{
  "$schema": "./compositions.schema.json",
  "version": 1,
  "lastReviewed": "2026-07-22",
  "purpose": "Initial VCQA composition map: individual stack items point at upstream standards, then composed VCQA standards define the deployable shapes we should author and judge.",
  "principles": [
    "Author VCQA standards for deployable stack shapes, not isolated framework doctrine.",
    "Reference upstream official standards for broad concerns such as React, TypeScript, WCAG, OWASP, and Cloudflare runtime behavior.",
    "VCQA owns the glue: repository shape, deployment constraints, detection rules, exception policy, and anti-patterns."
  ],
  "stackItems": [
    {
      "id": "node",
      "title": "Node",
      "kind": "runtime",
      "references": [
        "node-docs",
        "node-security-best-practices",
        "npm-package-json"
      ],
      "vcqaShouldOwn": [
        "runtime and package metadata gates",
        "CLI/service process safety",
        "Node-specific security checks"
      ],
      "docsUrl": "/docs/standards/items/node/"
    },
    {
      "id": "react",
      "title": "React",
      "kind": "framework",
      "references": [
        "react-docs",
        "react-rules-of-hooks"
      ],
      "vcqaShouldOwn": [
        "component/routing conventions only where the stack shape requires them",
        "detection mapping for hook and component anti-patterns"
      ],
      "docsUrl": "/docs/standards/items/react/"
    },
    {
      "id": "react-router",
      "title": "React Router",
      "kind": "routing",
      "references": [
        "react-router-docs"
      ],
      "vcqaShouldOwn": [
        "SPA fallback expectations",
        "route/module organization for static deployments"
      ],
      "docsUrl": "/docs/standards/items/react-router/"
    },
    {
      "id": "vite",
      "title": "Vite",
      "kind": "build-tool",
      "references": [
        "vite-guide",
        "vite-static-deploy"
      ],
      "vcqaShouldOwn": [
        "build artifact expectations",
        "client environment-variable boundary",
        "static hosting fit"
      ],
      "docsUrl": "/docs/standards/items/vite/"
    },
    {
      "id": "typescript",
      "title": "TypeScript",
      "kind": "language",
      "references": [
        "typescript-tsconfig",
        "typescript-handbook"
      ],
      "vcqaShouldOwn": [
        "strictness enforcement by stack",
        "exception policy for generated files",
        "typed boundary checks"
      ],
      "docsUrl": "/docs/standards/items/typescript/"
    },
    {
      "id": "web-accessibility",
      "title": "Web Accessibility",
      "kind": "quality",
      "references": [
        "wcag-22",
        "wai-aria"
      ],
      "vcqaShouldOwn": [
        "code-level detection mapping",
        "minimum acceptance gates for UI stacks"
      ],
      "docsUrl": "/docs/standards/items/web-accessibility/"
    },
    {
      "id": "web-security",
      "title": "Web Security",
      "kind": "security",
      "references": [
        "owasp-asvs",
        "owasp-cheat-sheets",
        "owasp-authorization-cheat-sheet",
        "owasp-secrets-management-cheat-sheet",
        "owasp-input-validation-cheat-sheet",
        "owasp-sql-injection-prevention",
        "owasp-logging-cheat-sheet",
        "owasp-csrf-cheat-sheet",
        "owasp-session-management"
      ],
      "vcqaShouldOwn": [
        "stack-specific auth and secret boundaries",
        "detectable unsafe patterns",
        "security gates in CI"
      ],
      "docsUrl": "/docs/standards/items/web-security/"
    },
    {
      "id": "vitest",
      "title": "Vitest",
      "kind": "testing",
      "references": [
        "vitest-guide"
      ],
      "vcqaShouldOwn": [
        "required test layers by stack",
        "coverage and CI gate expectations"
      ],
      "docsUrl": "/docs/standards/items/vitest/"
    },
    {
      "id": "playwright",
      "title": "Playwright",
      "kind": "testing",
      "references": [
        "playwright-best-practices"
      ],
      "vcqaShouldOwn": [
        "E2E smoke coverage by deployable app shape",
        "artifact and failure-report expectations"
      ],
      "docsUrl": "/docs/standards/items/playwright/"
    },
    {
      "id": "cloudflare-pages-functions",
      "title": "Cloudflare Pages Functions",
      "kind": "runtime",
      "references": [
        "cloudflare-pages-functions",
        "cloudflare-pages-functions-routing",
        "cloudflare-pages-functions-middleware"
      ],
      "vcqaShouldOwn": [
        "functions directory shape",
        "same-origin API seam",
        "SPA/functions route collision checks",
        "binding and env policy"
      ],
      "docsUrl": "/docs/standards/items/cloudflare-pages-functions/"
    },
    {
      "id": "cloudflare-workers",
      "title": "Cloudflare Workers",
      "kind": "runtime",
      "references": [
        "cloudflare-workers",
        "cloudflare-workers-best-practices"
      ],
      "vcqaShouldOwn": [
        "compatibility-date policy",
        "Worker-specific deployment and secrets checks",
        "runtime anti-patterns"
      ],
      "docsUrl": "/docs/standards/items/cloudflare-workers/"
    },
    {
      "id": "cloudflare-d1",
      "title": "Cloudflare D1",
      "kind": "database",
      "references": [
        "cloudflare-d1",
        "cloudflare-d1-migrations"
      ],
      "vcqaShouldOwn": [
        "migration discipline",
        "local/remote parity checks",
        "tenant database isolation",
        "query-safety checks"
      ],
      "docsUrl": "/docs/standards/items/cloudflare-d1/"
