fs
576a0c51cd
Add architecture test ViewLayerOutputEscapingContractTest that flags raw <?php echo in .phtml files. Legitimate uses (pre-built ARIA attrs from navActive(), hardcoded role values, pre-rendered HTML fragments) must carry an inline // raw-html-ok: reason marker. Annotated all 11 existing raw echo sites with justification markers. Added guard to catalog, enforcement map (automated), CLAUDE.md security section, and never-do-this list. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
181 lines
4.8 KiB
JSON
181 lines
4.8 KiB
JSON
{
|
|
"version": "1.0.0",
|
|
"entries": [
|
|
{
|
|
"guard_id": "GR-CORE-003",
|
|
"enforcement_mode": "automated",
|
|
"evidence_source": [
|
|
"tests/Architecture/CoreStarterkitContractTest.php"
|
|
]
|
|
},
|
|
{
|
|
"guard_id": "GR-CORE-007",
|
|
"enforcement_mode": "hybrid",
|
|
"evidence_source": [
|
|
"tests/Architecture/ApiSchemaContractTest.php",
|
|
".agents/runs/<TASK>/review-code.json"
|
|
]
|
|
},
|
|
{
|
|
"guard_id": "GR-CORE-010",
|
|
"enforcement_mode": "automated",
|
|
"evidence_source": [
|
|
"tests/Architecture/DatabaseUpdatesContractTest.php"
|
|
]
|
|
},
|
|
{
|
|
"guard_id": "GR-CORE-011",
|
|
"enforcement_mode": "reviewer",
|
|
"evidence_source": [
|
|
".agents/runs/<TASK>/review-code.json"
|
|
]
|
|
},
|
|
{
|
|
"guard_id": "GR-CORE-012",
|
|
"enforcement_mode": "automated",
|
|
"evidence_source": [
|
|
"tests/Architecture/PostRedirectGetContractTest.php"
|
|
]
|
|
},
|
|
{
|
|
"guard_id": "GR-TEST-001",
|
|
"enforcement_mode": "reviewer",
|
|
"evidence_source": [
|
|
".agents/runs/<TASK>/review-code.json",
|
|
".agents/runs/<TASK>/review-acceptance.json"
|
|
]
|
|
},
|
|
{
|
|
"guard_id": "GR-TEST-002",
|
|
"enforcement_mode": "hybrid",
|
|
"evidence_source": [
|
|
"tests/Architecture/CoreStarterkitContractTest.php",
|
|
".agents/runs/<TASK>/review-code.json"
|
|
]
|
|
},
|
|
{
|
|
"guard_id": "GR-UI-014",
|
|
"enforcement_mode": "reviewer",
|
|
"evidence_source": [
|
|
".agents/runs/<TASK>/review-code.json",
|
|
".agents/runs/<TASK>/review-acceptance.json"
|
|
]
|
|
},
|
|
{
|
|
"guard_id": "GR-UI-LIST",
|
|
"enforcement_mode": "automated",
|
|
"evidence_source": [
|
|
"tests/Architecture/ListDataEndpointContractTest.php",
|
|
"tests/Architecture/ListTemplateContractTest.php"
|
|
]
|
|
},
|
|
{
|
|
"guard_id": "GR-UI-DETAIL",
|
|
"enforcement_mode": "automated",
|
|
"evidence_source": [
|
|
"tests/Architecture/DetailPageRuntimeContractTest.php",
|
|
"tests/Architecture/DetailActionPolicyRuntimeContractTest.php"
|
|
]
|
|
},
|
|
{
|
|
"guard_id": "GR-UI-A11Y",
|
|
"enforcement_mode": "automated",
|
|
"evidence_source": [
|
|
"tests/Architecture/AuthLoginTemplateAccessibilityContractTest.php",
|
|
"tests/Architecture/AuthLoginFieldAccessibilityContractTest.php"
|
|
]
|
|
},
|
|
{
|
|
"guard_id": "GR-UI-I18N",
|
|
"enforcement_mode": "automated",
|
|
"evidence_source": [
|
|
"tests/Architecture/I18nKeyCompletenessContractTest.php",
|
|
"tests/Architecture/ModuleI18nContractTest.php"
|
|
]
|
|
},
|
|
{
|
|
"guard_id": "GR-UI-REUSE",
|
|
"enforcement_mode": "hybrid",
|
|
"evidence_source": [
|
|
"tests/Architecture/CoreStarterkitContractTest.php",
|
|
".agents/runs/<TASK>/review-code.json"
|
|
]
|
|
},
|
|
{
|
|
"guard_id": "GR-SEC-001",
|
|
"enforcement_mode": "automated",
|
|
"evidence_source": [
|
|
"tests/Architecture/PostEndpointCsrfContractTest.php"
|
|
]
|
|
},
|
|
{
|
|
"guard_id": "GR-SEC-002",
|
|
"enforcement_mode": "automated",
|
|
"evidence_source": [
|
|
"tests/Architecture/SecurityLoggingRedactionContractTest.php",
|
|
"tests/Architecture/SecurityLoggingTelemetryContractTest.php"
|
|
]
|
|
},
|
|
{
|
|
"guard_id": "GR-SEC-003",
|
|
"enforcement_mode": "reviewer",
|
|
"evidence_source": [
|
|
".agents/runs/<TASK>/review-security.json"
|
|
]
|
|
},
|
|
{
|
|
"guard_id": "GR-SEC-004",
|
|
"enforcement_mode": "automated",
|
|
"evidence_source": [
|
|
"tests/Architecture/SecurityRemoteAssetContractTest.php"
|
|
]
|
|
},
|
|
{
|
|
"guard_id": "GR-SEC-005",
|
|
"enforcement_mode": "automated",
|
|
"evidence_source": [
|
|
"tests/Architecture/SecurityCryptoContractTest.php"
|
|
]
|
|
},
|
|
{
|
|
"guard_id": "GR-SEC-006",
|
|
"enforcement_mode": "hybrid",
|
|
"evidence_source": [
|
|
"tests/Architecture/FileStorageContractTest.php",
|
|
".agents/runs/<TASK>/review-security.json"
|
|
]
|
|
},
|
|
{
|
|
"guard_id": "GR-SEC-007",
|
|
"enforcement_mode": "automated",
|
|
"evidence_source": [
|
|
"tests/Architecture/ApiSessionIsolationContractTest.php"
|
|
]
|
|
},
|
|
{
|
|
"guard_id": "GR-SEC-008",
|
|
"enforcement_mode": "hybrid",
|
|
"evidence_source": [
|
|
"tests/Architecture/AuthzAdminUsersContractTest.php",
|
|
"tests/Architecture/AuthzApiBootstrapContractTest.php",
|
|
".agents/runs/<TASK>/review-security.json"
|
|
]
|
|
},
|
|
{
|
|
"guard_id": "GR-SEC-009",
|
|
"enforcement_mode": "hybrid",
|
|
"evidence_source": [
|
|
"tests/Architecture/ApiResourceContractTest.php",
|
|
".agents/runs/<TASK>/review-security.json"
|
|
]
|
|
},
|
|
{
|
|
"guard_id": "GR-SEC-010",
|
|
"enforcement_mode": "automated",
|
|
"evidence_source": [
|
|
"tests/Architecture/ViewLayerOutputEscapingContractTest.php"
|
|
]
|
|
}
|
|
]
|
|
}
|