Skip to content

Standards References

This is the authority map for VibeCode QA standards. These are the official specs, framework docs, platform docs, security standards, and testing guides we cite before writing stack-specific rubrics.

The machine-readable version lives at /standards/references.json. Schema: /standards/references.schema.json.

Registry status

  • Last reviewed: 2026-08-11
  • Link health: checked-in-ci
  • Link rule: Every primary-source URL must return 2xx. Redirects fail unless expectedRedirectUrl is recorded on the reference.
  • Versioning rule: Where a publisher versions its documentation by date or release, cite the pinned upstream URL and state the edition in versionPolicy. An undated URL that redirects to whatever snapshot is current breaks CI on the publisher's next release, so expectedRedirectUrl is reserved for stable one-off redirects with no pinnable equivalent. A pinned citation ages deliberately and is refreshed on review, which is the intended behaviour for a standards registry.
  • Transient failure rule: A definitive answer we do not want - 4xx, 5xx, an unexpected redirect, a dead hostname, a refused connection, an invalid certificate - is a registry defect and fails the build. A connection that times out or is reset is not an answer at all: it is retried up to three times, and if it still will not answer it is reported as a warning and the build proceeds, because third-party availability is not a property of our commit. Past three unreachable references the run fails instead - that is an outage rather than a flake, and link health has not actually been verified. Run validate-references.mjs --links-strict to make every unreachable reference fatal.
  • Applicability rule: appliesTo contains only canonical VCQA standard or stack item IDs from registry.json/compositions.json. Descriptive discovery terms live in topics.

Authoring rule

VCQA standards should compose and cite these sources. Do not re-create broad framework doctrine when an upstream standard already exists; author only the stack shape, deployment constraints, detection mapping, exceptions, and anti-patterns needed to judge a repo.

Source preference

  • Official specification
  • Official project or vendor documentation
  • Recognized independent standard body
  • Mature ecosystem documentation
  • Vendor-neutral implementation guide

Web platform

Baseline browser, markup, accessibility, and web API references.

Reference Publisher Version policy Link check Redirect target Controlled appliesTo Topics Use it for
HTML Living Standard WHATWG Tracks current canonical upstream URL. CI-enforced 2xx none expected - html, browser-app, static-site, spa, ssr HTML semantics; forms; navigation; browser integration
Web Content Accessibility Guidelines (WCAG) 2.2 W3C WAI Tracks current canonical upstream URL. CI-enforced 2xx none expected docs-kb ui, website, web-app, documentation-site Accessibility conformance; perceivable/operable/understandable/robust criteria
WAI-ARIA Authoring Practices Guide W3C WAI Tracks current canonical upstream URL. CI-enforced 2xx none expected - ui, component-library, web-app ARIA widget patterns; keyboard interaction; focus behavior
MDN Web Docs Mozilla Tracks current canonical upstream URL. CI-enforced 2xx none expected - browser-app, javascript, css, html Browser API behavior; compatibility; web platform explanations

Languages and runtimes

Language, runtime, package manager, and CLI baseline references.

Reference Publisher Version policy Link check Redirect target Controlled appliesTo Topics Use it for
TSConfig Reference TypeScript Tracks current canonical upstream URL. CI-enforced 2xx none expected typescript tsconfig, strict-types Strictness flags; module resolution; project references
TypeScript Handbook TypeScript Tracks current canonical upstream URL. CI-enforced 2xx none expected typescript, typescript-sdk library, sdk, app Type modeling; narrowing; generics; declaration files
Node.js Documentation OpenJS Foundation Tracks current canonical upstream URL. CI-enforced 2xx none expected node-cli-internal-tool, typescript-sdk node-service, node-cli, node-library Runtime APIs; process behavior; streams; crypto; file system
Node.js Security Best Practices OpenJS Foundation Tracks current canonical upstream URL. CI-enforced 2xx none expected node-cli-internal-tool node-service, node-cli, server-side-javascript Node runtime security posture; dependency and input handling guidance
package.json npm Pinned to v11 upstream docs. CI-enforced 2xx none expected - npm-package, library, cli, workspace Package metadata; bin; exports; files; scripts; engines
pnpm Workspaces pnpm Tracks current canonical upstream URL. CI-enforced 2xx none expected - monorepo, workspace, typescript-project-references Workspace layout; workspace protocol; recursive scripts
Effective Dart Dart Tracks current canonical upstream URL. CI-enforced 2xx none expected dart flutter Dart style; documentation; usage and design guidance
Melos Documentation Invertase Tracks current canonical upstream URL. CI-enforced 2xx none expected melos dart-workspace, flutter-workspace, monorepo Dart and Flutter monorepo package orchestration; bootstrap scripts; workspace analyze/test commands