    },
    {
      "id": "durable-objects",
      "title": "Durable Objects",
      "kind": "state",
      "references": [
        "cloudflare-durable-objects",
        "cloudflare-durable-objects-best-practices"
      ],
      "vcqaShouldOwn": [
        "stateful object boundaries",
        "migration and storage policy",
        "DO binding checks"
      ],
      "docsUrl": "/docs/standards/items/durable-objects/"
    },
    {
      "id": "mcp",
      "title": "MCP",
      "kind": "protocol",
      "references": [
        "mcp-spec",
        "mcp-authorization",
        "mcp-security",
        "mcp-typescript-sdk"
      ],
      "vcqaShouldOwn": [
        "tool safety rubric",
        "remote authorization policy",
        "tool schema quality",
        "auditability"
      ],
      "docsUrl": "/docs/standards/items/mcp/"
    },
    {
      "id": "zod",
      "title": "Zod",
      "kind": "validation",
      "references": [
        "zod-docs"
      ],
      "vcqaShouldOwn": [
        "boundary-validation expectations",
        "safeParse/error-shape policy",
        "schema sharing across API/client seams"
      ],
      "docsUrl": "/docs/standards/items/zod/"
    },
    {
      "id": "openapi",
      "title": "OpenAPI",
      "kind": "api-contract",
      "references": [
        "openapi",
        "json-schema"
      ],
      "vcqaShouldOwn": [
        "contract freshness checks",
        "generated client/server drift checks",
        "operation coverage"
      ],
      "docsUrl": "/docs/standards/items/openapi/"
    },
    {
      "id": "github-actions",
      "title": "GitHub Actions",
      "kind": "ci",
      "references": [
        "github-actions-secure-use",
        "github-actions-oidc"
      ],
      "vcqaShouldOwn": [
        "workflow permission gates",
        "deployment environment checks",
        "required test/build gates by stack"
      ],
      "docsUrl": "/docs/standards/items/github-actions/"
    },
    {
      "id": "vscode-extension",
      "title": "VS Code Extension",
      "kind": "extension",
      "references": [
        "vscode-extension-api",
        "vscode-extension-publishing",
        "vscode-extension-runtime-security"
      ],
      "vcqaShouldOwn": [
        "activation scope",
        "webview/security policy",
        "marketplace metadata checks"
      ],
      "docsUrl": "/docs/standards/items/vscode-extension/"
    },
    {
      "id": "github-action",
      "title": "GitHub Action",
      "kind": "automation",
      "references": [
        "github-actions-metadata",
        "github-actions-creating-actions",
        "github-actions-secure-use"
      ],
      "vcqaShouldOwn": [
        "action.yml quality",
        "input/output contract",
        "token/permission guidance",
        "pinning/versioning checks"
      ],
      "docsUrl": "/docs/standards/items/github-action/"
    },
    {
      "id": "tauri",
      "title": "Tauri",
      "kind": "desktop",
      "references": [
        "tauri-docs"
      ],
      "vcqaShouldOwn": [
        "command/capability boundaries",
        "secret storage expectations",
        "desktop build/signing checks"
      ],
      "docsUrl": "/docs/standards/items/tauri/"
    },
    {
      "id": "docs-kb",
      "title": "Docs KB",
      "kind": "documentation",
      "references": [
        "zensical-docs",
        "diataxis",
        "adr-github",
        "c4-model"
      ],
      "vcqaShouldOwn": [
        "docs source/build separation",
        "ADR freshness checks",
        "published KB access policy",
        "architecture drift gates"
      ],
      "docsUrl": "/docs/standards/items/docs-kb/"
    },
    {
      "id": "dependencies",
      "title": "Dependency Hygiene",
      "kind": "supply-chain",
      "references": [
        "npm-package-json",
        "github-actions-secure-use"
      ],
      "vcqaShouldOwn": [
        "lockfile and package-manager consistency",
        "install-script and dependency provenance gates",
        "audit, license, update, and exception evidence"
      ],
      "docsUrl": "/docs/standards/items/dependencies/"
    },
    {
      "id": "dart",
      "title": "Dart",
      "kind": "language",
      "references": [
        "dart-effective"
      ],
      "vcqaShouldOwn": [
        "Dart SDK constraints and analyzer gates by package",
        "generated/localized code exception boundaries",
        "shared model compatibility across app packages"
      ],
      "docsUrl": "/docs/standards/items/dart/"
    },
    {
      "id": "flutter",
      "title": "Flutter",
      "kind": "framework",
      "references": [
        "flutter-docs",
        "firebase-flutter-setup"
      ],
      "vcqaShouldOwn": [
        "Flutter package/app structure across platform targets",
        "widget/integration test evidence for user flows",
        "platform permission and build artifact checks"
      ],
      "docsUrl": "/docs/standards/items/flutter/"
    },
    {
      "id": "firebase",
      "title": "Firebase",
      "kind": "backend-platform",
      "references": [
        "firebase-flutter-setup",
        "firebase-functions",
        "firebase-firestore-security-rules",
        "firebase-rules-unit-tests",
        "firebase-hosting-github-integration"
      ],
      "vcqaShouldOwn": [
        "Firebase project/environment separation",
        "Firestore rules and index test gates",
        "client-exposed config versus server secret boundaries",
        "Hosting/Functions deploy evidence and rollback path"
      ],
      "docsUrl": "/docs/standards/items/firebase/"
    },
    {
      "id": "melos",
      "title": "Melos",
