI structure, static build gates, and public client configuration discipline. Score evidence: A 94/100 (self-reported); commit 54ac82b (2026-07-23); CI success (2026-07-23); verified 2026-08-08.
• vibecodeqa/ref-cloudflare-worker-mcp (published, primary standard cloudflare-worker-mcp-server): SDK-backed Streamable HTTP MCP Worker template: protected resource metadata, Worker-boundary authorization, scoped tool permissions, Zod validation, audit events, runbooks, and Wrangler dry-run deploy gates. Score evidence: A 92/100 (self-reported); commit 2242765 (2026-07-24); CI success (2026-07-24); verified 2026-08-08.
• vibecodeqa/ref-cloudflare-saas (published, primary standard tenant-deployed-cloudflare-saas): Product-neutral Cloudflare SaaS template: React SPA, Pages Functions, D1, Worker MCP, SDK, CLI, tenant manifests, runbooks, and CI gates. Score evidence: A 91/100 (self-reported); commit 41eb243 (2026-07-23); CI success (2026-07-23); verified 2026-08-08.
• vibecodeqa/ref-node-cli-internal-tool (published, primary standard node-cli-internal-tool): Small Node CLI template: TypeScript, stable exit codes, credential resolution, production safety guards, structured output, parser tests, and executable smoke checks. Score evidence: 92/100 (self-reported); commit 95f4194 (2026-07-24); CI success (2026-07-24); verified 2026-08-08.
• vibecodeqa/ref-cloudflare-pages-fullstack (published, primary standard cloudflare-pages-fullstack): React SPA plus same-origin Cloudflare Pages Functions API, route ownership, bindings, and deploy evidence. Score evidence: 92/100 (self-reported); commit 26b59c4 (2026-07-25); CI success (2026-07-25); verified 2026-08-08.
• vibecodeqa/ref-cloudflare-d1-app (published, primary standard cloudflare-d1-app): D1 migrations, local apply checks, bindings, query safety, and environment isolation without the broader SaaS composition. Score evidence: 92/100 (self-reported); commit 167e6e4 (2026-07-25); CI success (2026-07-25); verified 2026-08-08.
• vibecodeqa/ref-typescript-sdk (published, primary standard typescript-sdk): Export maps, declarations, typed errors, generated client drift checks, and consumer compatibility tests. Score evidence: A 98/100 (self-reported); commit 2f6a285 (2026-08-09); CI success (2026-08-08); verified 2026-08-09.
• vibecodeqa/ref-github-action-package (published, primary standard github-action-package): GitHub Action package metadata, minimum permissions, input validation, runtime/dependency policy, bundled-output freshness, release tags, and CI smoke evidence. Score evidence: A 100/100 (self-reported); commit fd8722d (2026-08-09); CI success (2026-08-08); verified 2026-08-09.
• vibecodeqa/ref-firebase-react-fullstack (experimental, no primary stack standard yet): Firebase Hosting + Functions v2 + Firestore workspace behind a Vite React app: shared TypeScript contracts, denied-by-default Firestore/Storage rules, emulator-backed rules tests, and CI gates. Score evidence: 91/100 (self-reported); commit 9a18be4 (2026-07-24); CI success (2026-07-24); verified 2026-08-08.
• vibecodeqa/ref-zensical-kb-site (experimental, primary standard zensical-kb-site): Markdown source of truth, stable docs URLs, references, generated-site policy, and docs smoke checks. Score evidence: B 88/100 (self-reported); commit 7b3f489 (2026-08-09); CI success (2026-08-08); verified 2026-08-09.
• vibecodeqa/ref-vscode-extension-package (experimental, primary standard vscode-extension-package): Activation scope, workspace trust, command/webview boundaries, marketplace metadata, and extension tests. Score evidence: A 99/100 (self-reported); commit ca7525f (2026-08-09); CI success (2026-08-08); verified 2026-08-09.
• vibecodeqa/ref-tauri-react-desktop (experimental, primary standard tauri-react-desktop): Tauri command/capability boundaries, secure storage, file-system safety, packaging, and frontend/backend typing. Score evidence: A 98/100 (self-reported); commit 263d600 (2026-08-09); CI success (2026-08-08); verified 2026-08-09.
• vibecodeqa/ref-flutter-firebase-app (experimental, primary standard flutter-firebase-app): Product-neutral Flutter + Firebase workspace: app/admin/shared packages, Firebase Hosting/Functions/Firestore, rules tests, platform builds, and CI evidence gates. Score evidence: A 93/100 (self-reported); commit d0d1a28 (2026-08-09); CI success (2026-08-08); verified 2026-08-09.