Frontend frameworks and build tools

Framework authorities to reference from stack-specific UI standards.

Reference Publisher Version policy Link check Redirect target Controlled appliesTo Topics Use it for
React Documentation Meta / React Tracks current canonical upstream URL. CI-enforced 2xx none expected react, react-spa, react-ssr - Components; hooks; state; effects; React compiler guidance
Rules of Hooks React Tracks current canonical upstream URL. CI-enforced 2xx none expected react react-components, hooks Hook call placement; custom hook constraints; lint mapping
React Router Documentation React Router Tracks current canonical upstream URL. CI-enforced 2xx none expected react-spa, react-router react-fullstack Routing modes; data routers; framework mode; SPA fallback implications
Vite Guide Vite Tracks current canonical upstream URL. CI-enforced 2xx none expected vite spa, frontend-build Dev server; production build; static deployment; env variables
Deploying a Static Site Vite Tracks current canonical upstream URL. CI-enforced 2xx none expected vite static-site, spa Static hosting expectations; SPA deployment guidance
Env Variables and Modes Vite Tracks current canonical upstream URL. CI-enforced 2xx none expected vite spa, client-env Client-exposed environment variables; mode-specific config; public env prefixes
Next.js Documentation Vercel Tracks current canonical upstream URL. CI-enforced 2xx none expected react-ssr nextjs, react-fullstack App Router; server components; route handlers; deployment
Data Security Next.js Tracks current canonical upstream URL. CI-enforced 2xx none expected - nextjs, react-server-components, server-data Server component data boundaries; DTOs; sensitive data handling
Vue.js Guide Vue Tracks current canonical upstream URL. CI-enforced 2xx none expected - vue, vue-spa, vue-ssr Composition API; SFCs; reactivity; app structure
Vue Style Guide Vue Tracks current canonical upstream URL. CI-enforced 2xx none expected - vue, vue-components Vue-specific conventions; component naming; anti-patterns
Svelte Documentation Svelte Tracks current canonical upstream URL. CI-enforced 2xx none expected - svelte, sveltekit Svelte syntax; runes; compiler warnings; component model
SvelteKit Documentation Svelte Tracks current canonical upstream URL. CI-enforced 2xx none expected - sveltekit, svelte-fullstack, svelte-ssr Routing; load functions; server endpoints; deployment adapters
Angular Documentation Google / Angular Tracks current canonical upstream URL. CI-enforced 2xx none expected - angular, angular-spa Signals; templates; dependency injection; Angular CLI
Astro Documentation Astro Tracks current canonical upstream URL. CI-enforced 2xx none expected - astro, static-site, content-site Content collections; islands architecture; static/SSR output

Cloudflare edge stack

Cloudflare platform references for Pages, Workers, D1, Durable Objects, and SaaS isolation.