      "kind": "workspace-tool",
      "references": [
        "melos-docs"
      ],
      "vcqaShouldOwn": [
        "workspace package discovery and bootstrap reproducibility",
        "cross-package analyze/test orchestration",
        "shared package dependency drift checks"
      ],
      "docsUrl": "/docs/standards/items/melos/"
    }
  ],
  "composedStandards": [
    {
      "id": "react-spa",
      "status": "authored",
      "stackItems": [
        "react",
        "react-router",
        "vite",
        "typescript",
        "web-accessibility",
        "web-security",
        "vitest",
        "playwright"
      ],
      "ownedRules": [
        "static SPA boundary",
        "client env vars are non-secret only",
        "SPA routing fallback",
        "build output and asset hygiene"
      ],
      "benefits": [
        "vibecodeqa/app web dashboard",
        "Cloudflare SaaS example frontend"
      ],
      "aliases": [
        "react-spa-static"
      ],
      "standardUrl": "/standards/react-spa/v1/",
      "latestEdition": "v1",
      "docsUrl": "/docs/standards/stacks/react-spa/"
    },
    {
      "id": "cloudflare-pages-fullstack",
      "status": "authored",
      "stackItems": [
        "react-spa",
        "cloudflare-pages-functions",
        "typescript",
        "web-security",
        "github-actions"
      ],
      "ownedRules": [
        "same-origin /api seam",
        "functions route shape",
        "middleware/auth placement",
        "bindings and deployed vars",
        "SPA/functions deploy assembly"
      ],
      "benefits": [
        "Cloudflare SaaS example app",
        "future VCQA fullstack dashboard patterns"
      ],
      "aliases": [
        "pages-fullstack"
      ],
      "standardUrl": "/standards/cloudflare-pages-fullstack/v1/",
      "latestEdition": "v1",
      "docsUrl": "/docs/standards/stacks/cloudflare-pages-fullstack/"
    },
    {
      "id": "cloudflare-d1-app",
      "status": "authored",
      "stackItems": [
        "cloudflare-d1",
        "cloudflare-pages-functions",
        "cloudflare-workers",
        "typescript",
        "web-security",
        "github-actions"
      ],
      "ownedRules": [
        "append-only/versioned migrations",
        "migration checksum or drift guard",
        "local apply test",
        "staging/prod/tenant database isolation",
        "parameterized query enforcement"
      ],
      "benefits": [
        "Cloudflare SaaS example D1 usage"
      ],
      "aliases": [
        "cloudflare-d1",
        "d1-database"
      ],
      "standardUrl": "/standards/cloudflare-d1-app/v1/",
      "latestEdition": "v1",
      "docsUrl": "/docs/standards/stacks/cloudflare-d1-app/"
    },
    {
      "id": "cloudflare-worker-mcp-server",
      "status": "authored",
      "stackItems": [
        "cloudflare-workers",
        "durable-objects",
        "mcp",
        "zod",
        "typescript",
        "web-security",
        "github-actions"
      ],
      "ownedRules": [
        "remote MCP authorization",
        "tool schema and permission boundaries",
        "Durable Object/KV storage policy",
        "per-environment OAuth isolation",
        "tool audit trail"
      ],
      "benefits": [
        "Cloudflare SaaS example MCP Worker"
      ],
      "aliases": [],
      "standardUrl": "/standards/cloudflare-worker-mcp-server/v1/",
      "latestEdition": "v1",
      "docsUrl": "/docs/standards/stacks/cloudflare-worker-mcp-server/"
    },
    {
      "id": "tenant-deployed-cloudflare-saas",
      "status": "authored",
      "stackItems": [
        "cloudflare-workers",
        "github-actions",
        "web-security",
        "docs-kb"
      ],
      "optionalStackItems": [
        "cloudflare-pages-functions",
        "cloudflare-d1"
      ],
      "ownedRules": [
        "tenant instance isolation",
        "staging/prod promotion gates",
        "per-tenant data-resource and secret boundaries",
        "deployment alias auth perimeter",
        "tenant provisioning documentation"
      ],
      "benefits": [
        "Cloudflare SaaS tenant deployment model"
      ],
      "aliases": [],
      "standardUrl": "/standards/tenant-deployed-cloudflare-saas/v1/",
      "latestEdition": "v1",
      "docsUrl": "/docs/standards/stacks/tenant-deployed-cloudflare-saas/"
    },
    {
      "id": "security",
      "status": "authored",
      "stackItems": [
        "web-security",
        "github-actions",
        "cloudflare-workers",
        "mcp",
        "docs-kb"
      ],
      "ownedRules": [
        "server-side authorization boundary checks",
        "client/server secret exposure and environment-scope checks",
        "input validation and injection-prone boundary checks",
        "output safety for browser, logs, tool responses, and generated content",
        "tenant, preview, staging, and production isolation signals",
        "GitHub Actions and deployment permission gates",
        "security logging, audit, and incident evidence expectations"
      ],
      "benefits": [
        "Cloudflare SaaS example security coverage",
        "all VCQA app, API, Worker, MCP, CLI, SDK, and CI surfaces"
      ],
      "aliases": [],
      "standardUrl": "/standards/security/v1/",
      "latestEdition": "v1",
      "docsUrl": "/docs/standards/items/web-security/"
    },
    {
      "id": "testing",
      "status": "authored",
      "stackItems": [
        "vitest",
        "playwright",
        "github-actions"
      ],
      "ownedRules": [
        "critical behavior mapped to automated tests or explicit risk exceptions",
        "meaningful unit assertions over deterministic logic",
