Skip to content

Stack Items

Stack items are the reusable building blocks that composed standards cite. They are not full VCQA standards by themselves unless the deployable stack shape makes them judgeable.

Runtime

  • Node: runtime and package metadata gates, CLI/service process safety, Node-specific security checks.
  • Cloudflare Pages Functions: functions directory shape, same-origin API seam, SPA/functions route collision checks, binding and env policy.
  • Cloudflare Workers: compatibility-date policy, Worker-specific deployment and secrets checks, runtime anti-patterns.

Framework

  • React: component/routing conventions only where the stack shape requires them, detection mapping for hook and component anti-patterns.
  • Flutter: Flutter package/app structure across platform targets, widget/integration test evidence for user flows, platform permission and build artifact checks.

Routing

  • React Router: SPA fallback expectations, route/module organization for static deployments.

Build Tool

  • Vite: build artifact expectations, client environment-variable boundary, static hosting fit.

Language

  • TypeScript: strictness enforcement by stack, exception policy for generated files, typed boundary checks.
  • Dart: Dart SDK constraints and analyzer gates by package, generated/localized code exception boundaries, shared model compatibility across app packages.

Quality

  • Web Accessibility: code-level detection mapping, minimum acceptance gates for UI stacks.

Security

  • Web Security: stack-specific auth and secret boundaries, detectable unsafe patterns, security gates in CI.

Testing

  • Vitest: required test layers by stack, coverage and CI gate expectations.
  • Playwright: E2E smoke coverage by deployable app shape, artifact and failure-report expectations.

Database

  • Cloudflare D1: migration discipline, local/remote parity checks, tenant database isolation, query-safety checks.

State

  • Durable Objects: stateful object boundaries, migration and storage policy, DO binding checks.

Protocol

  • MCP: tool safety rubric, remote authorization policy, tool schema quality, auditability.

Validation

  • Zod: boundary-validation expectations, safeParse/error-shape policy, schema sharing across API/client seams.

API Contract

  • OpenAPI: contract freshness checks, generated client/server drift checks, operation coverage.

CI

  • GitHub Actions: workflow permission gates, deployment environment checks, required test/build gates by stack.

Extension

  • VS Code Extension: activation scope, webview/security policy, marketplace metadata checks.

Automation

  • GitHub Action: action.yml quality, input/output contract, token/permission guidance, pinning/versioning checks.

Desktop

  • Tauri: command/capability boundaries, secret storage expectations, desktop build/signing checks.

Documentation

  • Docs KB: docs source/build separation, ADR freshness checks, published KB access policy, architecture drift gates.

Supply Chain

  • Dependency Hygiene: lockfile and package-manager consistency, install-script and dependency provenance gates, audit, license, update, and exception evidence.

Backend Platform

  • Firebase: Firebase project/environment separation, Firestore rules and index test gates, client-exposed config versus server secret boundaries, Hosting/Functions deploy evidence and rollback path.

Workspace Tool

  • Melos: workspace package discovery and bootstrap reproducibility, cross-package analyze/test orchestration, shared package dependency drift checks.

Authoring rule

Item pages should explain what upstream owns and what VCQA owns when that item appears in a stack. They should link to official references, but they should not paraphrase broad framework doctrine into a generic VCQA standard.