Reference Publisher Version policy Link check Redirect target Controlled appliesTo Topics Use it for
Pages Functions Cloudflare Tracks current canonical upstream URL. CI-enforced 2xx none expected cloudflare-pages-fullstack, cloudflare-pages-functions, react-spa-on-cloudflare-pages pages-functions Functions directory; middleware; routing; bindings; runtime configuration
Pages Functions Routing Cloudflare Tracks current canonical upstream URL. CI-enforced 2xx none expected cloudflare-pages-functions, cloudflare-pages-fullstack pages-functions File-based routes; dynamic segments; route matching
Pages Functions Middleware Cloudflare Tracks current canonical upstream URL. CI-enforced 2xx none expected cloudflare-pages-functions pages-functions, auth-middleware, api-edge Middleware chains; error handling; authentication middleware
Pages Preview Deployments Cloudflare Tracks current canonical upstream URL. CI-enforced 2xx none expected tenant-deployed-cloudflare-saas cloudflare-pages, preview-deployments Preview URLs; preview aliases; Access protection; preview indexing posture
Pages Branch Build Controls Cloudflare Tracks current canonical upstream URL. CI-enforced 2xx none expected tenant-deployed-cloudflare-saas cloudflare-pages, release-branches Production branch control; preview branch control; release policy
Direct Upload with Continuous Integration Cloudflare Tracks current canonical upstream URL. CI-enforced 2xx none expected tenant-deployed-cloudflare-saas cloudflare-pages, ci-deploy CI-managed Pages deploys; artifact promotion; deployment traceability
Workers Documentation Cloudflare Tracks current canonical upstream URL. CI-enforced 2xx none expected cloudflare-workers, cloudflare-worker-mcp-server cloudflare-worker, edge-api, mcp-worker Worker runtime; bindings; compatibility dates; deployment
Workers Best Practices Cloudflare Tracks current canonical upstream URL. CI-enforced 2xx none expected cloudflare-workers cloudflare-worker, edge-api Worker production patterns; anti-patterns; performance and reliability
Workers Environments Cloudflare Tracks current canonical upstream URL. CI-enforced 2xx none expected cloudflare-workers, tenant-deployed-cloudflare-saas cloudflare-worker, wrangler Environment-specific configuration; binding selection; deployment isolation
Workers Bindings Cloudflare Tracks current canonical upstream URL. CI-enforced 2xx none expected cloudflare-workers, tenant-deployed-cloudflare-saas cloudflare-worker, bindings Resource bindings; runtime configuration; service boundaries
Workers Secrets Cloudflare Tracks current canonical upstream URL. CI-enforced 2xx none expected cloudflare-workers, tenant-deployed-cloudflare-saas cloudflare-worker, secrets Secret configuration; secret scope; secret handling
Workers Preview URLs Cloudflare Tracks current canonical upstream URL. CI-enforced 2xx none expected cloudflare-workers, tenant-deployed-cloudflare-saas cloudflare-worker, preview-deployments Worker preview exposure; preview URL policy
Workers Versions and Deployments Cloudflare Tracks current canonical upstream URL. CI-enforced 2xx none expected cloudflare-workers, tenant-deployed-cloudflare-saas cloudflare-worker, deployment-versioning Worker versions; deployments; rollback and promotion evidence
D1 Documentation Cloudflare Tracks current canonical upstream URL. CI-enforced 2xx none expected cloudflare-d1, cloudflare-pages-fullstack, cloudflare-workers d1-database, cloudflare-worker D1 database model; bindings; local/remote database behavior
D1 Migrations Cloudflare Tracks current canonical upstream URL. CI-enforced 2xx none expected cloudflare-d1 d1-database, database-migrations SQL migration files; migrations folder; versioned database changes
D1 Prepared Statement Methods Cloudflare Tracks current canonical upstream URL. CI-enforced 2xx none expected cloudflare-d1 d1-database, query-safety, edge-sql Prepared statements; parameter binding; query result APIs
D1 Environments Cloudflare Tracks current canonical upstream URL. CI-enforced 2xx none expected cloudflare-d1 d1-database, cloudflare-environments, preview-database Preview database IDs; environment-specific D1 bindings
D1 Time Travel and Backups Cloudflare Tracks current canonical upstream URL. CI-enforced 2xx none expected cloudflare-d1, tenant-deployed-cloudflare-saas d1-database, backup Point-in-time restore; backup bookmarks; restore runbooks
D1 Import and Export Data Cloudflare Tracks current canonical upstream URL. CI-enforced 2xx none expected cloudflare-d1, tenant-deployed-cloudflare-saas d1-database, backup Tenant data export; restore/fix-forward runbooks; data preservation
Durable Objects Documentation Cloudflare Tracks current canonical upstream URL. CI-enforced 2xx none expected durable-objects, cloudflare-worker-mcp-server stateful-worker, mcp-worker Durable Object model; bindings; storage; stateful coordination
Durable Objects Best Practices Cloudflare Tracks current canonical upstream URL. CI-enforced 2xx none expected durable-objects stateful-worker Object design; storage; RPC; error handling; anti-patterns
SaaS Data Isolation Cloudflare Tracks current canonical upstream URL. CI-enforced 2xx none expected tenant-deployed-cloudflare-saas multi-tenant-saas, cloudflare-saas, tenant-isolation Tenant data isolation; Cloudflare SaaS architecture references
Service tokens Cloudflare Tracks current canonical upstream URL. CI-enforced 2xx none expected - cloudflare-access, machine-auth, edge-perimeter Service token behavior; Access policy integration
Model Context Protocol (MCP) Cloudflare Tracks current canonical upstream URL. CI-enforced 2xx none expected cloudflare-worker-mcp-server mcp-worker, agents MCP on Cloudflare Workers and Agents; remote MCP server implementation
Workers CI/CD with GitHub Actions Cloudflare Tracks current canonical upstream URL. CI-enforced 2xx none expected cloudflare-workers, github-actions, tenant-deployed-cloudflare-saas cloudflare-worker Wrangler deployment from GitHub Actions; CI/CD setup; Cloudflare deploy automation