        "integration tests at public API, command, database, provider, protocol, or package seams",
        "component and UI tests that assert user-visible behavior",
        "built-artifact smoke tests for deployable apps",
        "coverage thresholds and documented exclusions for behavior-bearing code",
        "mock, fixture, snapshot, flaky, skipped, and generated-test quality gates",
        "CI test gates and failure evidence before deploy, release, or publish"
      ],
      "benefits": [
        "all VCQA app, API, Worker, MCP, CLI, SDK, desktop, and CI surfaces",
        "VCQA testing and test-audit scanner checks",
        "Cloudflare SaaS example coverage gaps"
      ],
      "aliases": [],
      "standardUrl": "/standards/testing/v1/",
      "latestEdition": "v1",
      "docsUrl": "/docs/standards/items/vitest/"
    },
    {
      "id": "typescript",
      "status": "authored",
      "stackItems": [
        "typescript",
        "node",
        "github-actions"
      ],
      "ownedRules": [
        "strict compiler settings for owned source",
        "runtime-compatible lib, types, module, and moduleResolution",
        "project references or explicit typecheck boundaries",
        "unsafe any, assertion, and suppression controls",
        "external data validation before trusted domain typing",
        "type-only import and emit discipline",
        "generated code and exception policy",
        "declaration and public API type compatibility",
        "CI typecheck gates and drift evidence"
      ],
      "benefits": [
        "all VCQA typed app, Worker, MCP, CLI, SDK, extension, desktop, and CI surfaces",
        "VCQA typecheck and type-safety scanner checks",
        "Cloudflare SaaS example typed boundary gaps"
      ],
      "aliases": [],
      "standardUrl": "/standards/typescript/v1/",
      "latestEdition": "v1",
      "docsUrl": "/docs/standards/items/typescript/"
    },
    {
      "id": "node-cli-internal-tool",
      "status": "planned",
      "stackItems": [
        "typescript",
        "node",
        "openapi",
        "web-security"
      ],
      "ownedRules": [
        "noninteractive exit-code contract",
        "credential resolution order",
        "prod/staging safety defaults",
        "structured output mode",
        "SDK reuse instead of API duplication"
      ],
      "benefits": [
        "Cloudflare SaaS example CLI",
        "vcqa/cli"
      ],
      "aliases": [
        "node-service"
      ],
      "standardUrl": null,
      "latestEdition": null,
      "docsUrl": "/docs/standards/stacks/node-cli-internal-tool/"
    },
    {
      "id": "typescript-sdk",
      "status": "planned",
      "stackItems": [
        "typescript",
        "openapi",
        "zod",
        "vitest"
      ],
      "ownedRules": [
        "export map and declaration quality",
        "API contract freshness",
        "credential boundary",
        "typed error model",
        "consumer compatibility tests"
      ],
      "benefits": [
        "Cloudflare SaaS example SDK",
        "future VCQA schema/client packages"
      ],
      "aliases": [
        "library"
      ],
      "standardUrl": null,
      "latestEdition": null,
      "docsUrl": "/docs/standards/stacks/typescript-sdk/"
    },
    {
      "id": "github-action-package",
      "status": "planned",
      "stackItems": [
        "github-action",
        "github-actions",
        "node",
        "typescript"
      ],
      "ownedRules": [
        "action.yml metadata completeness",
        "minimum token permissions",
        "input validation",
        "pinned runtime/dependency policy",
        "release tag policy"
      ],
      "benefits": [
        "vibecodeqa/action"
      ],
      "aliases": [],
      "standardUrl": null,
      "latestEdition": null,
      "docsUrl": "/docs/standards/stacks/github-action-package/"
    },
    {
      "id": "vscode-extension-package",
      "status": "planned",
      "stackItems": [
        "vscode-extension",
        "typescript",
        "node",
        "web-security"
      ],
      "ownedRules": [
        "activation event scope",
        "workspace trust behavior",
        "command and webview boundaries",
        "marketplace metadata",
        "extension test coverage"
      ],
      "benefits": [
        "vibecodeqa/vscode"
      ],
      "aliases": [],
      "standardUrl": null,
      "latestEdition": null,
      "docsUrl": "/docs/standards/stacks/vscode-extension-package/"
    },
    {
      "id": "tauri-react-desktop",
      "status": "planned",
      "stackItems": [
        "tauri",
        "react",
        "typescript",
        "web-security",
        "docs-kb"
      ],
      "ownedRules": [
        "Tauri command/capability boundaries",
        "keychain/secret storage",
        "file-system watch safety",
        "desktop packaging and signing",
        "frontend/backend contract typing"
      ],
      "benefits": [
        "vibecodeqa/app desktop monitor"
      ],
      "aliases": [],
      "standardUrl": null,
      "latestEdition": null,
      "docsUrl": "/docs/standards/stacks/tauri-react-desktop/"
    },
    {
      "id": "zensical-kb-site",
      "status": "planned",
      "stackItems": [
        "docs-kb",
        "github-actions"
      ],
      "ownedRules": [
        "Markdown source is the source of truth",
        "generated site is ignored",
        "published URLs are stable",
        "source references are tracked",
        "docs drift checks where mirrors exist"
      ],
      "benefits": [
        "vibecodeqa/docs",
        "vibecodeqa/standards",
        "Cloudflare SaaS example docs"