Decision¶

We do not author generic replacements for React, TypeScript, WCAG, OWASP, Cloudflare, or MCP doctrine. Those sources already publish the broad rules. VibeCode QA standards define deployable stack shapes, or narrow cross-cutting rubrics where VCQA owns checkable glue across many stack shapes.

Authored Standards¶

React SPA is authored as React SPA v1. The older name react-spa-static is an alias, not a separate standard.

It composes React, React Router, Vite, TypeScript, Web Accessibility, Web Security, Vitest, and Playwright.

Cloudflare Pages Fullstack is authored as Cloudflare Pages Fullstack v1. It composes React SPA, Cloudflare Pages Functions, TypeScript, Web Security, and GitHub Actions.

Cloudflare D1 App is authored as Cloudflare D1 App v1. It composes Cloudflare D1, Cloudflare Pages Functions, Cloudflare Workers, TypeScript, Web Security, and GitHub Actions. It owns migration discipline, drift checks, local apply tests, environment/tenant DB isolation, query safety, and deployment gates.

Cloudflare Worker MCP Server is authored as Cloudflare Worker MCP Server v1. It composes Cloudflare Workers, Durable Objects, MCP, Zod, TypeScript, Web Security, and GitHub Actions. It owns remote MCP authorization, tool schemas, permission boundaries, storage policy, environment isolation, audit trail, and output safety.

Tenant-Deployed Cloudflare SaaS is authored as Tenant-Deployed Cloudflare SaaS v1. It commonly composes Cloudflare Workers, GitHub Actions, Web Security, and Docs KB, plus Cloudflare Pages Functions or Cloudflare D1 when those surfaces are present. It owns tenant resource manifests, tenant/environment bindings, protected previews and aliases, promotion gates, data-state runbooks, provisioning, observability, and auditability.

Security is authored as Security v1. It is cross-cutting rather than a deployable stack standard. It composes OWASP-backed Web Security, GitHub Actions, Cloudflare runtime boundaries, MCP tool boundaries, and docs/runbook evidence. It owns authorization boundary checks, secret exposure checks, input/output safety, tenant/environment isolation, deploy permissions, security logging, and incident evidence.

Testing is authored as Testing v1. It is cross-cutting rather than a deployable stack standard. It composes Vitest, Playwright, Testing Library guidance, and GitHub Actions. It owns behavior-focused strategy, required test layers, meaningful assertions, boundary tests, smoke tests, coverage/risk policy, mock and fixture discipline, CI evidence, and fake/flaky/generated test controls.

TypeScript is authored as TypeScript v1. It is cross-cutting rather than a deployable stack standard. It composes the TypeScript item, runtime and module references, and GitHub Actions evidence. It owns strict compiler config, runtime fit, project references, no-any and suppression policy, runtime boundary validation, emit/import discipline, generated exceptions, declarations and public APIs, and CI typecheck evidence.

Planned Stack Standards¶

Cross-Cutting¶

• Dependency Hygiene: applies to package-managed slices; owns lockfile, audit, install script, license, runtime, and supply-chain risk gates.
• Accessibility: applies to UI slices; owns scan/manual acceptance gates that compose WCAG and WAI-ARIA guidance into stack-specific review.

Packages and Tools¶

• Node CLI Internal Tool: composes Node.js, TypeScript, OpenAPI, and Web Security. It owns exit-code contracts, credential resolution, safe defaults, structured output, and SDK reuse.
• TypeScript SDK: composes TypeScript, OpenAPI, Zod, and Vitest. It owns export maps, declarations, contract freshness, typed errors, and consumer compatibility tests.
• GitHub Action Package: composes GitHub Action Package, GitHub Actions, Node.js, and TypeScript. It owns metadata, minimum token permissions, input validation, runtime policy, and release tagging.
• VS Code Extension Package: composes VS Code Extension, TypeScript, Node.js, and Web Security. It owns activation scope, workspace trust, command/webview boundaries, marketplace metadata, and extension tests.
• Tauri React Desktop: composes Tauri, React, TypeScript, Web Security, and Docs KB. It owns native command/capability boundaries, secure storage, file-system safety, signing, and frontend/backend contract typing.
• Zensical KB Site: composes Docs KB and GitHub Actions. It owns Markdown source-of-truth discipline, generated-site handling, stable URLs, source references, and docs drift checks.

Stack Items¶

Use Stack Items for the reusable building blocks. Each item page explains what upstream owns, what VCQA owns when the item appears in a stack, detection signals, and the composed standards that use it.

Authoring Order¶

1. Dependency Hygiene cross-cutting standard: remove the remaining package-managed repo-wide gaps shown by the resolver.
2. Node CLI Internal Tool and TypeScript SDK: cover the operator and package surfaces in the Cloudflare SaaS example.
3. Zensical KB Site: covers docs source-of-truth and publishing discipline.