APIs, auth, validation, and AI protocols

Contract, authentication, authorization, schema, and AI-tool protocol references.

Reference Publisher Version policy Link check Redirect target Controlled appliesTo Topics Use it for
OpenAPI Specification OpenAPI Initiative Tracks current canonical upstream URL. CI-enforced 2xx none expected typescript-sdk rest-api, sdk, api-contract HTTP API contracts; client generation; operation schemas
JSON Schema JSON Schema Tracks current canonical upstream URL. CI-enforced 2xx none expected - api-contract, validation, configuration JSON validation; machine-readable schemas; config contracts
Zod Documentation Zod Tracks current canonical upstream URL. CI-enforced 2xx none expected zod-validation runtime-validation, typescript-boundaries Runtime validation; schema inference; safe parsing
OAuth 2.1 Authorization Framework IETF Tracks current canonical upstream URL. CI-enforced 2xx none expected cloudflare-worker-mcp-server oauth, authorization, remote-mcp, web-app-auth Authorization code flow; PKCE; bearer token handling
OpenID Connect Core OpenID Foundation Tracks current canonical upstream URL. CI-enforced 2xx none expected - oidc, login, identity ID tokens; claims; authentication flows
Model Context Protocol Specification Model Context Protocol Pinned to dated specification 2025-11-25. CI-enforced 2xx none expected mcp-server mcp-client, ai-tools Protocol messages; tools; resources; prompts; transports
MCP Authorization Model Context Protocol Pinned to dated specification 2025-11-25. CI-enforced 2xx none expected cloudflare-worker-mcp-server, mcp-server remote-mcp, oauth Remote MCP authorization; resource server behavior; protected resource metadata
MCP Security Best Practices Model Context Protocol Pinned to dated documentation 2026-07-28. CI-enforced 2xx none expected mcp-server mcp-client, ai-tools Tool poisoning defenses; authorization risks; prompt injection considerations
MCP TypeScript SDK Model Context Protocol Tracks current canonical upstream URL. CI-enforced 2xx none expected mcp-server, typescript, node, cloudflare-workers worker Server implementation patterns; tool schemas; transport support

Security, CI, and testing

Security verification, CI hardening, and automated test references.