      ],
      "aliases": [],
      "standardUrl": null,
      "latestEdition": null,
      "docsUrl": "/docs/standards/stacks/zensical-kb-site/"
    },
    {
      "id": "react-spa-on-cloudflare-pages",
      "status": "authored",
      "stackItems": [
        "react-spa",
        "cloudflare-pages-functions",
        "typescript",
        "web-security",
        "github-actions"
      ],
      "ownedRules": [
        "same-origin app/API deployment seam",
        "SPA fallback and /api route ownership",
        "shared deployment evidence for React app plus Pages Functions"
      ],
      "benefits": [
        "Alias to Cloudflare Pages Fullstack for React SPA deployments on Cloudflare Pages"
      ],
      "aliases": [
        "pages-fullstack"
      ],
      "standardUrl": "/standards/cloudflare-pages-fullstack/v1/",
      "latestEdition": "v1",
      "docsUrl": "/docs/standards/stacks/cloudflare-pages-fullstack/"
    },
    {
      "id": "accessibility",
      "status": "planned",
      "stackItems": [
        "web-accessibility"
      ],
      "ownedRules": [
        "WCAG and ARIA acceptance gates mapped to scanner evidence",
        "keyboard, focus, semantics, and contrast checks by UI stack",
        "manual-review exception policy for accessibility findings"
      ],
      "benefits": [
        "all VCQA browser app, docs, extension webview, and desktop UI surfaces"
      ],
      "aliases": [],
      "standardUrl": null,
      "latestEdition": null,
      "docsUrl": "/docs/standards/items/web-accessibility/"
    },
    {
      "id": "dependencies",
      "status": "planned",
      "stackItems": [
        "dependencies",
        "github-actions",
        "node"
      ],
      "ownedRules": [
        "lockfile and package-manager pinning",
        "install script and dependency provenance review",
        "audit, license, update, runtime, and exception evidence in CI"
      ],
      "benefits": [
        "all VCQA package-managed apps, Workers, CLIs, SDKs, Actions, and docs sites"
      ],
      "aliases": [],
      "standardUrl": null,
      "latestEdition": null,
      "docsUrl": "/docs/standards/items/dependencies/"
    },
    {
      "id": "flutter-firebase-app",
      "status": "authored",
      "aliases": [
        "flutterfire-app",
        "firebase-flutter-app"
      ],
      "stackItems": [
        "dart",
        "flutter",
        "firebase",
        "melos",
        "github-actions",
        "dependencies"
      ],
      "optionalStackItems": [
        "web-accessibility",
        "web-security",
        "node"
      ],
      "ownedRules": [
        "Flutter/Dart workspace declaration, workspace-wide analyze, and shared-package consumer proof",
        "the client/server field contract declared once across Dart, firestore.rules, and Functions",
        "Firebase environment separation, emulator isolation, and build-time environment selection",
        "the public client config versus server credential boundary, in source and in the built artifact",
        "Firestore rules and composite indexes as versioned, emulator-tested, deployable artifacts",
        "Cloud Functions as the owner of privileged writes, with server-side claim re-verification",
        "Flutter build evidence: pinned toolchain, platform permissions, and stated build-shape limits",
        "production deploy gating, rules-before-code promotion order, and deploy credential shape"
      ],
      "benefits": [
        "HeartFull platform: app/admin/shared Flutter workspace with Firebase backend",
        "ref-flutter-firebase-app: product-neutral template for this composition"
      ],
      "standardUrl": "https://vibecodeqa.online/standards/flutter-firebase-app/v1/",
      "latestEdition": "v1",
      "docsUrl": "/docs/standards/stacks/flutter-firebase-app/"
    }
  ],
  "referenceImplementations": [
    {
      "id": "ref-react-spa",
      "repo": "vibecodeqa/ref-react-spa",
      "url": "https://github.com/vibecodeqa/ref-react-spa",
      "status": "published",
      "standards": [
        "react-spa",
        "typescript",
        "testing",
        "security"
      ],
      "demonstratesPrimary": "react-spa",
      "demonstrates": "Small React SPA template: Vite, TypeScript, React Router, Vitest, Playwright, accessibility-oriented UI structure, static build gates, and public client configuration discipline.",
      "note": null,
      "evidence": {
        "reportUrl": "https://github.com/vibecodeqa/ref-react-spa/blob/main/docs/vcqa-report.md",
        "score": 94,
        "grade": "A",
        "assessedCommit": "54ac82b9d91b83055409bca0b60d317115c358fd",
        "assessedAt": "2026-07-23",
        "ciRunUrl": "https://github.com/vibecodeqa/ref-react-spa/actions/runs/30010328660",
        "ciConclusion": "success",
        "ciRunAt": "2026-07-23",
        "independentAssessmentUrl": null,
        "verifiedAt": "2026-08-08"
      }
    },
    {
      "id": "ref-cloudflare-worker-mcp",
      "repo": "vibecodeqa/ref-cloudflare-worker-mcp",
      "url": "https://github.com/vibecodeqa/ref-cloudflare-worker-mcp",
      "status": "published",
      "standards": [
        "cloudflare-worker-mcp-server",
        "typescript",
        "testing",
        "security"
      ],
      "demonstratesPrimary": "cloudflare-worker-mcp-server",
      "demonstrates": "SDK-backed Streamable HTTP MCP Worker template: protected resource metadata, Worker-boundary authorization, scoped tool permissions, Zod validation, audit events, runbooks, and Wrangler dry-run deploy gates.",
      "note": null,
      "evidence": {
