Rules

One page per rule: what it catches, why, a bad and a good example, how it is checked and how to silence it. There are 123 rules. brevio-core scan checks 13 of them. The harness’s pre-flight checks 10 more, which brevio-core scan does not run; 22 more are slice cards; the rest are standing rules. Generated from the rule definitions; do not edit by hand.

R1: UI and mobile performance

• R1.1 Mobile GPU budget (harness pre-flight)
• R1.2 SSR visibility resilience (harness pre-flight)
• R1.3 Third-party script deferral (harness pre-flight)
• R1.4 Zero-flash theme bootstrap
• R1.5 No dead controls
• R1.6 Accessible switch geometry
• R1.7 LCP asset priority
• R1.8 Async polling hygiene

R2: Security and tenancy

• R2.1 Tenant context derivation
• R2.2 Tenant-scoped data access (harness pre-flight)
• R2.3 Dual-key entity resolution
• R2.4 Raw-body webhook verification (harness pre-flight)
• R2.5 Outbound SSRF & timeout guard
• R2.6 Constant-time secret comparison
• R2.7 Secure cookie & CORS hygiene
• R2.8 No unsafe code or HTML sinks (brevio-core scan)

R3: Billing and money

• R3.1 Idempotent webhook processing
• R3.2 Monetary integer representation (harness pre-flight)
• R3.3 Gateway ID discrimination
• R3.4 Pre-execution quota enforcement
• R3.5 Transactional outbox

R4: Database and migrations

• R4.1 Expand-contract migrations
• R4.2 Foreign-key & tenant composite indexing
• R4.3 N+1 query prevention
• R4.4 Ingestion FK pre-resolution
• R4.5 Bounded pagination

R5: Reliability and fallbacks

• R5.1 Deterministic graceful fallbacks
• R5.2 HTTP empty-body hygiene
• R5.3 Bounded retry with jitter
• R5.4 No silent exception swallowing (brevio-core scan)
• R5.5 Process & lock safety (brevio-core scan)

R6: Testing and hermeticity

• R6.1 Real production import gate (harness pre-flight)
• R6.2 Mutation side-effect assertions (harness pre-flight)
• R6.3 Deterministic condition waits (brevio-core scan) (preview)
• R6.4 Hermetic test state isolation
• R6.5 Post-incident regression crystallization

R7: Architecture and contracts

• R7.1 Contract-first monorepo changes
• R7.2 Granular field validation
• R7.3 Single canonical route per path
• R7.4 Acyclic module layering
• R7.5 Universal contracts purity (harness pre-flight)

R8: Marketing and attribution

• R8.1 Anti-cloaking & markdown parity
• R8.2 Honest telemetry attribution
• R8.3 Consent Mode v2 ordering

R9: Type safety

• R9.1 No untyped escape hatches (brevio-core scan)
• R9.2 No silenced type errors (brevio-core scan)
• R9.3 Package-name imports (harness pre-flight)

R10: API and network robustness

• R10.1 Explicit HTTP request timeouts (brevio-core scan)
• R10.2 Idempotency key transmission
• R10.3 Rate-limit header handling
• R10.4 Structured error envelope
• R10.5 Response size bounding
• R10.6 Content-Type negotiation
• R10.7 No unauthenticated admin endpoints
• R10.8 Strict HTTP verb mapping

R11: State and concurrency

• R11.1 Atomic read-modify-write
• R11.2 No dangling unawaited promises
• R11.3 Race condition prevention
• R11.4 Deterministic reducer purity
• R11.5 Cache key stability
• R11.6 Optimistic UI rollback
• R11.7 Bounded in-memory queues
• R11.8 Thread-safe singleton initialization

R12: Memory and resource leaks

• R12.1 Event listener teardown
• R12.2 Timer lifecycle cleanup
• R12.3 Stream disposal hygiene
• R12.4 WebSocket cleanup
• R12.5 Database connection pool hygiene
• R12.6 Worker thread termination
• R12.7 Temp file deterministic deletion
• R12.8 No unbounded collection growth

R13: Observability and logging

• R13.1 Zero secret logging (brevio-core scan)
• R13.2 Structured JSON logging
• R13.3 Trace context propagation
• R13.4 Metric label cardinality bounding
• R13.5 Standard log severity
• R13.6 Audit event journaling
• R13.7 Health check hermeticity
• R13.8 Exception traceback containment

R14: Auth and sessions

• R14.1 Session token entropy
• R14.2 Password hash modern algorithms
• R14.3 Token expiration bounding
• R14.4 CSRF token validation
• R14.5 No credentials in URLs
• R14.6 Strict redirect URL allowlist
• R14.7 Brute-force throttle
• R14.8 Role-based access control

R15: Error boundaries and fallback rendering

• R15.1 React error boundary protection
• R15.2 Non-blocking third-party failures
• R15.3 Form submit recovery
• R15.4 Image broken state fallback
• R15.5 Network offline banner
• R15.6 Empty state affordance
• R15.7 Skeleton loader transition
• R15.8 Recoverable 404 navigation

R16: Supply chain

• R16.1 Lockfile integrity enforcement
• R16.2 No wildcard dependency versions (brevio-core scan)
• R16.3 Scoped internal packages
• R16.4 No install script execution
• R16.5 Production bundle minimization
• R16.6 License compliance
• R16.7 Single package manager
• R16.8 Deterministic engine constraints

R17: React and Next.js patterns

• R17.1 Server Component default
• R17.2 No server-only code in client (brevio-core scan)
• R17.3 Metadata API compliance
• R17.4 Next/Image usage
• R17.5 Next/Font optimization
• R17.6 Client boundary minimization
• R17.7 Server action security
• R17.8 Route handler return typing

R18: Accessibility (WCAG 2.1 AA)

• R18.1 Meaningful image alternative text (brevio-core scan)
• R18.2 Form control labels (brevio-core scan)
• R18.3 Keyboard navigation accessibility
• R18.4 Contrast ratio minimum
• R18.5 No click handlers on non-interactive elements (brevio-core scan)
• R18.6 Aria attributes validity
• R18.7 Visible focus rings
• R18.8 Document language attribute

R19: Clean code

• R19.1 Function length limit
• R19.2 Cyclomatic complexity bounding
• R19.3 No dead commented-out code
• R19.4 Descriptive variable naming