Reference Publisher Version policy Link check Redirect target Controlled appliesTo Topics Use it for
Application Security Verification Standard OWASP Tracks current canonical upstream URL. CI-enforced 2xx none expected - web-app-security, api-security, secure-development Security requirements; authentication; access control; session handling
OWASP Cheat Sheet Series OWASP Tracks current canonical upstream URL. CI-enforced 2xx none expected security web-app, api, auth Topic-specific secure implementation guidance
Cross-Site Request Forgery Prevention Cheat Sheet OWASP Tracks current canonical upstream URL. CI-enforced 2xx none expected - web-app, cookie-auth, mutating-requests CSRF controls; same-site cookies; origin checks; custom headers
Session Management Cheat Sheet OWASP Tracks current canonical upstream URL. CI-enforced 2xx none expected - session-auth, web-app-auth, cookies Session ID handling; cookie attributes; timeout and renewal
Multi Tenant Security Cheat Sheet OWASP Tracks current canonical upstream URL. CI-enforced 2xx none expected tenant-deployed-cloudflare-saas multi-tenant-saas, tenant-isolation Tenant isolation risks; multi-tenant security design; shared-resource risk
Authorization Cheat Sheet OWASP Tracks current canonical upstream URL. CI-enforced 2xx none expected tenant-deployed-cloudflare-saas authorization, access-control Server-side authorization; least privilege; tenant access checks
Secrets Management Cheat Sheet OWASP Tracks current canonical upstream URL. CI-enforced 2xx none expected tenant-deployed-cloudflare-saas secrets, credential-management Secret lifecycle; rotation; revocation; safe logging
Input Validation Cheat Sheet OWASP Tracks current canonical upstream URL. CI-enforced 2xx none expected - input-validation, api-security, runtime-validation Boundary validation; allowlisting; runtime input parsing
SQL Injection Prevention Cheat Sheet OWASP Tracks current canonical upstream URL. CI-enforced 2xx none expected - sql, database, query-safety Parameterized queries; safe query APIs; SQL injection prevention
Injection Prevention Cheat Sheet OWASP Tracks current canonical upstream URL. CI-enforced 2xx none expected - injection, command-execution, interpreter-boundaries Injection-prone interpreter boundaries; command/query construction
Server Side Request Forgery Prevention Cheat Sheet OWASP Tracks current canonical upstream URL. CI-enforced 2xx none expected - ssrf, outbound-fetch, webhooks Outbound URL constraints; SSRF prevention; allowlisting
Cross Site Scripting Prevention Cheat Sheet OWASP Tracks current canonical upstream URL. CI-enforced 2xx none expected - xss, browser-output, html-rendering Output encoding; HTML sanitization; dangerous browser sinks
Error Handling Cheat Sheet OWASP Tracks current canonical upstream URL. CI-enforced 2xx none expected - error-handling, api-security, safe-output Safe errors; exception handling; information disclosure prevention
Logging Cheat Sheet OWASP Tracks current canonical upstream URL. CI-enforced 2xx none expected - logging, audit, incident-response Security events; safe logging; audit evidence
Secure use reference GitHub Tracks current canonical upstream URL. CI-enforced 2xx none expected github-actions ci, supply-chain Workflow permissions; untrusted code; third-party actions; secret handling
Security hardening your deployments GitHub Tracks current canonical upstream URL. CI-enforced 2xx none expected github-actions deployment, oidc OIDC for cloud deployments; environment protection; deployment hardening
Deployments and Environments GitHub Tracks current canonical upstream URL. CI-enforced 2xx none expected github-actions, tenant-deployed-cloudflare-saas deployment-environments Environment protection rules; deployment approvals; environment-scoped secrets
Vitest Guide Vitest Tracks current canonical upstream URL. CI-enforced 2xx none expected vite unit-tests, typescript-tests Test runner setup; coverage; watch vs run mode
Playwright Best Practices Microsoft / Playwright Tracks current canonical upstream URL. CI-enforced 2xx none expected - e2e-tests, browser-tests, web-app Locator strategy; test isolation; resilient browser tests
Testing Library Guiding Principles Testing Library Tracks current canonical upstream URL. CI-enforced 2xx none expected react component-tests, ui-tests, vue, svelte User-centered test style; DOM queries; implementation-detail avoidance

Apps, extensions, and packaging

Editor, desktop, mobile, and distribution references.