        "reportUrl": "https://github.com/vibecodeqa/ref-cloudflare-worker-mcp/blob/main/docs/vcqa-report.md",
        "score": 92,
        "grade": "A",
        "assessedCommit": "2242765a77a05458025c0ed377cd6a89856f5a6b",
        "assessedAt": "2026-07-24",
        "ciRunUrl": "https://github.com/vibecodeqa/ref-cloudflare-worker-mcp/actions/runs/30058670533",
        "ciConclusion": "success",
        "ciRunAt": "2026-07-24",
        "independentAssessmentUrl": null,
        "verifiedAt": "2026-08-08"
      }
    },
    {
      "id": "ref-cloudflare-saas",
      "repo": "vibecodeqa/ref-cloudflare-saas",
      "url": "https://github.com/vibecodeqa/ref-cloudflare-saas",
      "status": "published",
      "standards": [
        "react-spa",
        "cloudflare-pages-fullstack",
        "cloudflare-d1-app",
        "cloudflare-worker-mcp-server",
        "tenant-deployed-cloudflare-saas",
        "typescript",
        "testing",
        "security"
      ],
      "demonstratesPrimary": "tenant-deployed-cloudflare-saas",
      "demonstrates": "Product-neutral Cloudflare SaaS template: React SPA, Pages Functions, D1, Worker MCP, SDK, CLI, tenant manifests, runbooks, and CI gates.",
      "note": null,
      "evidence": {
        "reportUrl": "https://github.com/vibecodeqa/ref-cloudflare-saas/blob/main/docs/vcqa-report.md",
        "score": 91,
        "grade": "A",
        "assessedCommit": "41eb24369378b4efd4234d8ccea5e5e88b799761",
        "assessedAt": "2026-07-23",
        "ciRunUrl": "https://github.com/vibecodeqa/ref-cloudflare-saas/actions/runs/30010329406",
        "ciConclusion": "success",
        "ciRunAt": "2026-07-23",
        "independentAssessmentUrl": null,
        "verifiedAt": "2026-08-08"
      }
    },
    {
      "id": "ref-node-cli-internal-tool",
      "repo": "vibecodeqa/ref-node-cli-internal-tool",
      "url": "https://github.com/vibecodeqa/ref-node-cli-internal-tool",
      "status": "published",
      "standards": [
        "node-cli-internal-tool",
        "typescript",
        "testing",
        "security"
      ],
      "demonstratesPrimary": "node-cli-internal-tool",
      "demonstrates": "Small Node CLI template: TypeScript, stable exit codes, credential resolution, production safety guards, structured output, parser tests, and executable smoke checks.",
      "note": null,
      "evidence": {
        "reportUrl": "https://github.com/vibecodeqa/ref-node-cli-internal-tool/blob/main/docs/vcqa-report.md",
        "score": 92,
        "grade": null,
        "assessedCommit": "95f41941a1a049ce34e32cdea5a9698db5782717",
        "assessedAt": "2026-07-24",
        "ciRunUrl": "https://github.com/vibecodeqa/ref-node-cli-internal-tool/actions/runs/30108197597",
        "ciConclusion": "success",
        "ciRunAt": "2026-07-24",
        "independentAssessmentUrl": null,
        "verifiedAt": "2026-08-08"
      }
    },
    {
      "id": "ref-cloudflare-pages-fullstack",
      "repo": "vibecodeqa/ref-cloudflare-pages-fullstack",
      "url": "https://github.com/vibecodeqa/ref-cloudflare-pages-fullstack",
      "status": "published",
      "standards": [
        "cloudflare-pages-fullstack",
        "react-spa",
        "typescript",
        "testing",
        "security"
      ],
      "demonstratesPrimary": "cloudflare-pages-fullstack",
      "demonstrates": "React SPA plus same-origin Cloudflare Pages Functions API, route ownership, bindings, and deploy evidence.",
      "note": null,
      "evidence": {
        "reportUrl": "https://github.com/vibecodeqa/ref-cloudflare-pages-fullstack/blob/main/docs/vcqa-report.md",
        "score": 92,
        "grade": null,
        "assessedCommit": "26b59c4e3f00f1102d6244322e5e61e36311ecc7",
        "assessedAt": "2026-07-25",
        "ciRunUrl": "https://github.com/vibecodeqa/ref-cloudflare-pages-fullstack/actions/runs/30144503839",
        "ciConclusion": "success",
        "ciRunAt": "2026-07-25",
        "independentAssessmentUrl": null,
        "verifiedAt": "2026-08-08"
      }
    },
    {
      "id": "ref-cloudflare-d1-app",
      "repo": "vibecodeqa/ref-cloudflare-d1-app",
      "url": "https://github.com/vibecodeqa/ref-cloudflare-d1-app",
      "status": "published",
      "standards": [
        "cloudflare-d1-app",
        "typescript",
        "testing",
        "security"
      ],
      "demonstratesPrimary": "cloudflare-d1-app",
      "demonstrates": "D1 migrations, local apply checks, bindings, query safety, and environment isolation without the broader SaaS composition.",
      "note": null,
      "evidence": {
        "reportUrl": "https://github.com/vibecodeqa/ref-cloudflare-d1-app/blob/main/docs/vcqa-report.md",
        "score": 92,
        "grade": null,
        "assessedCommit": "167e6e42346e80acf2b13eea63beaa9987f3b6c9",
        "assessedAt": "2026-07-25",
        "ciRunUrl": "https://github.com/vibecodeqa/ref-cloudflare-d1-app/actions/runs/30144779114",
        "ciConclusion": "success",
        "ciRunAt": "2026-07-25",
        "independentAssessmentUrl": null,
        "verifiedAt": "2026-08-08"
      }
    },
    {
      "id": "ref-firebase-react-fullstack",
      "repo": "vibecodeqa/ref-firebase-react-fullstack",
      "url": "https://github.com/vibecodeqa/ref-firebase-react-fullstack",
      "status": "experimental",
      "standards": [
        "react-spa",
        "typescript",
        "testing",
        "security"
      ],
      "demonstratesPrimary": null,
      "demonstrates": "Firebase Hosting + Functions v2 + Firestore workspace behind a Vite React app: shared TypeScript contracts, denied-by-default Firestore/Storage rules, emulator-backed rules tests, and CI gates.",
      "note": "Experimental. This repo was published before any Firebase stack standard existed, and no authored or planned VCQA standard describes the Firebase + React shape today (flutter-firebase-app is planned, but it targets Flutter). It is cataloged as experimental evidence for the cross-cutting TypeScript, Testing, and Security rubrics only, and is not a reference implementation of a stack standard.",
      "evidence": {
        "reportUrl": "https://github.com/vibecodeqa/ref-firebase-react-fullstack/blob/main/docs/vcqa-report.md",
        "score": 91,
        "grade": null,
        "assessedCommit": "9a18be493942f77af2141b18ecf2dfed5e879299",
        "assessedAt": "2026-07-24",
        "ciRunUrl": "https://github.com/vibecodeqa/ref-firebase-react-fullstack/actions/runs/30089690815",
        "ciConclusion": "success",
        "ciRunAt": "2026-07-24",
        "independentAssessmentUrl": null,
        "verifiedAt": "2026-08-08"
      }
    },
    {
      "id": "ref-typescript-sdk",
      "repo": "vibecodeqa/ref-typescript-sdk",
      "url": "https://github.com/vibecodeqa/ref-typescript-sdk",
      "status": "published",
      "standards": [
        "typescript-sdk",
        "typescript",
        "testing",
        "dependencies"
      ],
      "demonstratesPrimary": "typescript-sdk",
      "demonstrates": "Export maps, declarations, typed errors, generated client drift checks, and consumer compatibility tests.",
      "note": "Published against a charter, not a versioned rubric: `typescript-sdk` is `planned` with maturity `candidate-rubric`, so the score is the CLI composite over the generic, TypeScript, Testing and Security checks rather than proof that the charter is satisfied. The repo's report does not map R-SDK-1 to R-SDK-12 rule by rule, which is what the charter's promotion criteria still require.",
      "evidence": {
        "reportUrl": "https://github.com/vibecodeqa/ref-typescript-sdk/blob/main/docs/vcqa-report.md",
        "score": 98,
        "grade": "A",
        "assessedCommit": "2f6a285c38341700492843919c4012f66df0c7a1",
        "assessedAt": "2026-08-09",
        "ciRunUrl": "https://github.com/vibecodeqa/ref-typescript-sdk/actions/runs/31281125180",
        "ciConclusion": "success",
        "ciRunAt": "2026-08-08",
        "independentAssessmentUrl": null,
        "verifiedAt": "2026-08-09"
      }
    },
    {
      "id": "ref-github-action-package",
      "repo": "vibecodeqa/ref-github-action-package",
      "url": "https://github.com/vibecodeqa/ref-github-action-package",
      "status": "published",
      "standards": [
        "github-action-package",
        "typescript",
        "testing",
        "security",
        "dependencies"
      ],
      "demonstratesPrimary": "github-action-package",
      "demonstrates": "GitHub Action package metadata, minimum permissions, input validation, runtime/dependency policy, bundled-output freshness, release tags, and CI smoke evidence.",
      "note": "Published against a charter, not a versioned rubric: `github-action-package` is `planned` with maturity `candidate-rubric`, so the score is the CLI composite and the repo's R-GHA-1 to R-GHA-10 mapping is argued by hand rather than machine-checked. No `vX.Y.Z` or moving `v1` tag has been pushed, so the release-tag rule is documented rather than exercised, and only the JavaScript runtime is covered.",
      "evidence": {
        "reportUrl": "https://github.com/vibecodeqa/ref-github-action-package/blob/main/docs/vcqa-report.md",
        "score": 100,
        "grade": "A",
        "assessedCommit": "fd8722d8f584481bb0fdc440f9a519337361e528",
        "assessedAt": "2026-08-09",
        "ciRunUrl": "https://github.com/vibecodeqa/ref-github-action-package/actions/runs/31280798527",
        "ciConclusion": "success",
        "ciRunAt": "2026-08-08",
        "independentAssessmentUrl": null,
        "verifiedAt": "2026-08-09"
      }
    },
    {
      "id": "ref-zensical-kb-site",
      "repo": "vibecodeqa/ref-zensical-kb-site",
      "url": "https://github.com/vibecodeqa/ref-zensical-kb-site",
      "status": "experimental",
      "standards": [
        "zensical-kb-site"
      ],
      "demonstratesPrimary": "zensical-kb-site",
      "demonstrates": "Markdown source of truth, stable docs URLs, references, generated-site policy, and docs smoke checks.",
      "note": "Experimental rather than published: `zensical-kb-site` is `planned` with maturity `draft-charter` and carries no numbered rules, so there is no rule set for this repo to be the reference implementation of. The score is the CLI composite over roughly 600 lines of checker scripts and says nothing about knowledge-base quality; the repo separately publishes a self-assessment against its own KB quality model, which is not a VCQA score and is not recorded here. External reachability checking runs in a separate weekly non-blocking workflow, so it is not part of the CI run cited above.",
      "evidence": {
        "reportUrl": "https://github.com/vibecodeqa/ref-zensical-kb-site/blob/main/docs/vcqa-report.md",
        "score": 88,
        "grade": "B",
        "assessedCommit": "7b3f48978d46e2731c44b88622ae1d7a97235c86",
        "assessedAt": "2026-08-09",
        "ciRunUrl": "https://github.com/vibecodeqa/ref-zensical-kb-site/actions/runs/31281323385",
        "ciConclusion": "success",
        "ciRunAt": "2026-08-08",
        "independentAssessmentUrl": null,
        "verifiedAt": "2026-08-09"
      }
    },
    {
      "id": "ref-vscode-extension-package",
      "repo": "vibecodeqa/ref-vscode-extension-package",
      "url": "https://github.com/vibecodeqa/ref-vscode-extension-package",