Reference Publisher Version policy Link check Redirect target Controlled appliesTo Topics Use it for
Extension API Visual Studio Code Tracks current canonical upstream URL. CI-enforced 2xx none expected vscode-extension editor-extension Extension structure; activation events; commands; webviews; testing
Publishing Extensions Visual Studio Code Tracks current canonical upstream URL. CI-enforced 2xx none expected vscode-extension marketplace Marketplace metadata; engines.vscode; VSIX packaging; publisher requirements
Extension Runtime Security Visual Studio Code Tracks current canonical upstream URL. CI-enforced 2xx none expected vscode-extension extension-security Extension trust boundaries; runtime permissions; user risk model
Metadata syntax for GitHub Actions GitHub Tracks current canonical upstream URL. CI-enforced 2xx none expected github-action action-yml action.yml schema; inputs; outputs; runs; branding
Creating actions GitHub Tracks current canonical upstream URL. CI-enforced 2xx none expected github-action ci-automation JavaScript actions; composite actions; Docker actions
Tauri Documentation Tauri Tracks current canonical upstream URL. CI-enforced 2xx none expected tauri desktop-app, rust-webview Tauri app structure; commands; capabilities; plugins; bundling
Electron Documentation Electron Tracks current canonical upstream URL. CI-enforced 2xx none expected - electron, desktop-app Main/renderer process boundaries; IPC; security; packaging
Flutter Documentation Flutter Tracks current canonical upstream URL. CI-enforced 2xx none expected flutter mobile-app, desktop-app Flutter app structure; widgets; testing; deployment
Add Firebase to your Flutter app Firebase Tracks current canonical upstream URL. CI-enforced 2xx none expected firebase, flutter, flutter-firebase-app flutterfire, firebase-core, mobile-app, web-app FlutterFire setup; Firebase CLI and FlutterFire CLI configuration; platform app registration

Architecture and documentation

Architecture decision and knowledge-base references.

Reference Publisher Version policy Link check Redirect target Controlled appliesTo Topics Use it for
Architecture Decision Records Michael Nygard / joelparkerhenderson Tracks current canonical upstream URL. CI-enforced 2xx none expected docs-kb adr, architecture-docs, knowledge-base ADR structure; decision history; docs-as-architecture
The C4 Model Structurizr Tracks current canonical upstream URL. CI-enforced 2xx none expected - architecture-docs, system-design, diagrams Context/container/component/code diagrams; architecture communication
Diataxis Diataxis Tracks current canonical upstream URL. CI-enforced 2xx none expected docs-kb documentation, knowledge-base, developer-docs Tutorial/how-to/reference/explanation structure
Zensical Documentation Zensical Tracks current canonical upstream URL. CI-enforced 2xx none expected docs-kb zensical, documentation-site, kb-publishing Zensical site configuration; Markdown authoring; static docs publishing
Material for MkDocs Material for MkDocs Tracks current canonical upstream URL. CI-enforced 2xx none expected docs-kb mkdocs, documentation-site Docs navigation; search; admonitions; theme configuration

Firebase backend platform

Firebase Auth, Firestore, Functions, Hosting, rules, and emulator references for client-backed apps.

Reference Publisher Version policy Link check Redirect target Controlled appliesTo Topics Use it for
Cloud Functions for Firebase Firebase Tracks current canonical upstream URL. CI-enforced 2xx none expected firebase, flutter-firebase-app, node cloud-functions, server-side-javascript, firebase-admin server-side Firebase functions; runtime configuration; backend mutation boundaries
Get started with Cloud Firestore Security Rules Firebase Tracks current canonical upstream URL. CI-enforced 2xx none expected firebase, flutter-firebase-app firestore, security-rules, tenant-isolation Firestore rules authoring; rules simulator expectations; client data access boundaries
Build unit tests for Firebase Security Rules Firebase Tracks current canonical upstream URL. CI-enforced 2xx none expected firebase, flutter-firebase-app, testing firestore, security-rules, emulator, rules-tests Emulator-backed rules tests; local rules validation; automated security-rule test gates
Deploy to live and preview channels via GitHub pull requests Firebase Tracks current canonical upstream URL. CI-enforced 2xx none expected firebase, flutter-firebase-app, github-actions firebase-hosting, preview-deployments, ci-deploy Firebase Hosting deploy automation; preview channels; GitHub Actions deployment evidence