      "status": "experimental",
      "standards": [
        "vscode-extension-package",
        "typescript",
        "testing",
        "security"
      ],
      "demonstratesPrimary": "vscode-extension-package",
      "demonstrates": "Activation scope, workspace trust, command/webview boundaries, marketplace metadata, and extension tests.",
      "note": "Experimental rather than published on two counts: `vscode-extension-package` is `planned` with maturity `backlog` and carries no numbered rules, and the resolver cannot detect the archetype at all — `standards/resolve.mjs` classifies this repo as `typescript-sdk` ([#47](https://github.com/vibecodeqa/vibecodeqa/issues/47)). The catalog will not call a repo the reference implementation of a standard that has no rules and cannot be recognised. Promote once both are fixed.",
      "evidence": {
        "reportUrl": "https://github.com/vibecodeqa/ref-vscode-extension-package/blob/main/docs/vcqa-report.md",
        "score": 99,
        "grade": "A",
        "assessedCommit": "ca7525fbe541694a362031f2e69165d88c0ad8a1",
        "assessedAt": "2026-08-09",
        "ciRunUrl": "https://github.com/vibecodeqa/ref-vscode-extension-package/actions/runs/31281381176",
        "ciConclusion": "success",
        "ciRunAt": "2026-08-08",
        "independentAssessmentUrl": null,
        "verifiedAt": "2026-08-09"
      }
    },
    {
      "id": "ref-tauri-react-desktop",
      "repo": "vibecodeqa/ref-tauri-react-desktop",
      "url": "https://github.com/vibecodeqa/ref-tauri-react-desktop",
      "status": "experimental",
      "standards": [
        "tauri-react-desktop",
        "react-spa",
        "typescript",
        "testing",
        "security"
      ],
      "demonstratesPrimary": "tauri-react-desktop",
      "demonstrates": "Tauri command/capability boundaries, secure storage, file-system safety, packaging, and frontend/backend typing.",
      "note": "Experimental rather than published: `tauri-react-desktop` is `planned` with maturity `draft-charter` and carries no numbered rules, so the score is a composite over the generic, React SPA, TypeScript, Testing and Security checks rather than evidence that the standard is satisfied. Packaging is verified as `tauri build --no-bundle` on Linux, not as a signed bundle, and there is no end-to-end layer driving the packaged window: the capability policy is proven by static validation and by the absence of the plugin crates.",
      "evidence": {
        "reportUrl": "https://github.com/vibecodeqa/ref-tauri-react-desktop/blob/main/docs/vcqa-report.md",
        "score": 98,
        "grade": "A",
        "assessedCommit": "263d600c1c7be456a95fb3c7494cc79f2b7dbab3",
        "assessedAt": "2026-08-09",
        "ciRunUrl": "https://github.com/vibecodeqa/ref-tauri-react-desktop/actions/runs/31281611946",
        "ciConclusion": "success",
        "ciRunAt": "2026-08-08",
        "independentAssessmentUrl": null,
        "verifiedAt": "2026-08-09"
      }
    },
    {
      "id": "ref-flutter-firebase-app",
      "repo": "vibecodeqa/ref-flutter-firebase-app",
      "url": "https://github.com/vibecodeqa/ref-flutter-firebase-app",
      "status": "experimental",
      "standards": [
        "flutter-firebase-app",
        "testing",
        "security",
        "dependencies"
      ],
      "demonstratesPrimary": "flutter-firebase-app",
      "demonstrates": "Product-neutral Flutter + Firebase workspace: app/admin/shared packages, Firebase Hosting/Functions/Firestore, rules tests, platform builds, and CI evidence gates.",
      "note": "Not yet re-judged against the v1 rubric published under [#43](https://github.com/vibecodeqa/vibecodeqa/issues/43): its score was assessed against the earlier charter plus testing@v1 and security@v1, so it stays experimental until a scan against flutter-firebase-app@v1 replaces the evidence below. The score is also self-reported and was not independently reproducible -- a bare-environment scan without a Flutter SDK and resolved Dart dependencies returns 78/100 for the same commit, because the analyzer cannot resolve imports. Two resolver limitations recorded here have since been fixed, and this note no longer claims them: detection no longer depends on melos.yaml -- the predicate accepts either that file or a `melos:` key in the workspace-root pubspec.yaml, and slicing reads the Dart `workspace:` list, so a Melos 7+ workspace resolves identically ([#48](https://github.com/vibecodeqa/vibecodeqa/issues/48), fixed in `80eb195`, both layouts covered by fixtures); and the Cloud Functions package no longer resolves as typescript-sdk, because that archetype now also requires `package.json:types`, which a Functions package does not declare ([#49](https://github.com/vibecodeqa/vibecodeqa/issues/49)). The repo still pins Melos 6.3.2, but for production fidelity to the repo this stack was modelled on -- not to stay detectable; whether to unpin is open in [#51](https://github.com/vibecodeqa/vibecodeqa/issues/51). The mobile build check is a debug APK compile: release signing, R8, App Bundle and iOS are never built.",
      "evidence": {
        "reportUrl": "https://github.com/vibecodeqa/ref-flutter-firebase-app/blob/main/docs/vcqa-report.md",
        "score": 93,
        "grade": "A",
        "assessedCommit": "d0d1a28e72cea97cf34432f8f0e2aaafe5b5349e",
        "assessedAt": "2026-08-09",
        "ciRunUrl": "https://github.com/vibecodeqa/ref-flutter-firebase-app/actions/runs/31282189859",
        "ciConclusion": "success",
        "ciRunAt": "2026-08-08",
        "independentAssessmentUrl": null,
        "verifiedAt": "2026-08-09"
      }
    }
  ]
}